Here we go – looks like before any application data is sent, the CRL is check using http. This one is going to the RootCA

Another CRL request to R2.

59