3444768 - Kernel cannot parse CRL; check CRL Format when running S_TRUST_DOWNLOAD_CRL report

Running the report S_TRUST_DOWNLOAD_CRL and facing "The kernel was not able to parse the CRL. The system has already downloaded the CRL and checked the signature. The CRL is either ill formed or uses a format not supported by the certificate revocation check" 

dev_w* trace has the following:

N  ==> krn_SsfParseCRL()
M  ThEppGetConnectionCounter: read connectionCounter 0 from epp 0
N  *** ERROR => OUT SsfParseCRL() result/CRC: 45 (SSF_API_CRL_CRITICAL_ISSUINGDISTPOINT) [ssfxxkrn.c   10260]
...
N  <== krn_SsfParseCRL()==0 (SSF_KRN_OK)

• SAP NetWeaver

STRUSTCR041, SSF_API_CRL_CRITICAL_ISSUINGDISTPOINT, S_TRUST_DOWNLOAD_CRL , KBA , BC-SEC-SSF , Secure Store and Forward , BC-SEC-SSL , Secure Sockets Layer Protocol , BC-IAM-SSO-CCL , CommonCryptoLib , Problem