I don't have an opinion about the ssl_crl stuff. Everything else looksgood to me.
======Kind Regards,Peter Smith.Fujitsu Australia.