diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index fb477e42ee..688e9ca9bd 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -713,6 +713,10 @@ EOD;
 		$ipsecconf .= "# This file is automatically generated. Do not edit\n";
 		$ipsecconf .= "config setup\n\tuniqueids = {$uniqueids}\n";
 		$ipsecconf .= "\tcharondebug=\"" . vpn_ipsec_configure_loglevels(true) . "\"\n";
+		
+		if (isset($config['ipsec']['strictcrlpolicy'])) {
+			$ipsecconf .= "\tstrictcrlpolicy = yes \n";
+		}
 
 		if (!isset($config['ipsec']['noshuntlaninterfaces'])) {
 			if ($config['interfaces']['lan']) {
diff --git a/usr/local/www/vpn_ipsec_settings.php b/usr/local/www/vpn_ipsec_settings.php
index 8b31f5757a..c0eaba64a7 100644
--- a/usr/local/www/vpn_ipsec_settings.php
+++ b/usr/local/www/vpn_ipsec_settings.php
@@ -47,6 +47,7 @@ foreach ($ipsec_loglevels as $lkey => $ldescr) {
 	}
 }
 $pconfig['unityplugin'] = isset($config['ipsec']['unityplugin']);
+$pconfig['strictcrlpolicy'] = isset($config['ipsec']['strictcrlpolicy']);
 $pconfig['makebeforebreak'] = isset($config['ipsec']['makebeforebreak']);
 $pconfig['noshuntlaninterfaces'] = isset($config['ipsec']['noshuntlaninterfaces']);
 $pconfig['compression'] = isset($config['ipsec']['compression']);
@@ -161,6 +162,12 @@ if ($_POST) {
 			$needsrestart = true;
 			unset($config['ipsec']['unityplugin']);
 		}
+		
+		if ($_POST['strictcrlpolicy'] == "yes") {
+			$config['ipsec']['strictcrlpolicy'] = true;
+		} else {
+			unset($config['ipsec']['strictcrlpolicy']);
+		}
 
 		if ($_POST['makebeforebreak'] == "yes") {
 			$config['ipsec']['makebeforebreak'] = true;
@@ -392,6 +399,15 @@ function maxmss_checked(obj) {
 							<?=gettext("Disable Unity Plugin which provides Cisco Extension support as Split-Include, Split-Exclude, Split-Dns, ..."); ?>
 						</td>
 					</tr>
+					<tr>
+						<td width="22%" valign="top" class="vncell"><?=gettext("Strict CRL Checking"); ?></td>
+						<td width="78%" class="vtable">
+							<input name="strictcrlpolicy" type="checkbox" id="strictcrlpolicy" value="yes" <?php if ($pconfig['strictcrlpolicy'] == true) echo "checked=\"checked\""; ?> />
+							<strong><?=gettext("Enable strict Certificate Revocation List checking"); ?></strong>
+							<br />
+							<?=gettext("Check this to require availability of a fresh CRL for peer authentication based on RSA signatures to succeed."); ?>
+						</td>
+					</tr>
 					<tr>
 						<td width="22%" valign="top" class="vncell"><?=gettext("Make before Break"); ?></td>
 						<td width="78%" class="vtable">