nss: make crl_der allocated on heap