In the course of migrating our internal CA we first the old server up and running in order to allow clients to download the CRl from the URL hardcoded in already issued certificates. Meanwhile the old server has been removed completely and there is merely a little virtual webhost active with its name with the sole purpose of delivering the CRL to clients.
I hope that this construct will become unnecessary when all old certificates are replaced (in a year or so). However, it would be nice to speed this process, e.g., by issuing new certificates ahead of time where applicable. To thius end, I would like to find out: When I see (from the web logs) a client retrieve the CRL, I can conclude that the client wanted to verify the validity of some (old) certificate. But how can I find out (not at the CA, but at the client maybe) which certificate the client wanted to verify?