OCSP and CRL settings for High Sierra

It seems like this article no longer applies for High Sierra and needs to be updated: Keychain for Mac: Change validation settings for certificates using Keychain Access. I don't see the options to require CRL and OCSP checks in Keychain like there were prior to High Sierra and would like to know if that's still configurable elsewhere.

Also I'm having trouble adding CRL files to a Keychain. I know I've done it before in the Terminal, I think with openssl but would like to use whatever method Apple recommends now and haven't had any luck with security or spctl and I'm not sure crlrefresh is doing anything.