When setting up CRLs, SSLManagerOpenSSL only sets the X509_V_FLAG_CRL_CHECK flag,  which only "enables CRL checking for the certificate chain leaf certificate" (source).

Consequently, peer certificate chains containing intermediate issuers that were revoked may still succeed in establishing SSL connection. We should add the X509_V_FLAG_CRL_CHECK_ALL flag to enable CRL checking for the entire certificate chain.