diff --git a/pkg/smokescreen/config.go b/pkg/smokescreen/config.go
index 74b09d49..0fd5e14f 100644
--- a/pkg/smokescreen/config.go
+++ b/pkg/smokescreen/config.go
@@ -484,7 +484,7 @@ func (config *Config) SetupCrls(crlFiles []string) error {
 
 		certList, err := x509.ParseCRL(crlBytes)
 		if err != nil {
-			log.Printf("Failed to parse CRL in '%s': %#v\n", crlFile, err)
+			return fmt.Errorf("failed to parse CRL in '%s': %w", crlFile, err)
 		}
 
 		// find the X509v3 Authority Key Identifier in the extensions (2.5.29.35)
diff --git a/pkg/smokescreen/crl_test.go b/pkg/smokescreen/crl_test.go
new file mode 100644
index 00000000..c2414e01
--- /dev/null
+++ b/pkg/smokescreen/crl_test.go
@@ -0,0 +1,34 @@
+//go:build !nounit
+// +build !nounit
+
+package smokescreen
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// A CRL file that does not parse should be reported as a configuration error,
+// not dereferenced.
+func TestSetupCrlsRejectsUnparseableFile(t *testing.T) {
+	crlFile := filepath.Join(t.TempDir(), "bad.crl")
+	require.NoError(t, os.WriteFile(crlFile, []byte("this is not a CRL"), 0600))
+
+	conf := NewConfig()
+	err := conf.SetupCrls([]string{crlFile})
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), crlFile)
+}
+
+func TestSetupCrlsReportsAMissingFile(t *testing.T) {
+	conf := NewConfig()
+
+	err := conf.SetupCrls([]string{filepath.Join(t.TempDir(), "absent.crl")})
+
+	assert.Error(t, err)
+}