There are several NIST PKITS tests that fail involving indirect CRLs. These should be
fixed. They can be categorized as follows:

4.14.24, 4.14.25, 4.14.26, 4.14.27, 4.14.28, 4.14.30, 4.14.33

  These tests fail because the current code does not build a certification path for the
  CRL issuer.

4.14.29

  This test fails because the current code does not handle relative names in
  Distribution Points correctly.

4.14.31, 4.14.32

  These tests fail because the current code recognizes the CertificateIssuer
  extension but does not remove it from the unresolved extensions.