I'm okay with the current behavior so long as we're getting a failure for the right reason.  When I wrote these tests originally, I inspected the wire traffic in Wireshark to see that SSL protocol exchange looked consistent with the failures I was expecting to have happen -- for a little more confidence that my tests were valid.  I could run that through locally if that seems useful.