You should not need to do this manually.. You'll get in a bit of a mess. Endian isn't really deigned for doing things manually.
From the GUI
VPN/Cetificates/Certificate Revocation List
The CRL will update each time you Revoke a certificate and is available for download.
Or you can obtain the CRL cert directly here (after revoking the certs)
/var/efw/vpn/ca/crl.pem