public function getCrlUrl() {
    if ($this->crlUrl === self::AUTOLOAD) {
      $this->crlUrl = NULL; // Default if we can't find something else.
      $caCertObj = X509Util::loadCACert($this->getCaCert());
      // There can be multiple DPs, but in practice CiviRootCA only has one.
      $crlDPs = $caCertObj->getExtension('id-ce-cRLDistributionPoints');
      if (is_array($crlDPs)) {
        foreach ($crlDPs as $crlDP) {
          foreach ($crlDP['distributionPoint']['fullName'] as $fullName) {
            if (isset($fullName['uniformResourceIdentifier'])) {
              $this->crlUrl = $fullName['uniformResourceIdentifier'];
              break 2;
            }
          }
        }
      }
    }
    return $this->crlUrl;
  }