static int get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl,
			X509_NAME *nm, STACK_OF(X509_CRL) *crls)
	{
	int i, crl_score, best_score = -1;
	X509_CRL *crl, *best_crl = NULL;
	X509 *crl_issuer, *best_crl_issuer = NULL;
	for (i = 0; i < sk_X509_CRL_num(crls); i++)
		{
		int imatch = 1;
		crl_score = 0;
		crl_issuer = NULL;
		crl = sk_X509_CRL_value(crls, i);
		if (nm && X509_NAME_cmp(nm, X509_CRL_get_issuer(crl)))
			{
			/* Issuer name does not match: could be indirect */
			if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT))
				continue;
			if (!(crl->idp_flags & IDP_INDIRECT))
				continue;
			imatch = 0;
			}
		if (check_crl_time(ctx, crl, 0))
			crl_score |= CRL_SCORE_TIME;

		if (crl->idp_flags & IDP_PRESENT)
			{
			if (crl->idp_flags & IDP_REJECT)
				continue;
			if (idp_check_scope(ctx->current_cert, crl, &imatch))
				crl_score |= CRL_SCORE_SCOPE;
			}
		else
			crl_score |= CRL_SCORE_SCOPE;

		/* If no issuer match at this point try next CRL */
		if (!imatch)
			continue;

		if (crl_akid_check(ctx, crl, &crl_issuer))
			crl_score |= CRL_SCORE_AKID;
		/* If CRL matches criteria and issuer is not different use it */
		if (crl_score == CRL_SCORE_ALL && !crl_issuer)
			{
			*pcrl = crl;
			CRYPTO_add(&crl->references, 1, CRYPTO_LOCK_X509_CRL);
			return 1;
			}

		if (crl_score > best_score)
			{
			best_crl = crl;
			best_crl_issuer = crl_issuer;
			best_score = crl_score;
			}
		}
	if (best_crl)
		{
		*pcrl = best_crl;
		ctx->current_issuer = best_crl_issuer;
		CRYPTO_add(&best_crl->references, 1, CRYPTO_LOCK_X509);
		}

	return 0;
	}