diff --git a/debian-package/debian/changelog b/debian-package/debian/changelog
index 2f2344a..f94c677 100644
--- a/debian-package/debian/changelog
+++ b/debian-package/debian/changelog
@@ -1,3 +1,12 @@
+vpn-router (0.33.4-1) unstable; urgency=medium
+
+  fix: OpenVPN starts on a new router, as setup installs CRLs that revoke nothing.
+
+  * A CRL without revoked certificates is installed for strongSwan and
+    OpenVPN.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Wed, 28 Oct 2026 22:00:00 +0100
+
 vpn-router (0.33.3-1) unstable; urgency=medium
 
   fix: vpn-router-setup runs on a new installation once libpq can be found.
diff --git a/debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py b/debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py
index 622145f..21e114c 100644
--- a/debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py
+++ b/debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py
@@ -722,7 +722,7 @@ def install_crls(connection):
     crls = {}
     for name, file in SWANCTL_CA_FILES.items():
         entry = authority(connection, name)
-        crls[name] = entry['crl'].public_bytes(serialization.Encoding.PEM) if entry and entry['crl'] else None
+        crls[name] = entry['crl'].public_bytes(serialization.Encoding.PEM) if entry and entry['crl'] is not None else None
         changed |= write(X509CRL_DIR / file, crls[name], 0o644) if crls[name] else remove(X509CRL_DIR / file)
     if crls['root'] and crls['p2s']:
         changed |= write(OPENVPN_CRL, crls['root'] + crls['p2s'], 0o644)