Client authentication will continue to work with the most recently downloaded CRL file. The TMX will only replace a working CRL file with a new CRL file if the new CRL file is valid. The bottom line is that the TMX needs at least one valid CRL file. The only way that the CRL file would prevent client authentication from working is if a valid file was never downloaded. When you execute the "ssl settings crl" command, the TMX will download the initial CRL file, so you will be able to tell at that point if there was an initial problem.