Okay, I'll take a look at that.  Was thinking another reason you could get a failure would be if the client library thought that the PEM file were malformed for some reason -- i.e., that we had committed an improperly generated cert and hadn't noticed that because the previous tests were using the keystore instead.  Maybe I'm being too paranoid...