Ran across the reason for this apparently backward behavior: it's not a bug; it's because the value for DefaultSslCertCheckMode is a set of flags, not a single boolean, and the flag with value 1 is DisableClientCertRevocationCheck. ---kyle From http://msdn.microsoft.com/en-us/library/ms689452...