I believe there are two forms of cert checking. One is that there is a valid cert, and the other is making sure that the cert's validation chain terminates in one of the root certs. Do you know which one this is?

The checking down to the root cert is hard (in general) because most runtimes (like PHP and the .NET Mono engine) don't hook into the OS's root cert store by default. This means that if your enable root cert checking, it will fail for runtimes unless the user also hooks up the root certs. I don't know what the appropriate behavior is there (how do we make it work by default yet keep people safe from man-in-the-middle attacks?)