Restarting Apache regularly is needed as a workaround for Apache not
re-reading certificate revocation lists (CRLs); the only way to get
Apache to pick up changes to those, is to restart Apache.  If you do
not do so, Apache will just let the loaded CRLs expire and start to
refuse client certificates issued by those CAs.