diff --git a/spring-vault-core/src/main/java/org/springframework/vault/core/VaultPkiOperations.java b/spring-vault-core/src/main/java/org/springframework/vault/core/VaultPkiOperations.java
index 27daec6f..d7adc213 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/core/VaultPkiOperations.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/core/VaultPkiOperations.java
@@ -17,6 +17,7 @@ package org.springframework.vault.core;
 
 import java.io.InputStream;
 
+import org.springframework.lang.Nullable;
 import org.springframework.vault.VaultException;
 import org.springframework.vault.support.CertificateBundle;
 import org.springframework.vault.support.VaultCertificateRequest;
@@ -93,12 +94,17 @@ public interface VaultPkiOperations {
 	 * CRL distribution points extension in a CA certificate. This is a bare endpoint that
 	 * does not return a standard Vault data structure. Returns data {@link Encoding#DER}
 	 * or {@link Encoding#PEM} encoded.
+	 * <p>
+	 * If Vault reports no content under the CRL URL, then the result of this method call
+	 * is {@literal null}.
 	 *
-	 * @return {@link java.io.InputStream} containing the encoded CRL.
+	 * @return {@link java.io.InputStream} containing the encoded CRL or {@literal null}
+	 * if Vault responds with 204 No Content.
 	 * @since 2.0
 	 * @see <a href="https://www.vaultproject.io/api/secret/pki/index.html#read-crl">GET
 	 * /pki/crl</a>
 	 */
+	@Nullable
 	InputStream getCrl(Encoding encoding) throws VaultException;
 
 	enum Encoding {
diff --git a/spring-vault-core/src/main/java/org/springframework/vault/core/VaultPkiTemplate.java b/spring-vault-core/src/main/java/org/springframework/vault/core/VaultPkiTemplate.java
index f1e73c8c..8f41bdfb 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/core/VaultPkiTemplate.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/core/VaultPkiTemplate.java
@@ -22,6 +22,7 @@ import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
 
+import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
@@ -141,7 +142,11 @@ public class VaultPkiTemplate implements VaultPkiOperations {
 				ResponseEntity<byte[]> response = restOperations.getForEntity(requestPath,
 						byte[].class, path);
 
-				return new ByteArrayInputStream(response.getBody());
+				if (response.getStatusCode() == HttpStatus.OK) {
+					return new ByteArrayInputStream(response.getBody());
+				}
+
+				return null;
 			}
 			catch (HttpStatusCodeException e) {
 				throw VaultResponses.buildException(e);