The puppetserver ca import command should initialize a CRL for the intermediate CA

Setting Puppet Server up to operate an intermediate CA that is issued by an external CA requires supplying the puppetserver ca import command with a complete chain of certificates and certificate revocation lists for the intermediate CA and the external CA that signed it. The external CA can provide the certificates and some of the certificate revocation lists, but generating a revocation list for the intermediate CA operated by Puppet Server requires access to the private key used by Puppet Server. Most external CAs will be incapable of providing this revocation list as transporting the private key between nodes is against best practices.

Therefore, the puppetserver ca import command should initialize an empty CRL for Puppet's intermediate CA if it detects one has not been provided in the crl chain from the external root.