check revocation prior to reading local certs.

diff --git a/lib/system.c b/lib/system.c
index b79bbd085636d7820ad331dee41016bac200df33..1c73fc05319bab2c5ed0200c817c4134695f799a 100644 (file)
--- a/lib/system.c
+++ b/lib/system.c
@@ -540,14 +540,14 @@ int add_system_trust(gnutls_x509_trust_list_t list, unsigned int tl_flags, unsig
   if (ret >= 0)
     r += ret;
 
-  ret = load_dir_certs("/data/misc/keychain/cacerts-added/", list, tl_flags, tl_vflags, GNUTLS_X509_FMT_DER);
-  if (ret >= 0)
-    r += ret;
-    
   ret = load_revoked_certs(list, GNUTLS_X509_FMT_DER);
   if (ret >= 0)
     r -= ret;
 
+  ret = load_dir_certs("/data/misc/keychain/cacerts-added/", list, tl_flags, tl_vflags, GNUTLS_X509_FMT_DER);
+  if (ret >= 0)
+    r += ret;
+
   return r;
 }
 #else