@Override
    public void apply(final X509CRL crl) throws ExpiredCRLException {
        val cutoff = ZonedDateTime.now(ZoneOffset.UTC);
        if (CertUtils.isExpired(crl, cutoff)) {
            if (CertUtils.isExpired(crl, cutoff.minusSeconds(this.threshold))) {
                throw new ExpiredCRLException(crl.toString(), cutoff, this.threshold);
            }
            LOGGER.info("CRL expired on [{}] but is within threshold period, [{}] seconds.",
                crl.getNextUpdate(), this.threshold);
        }
    }
{@inheritDoc}
The CRL next update time is compared against the current time with the threshold
applied and rejected if and only if the next update time is in the past.

@param crl CRL instance to evaluate.
@throws ExpiredCRLException On expired CRL data. Check the exception type for exact details
support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/revocation/policy/ThresholdExpiredCRLRevocationPolicy.java