use crl_reason_t definition from <credentials/certificates/crl.h>