Function effective_revoked_list_path 

pub fn effective_revoked_list_path(
    data_dir: &Path,
    configured_crl_path: Option<&str>,
) -> PathBuf

The revoked-fingerprint list the WSS verifier will actually read: the operator’s [wss.client_auth].crl_path when set, otherwise the ledger default under <data_dir>/tls/revoked.

Revocation must materialize to THIS path. Materializing to the default while the verifier honours a configured override lets revoke-client-cert report success while the next handshake still accepts the certificate — the transport design of record requires revocation to fail closed.