Support Certificate Revocation List in embedded web server SSL configuration

When using SSL client authentication, the ability to revoke and reject a client certificate is useful to ensure that a leaked certificate is no longer able to authenticate with the service without having to create a new CA and truststore.

In Ssl.java add a crlFile attribute as path to the CRL file

In TomcatEmbeddedServletContainerFactory.java#configureSsl (or arguably in TomcatEmbeddedServletContainerFactory.java#configureSslClientAuth only if clientAuth is need or want since the crlFile is used to validate clients) call protocol.setCrlFile

Jetty's SslContextFactory supports setting a crlPath

Undertow looks not so much to support it out of the box, however it does allow TrustManager configuration so the equivalent of org.apache.tomcat.util.net.jsse.JSSESocketFactory#getTrustManagers could be added in UndertowEmbeddedServletContainerFactory

Start in Ssl.java to trace the SSL configuration attributes, then inspect configureSsl and configureSslClientAuth in TomcatEmbeddedServletContainerFactory.java. Compare the CRL-related APIs available in Tomcat, Jetty, and Undertow, including Undertow's TrustManager configuration. Done means CRL configuration is supported across the relevant embedded servers and client certificates listed in the CRL are rejected.