Question about Validation Credentials and digital signatures   

Hi,
I have a Web Service that is expecting a digitally signed soap message and a X509 (according to WS-security). To verify the signature I have configured a "Verify" action in to the processing policy and inside that action I have specified the necessary validation credentials.

My Validation Credentials consist of 3 CA certificates and for those 3 CA:s I have configured CRL update policies in to the default domain. This is working as supposed.

Now when I send a message to this service that is signed with a certificate that is not issued by any of my three CA:s I get an error saying:

<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/">
	<env:Body>
		<env:Fault>
			<faultcode>env:Client</faultcode>
			<faultstring>unable to get certificate CRL (from client)</faultstring>
		</env:Fault>
	</env:Body>
</env:Envelope>

Is this the expected behaviour? To me it feels strange that you would even look for a CRL list if the certificate issuing CA is not on the list of approved CA:s.

But I do require CRL check for the approved certificates. If the CRL list expires and a new one can not be downloaded for some reason, I do want to block the access to the service. So I dont want to turn "Requre CRLs" attribute to off.