I'd also like to see tests around:

- [ ] bad ca chain
- [ ] revoked server certificate

I know @bkerley has made some of those for the Ruby client, they might be instructive.