make X509_CRL opaque