AWS Private CA now supports an option to omit the CDP extension from issued certificates, when CRL revocation is enabled.