diff --git a/gnmi_server/clientCertAuth.go b/gnmi_server/clientCertAuth.go
index 381a915e1..51a240eb0 100644
--- a/gnmi_server/clientCertAuth.go
+++ b/gnmi_server/clientCertAuth.go
@@ -160,15 +160,20 @@ func TryDownload(url string) bool {
 	glog.Infof("Download CRL start: %s", url)
 	resp, err := http.Get(url)
 
-	if resp != nil {
+	if resp != nil && resp.Body != nil {
 		defer resp.Body.Close()
 	}
 
-	if err != nil || resp.StatusCode != http.StatusOK {
+	if err != nil {
 		glog.Infof("Download CRL: %s failed: %v", url, err)
 		return false
 	}
 
+	if resp.StatusCode != http.StatusOK {
+		glog.Infof("Download CRL: %s failed: HTTP %d", url, resp.StatusCode)
+		return false
+	}
+
 	crlContent, err := io.ReadAll(resp.Body)
 	if err != nil {
 		glog.Infof("Download CRL: %s failed: %v", url, err)
diff --git a/gnmi_server/crl_test.go b/gnmi_server/crl_test.go
index a77dbb12f..046402a26 100644
--- a/gnmi_server/crl_test.go
+++ b/gnmi_server/crl_test.go
@@ -12,6 +12,8 @@ import (
 	"github.com/sonic-net/sonic-gnmi/common_utils"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"testing"
 	"time"
@@ -248,3 +250,27 @@ func TestTryDownload(t *testing.T) {
 		t.Errorf("Download should failed: %v", downloaded)
 	}
 }
+
+func TestTryDownloadRedirectError(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, "/redirect", http.StatusFound)
+	}))
+	defer server.Close()
+
+	downloaded := TryDownload(server.URL)
+	if downloaded {
+		t.Errorf("Download should fail on redirect loop")
+	}
+}
+
+func TestTryDownloadNonOKResponse(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "not found", http.StatusNotFound)
+	}))
+	defer server.Close()
+
+	downloaded := TryDownload(server.URL)
+	if downloaded {
+		t.Errorf("Download should fail on non-OK response")
+	}
+}