EAP-TLS & deny access?

[uhel at gmx.net]

Hi,

how can i deny access to a user (a certificate)? 
Is a CRL (with the CA_path and c_rehash stuff) the only possibility to
deny access or is it possible to have a *whitelist* (like the CA_path
and c_rehash stuff but as a whitelist) with certs that are allowed? 

I'm using Freeradius 1.1.7 with EAP-TLS which works fine so far. I'm
not using any SQL or LDAP backend only the *users* file. 

-- 
regards uHel