I'm using nginx(1.1.9) for serving debian packages on https by using client certificate feature.

listen 443 ssl;

...

ssl_certificate /etc/ssl/ca.chain.crt; ssl_certificate_key /etc/ssl/server.key; #ssl_crl /etc/ssl/ca-crl.pem; ssl_client_certificate /etc/ssl/ca.pem; ssl_verify_client on; ssl_verify_depth 2;
ssl_protocols SSLv2 SSLv3 TLSv1 TLSv1.1;

...

error_log /var/log/nginx/error.log debug; ...

I use reprepro to config an apt repo.I can use apt-get update to this repo without any error but when I comment out ssl_crl in order to use revocation list. Log display

client SSL certificate verify error: (3:unable to get certificate CRL) while reading client request headers, client: xxx.xxx.xxx.xxx, server: apt.myrepo.com, request: "GET /ubuntu/dists/precise/non-free/i18n/Translation-en HTTP/1.1", host: "apt.myrepo.com"

I'm not sure why nginx can find my certificate revocation list.