SSL mode with Intermediate Certificate Authorities and CRLS seems broken

Here's a problem I and some others have been wrestling with. The problem was presented by a PostgreSQL Experts client. If you want to play along, here are the test files I have been using. Included is a root Certificate Authority certificate, an Intermedfiate Certificate Authority certificate signed by the root CA, a server certificate and key and two client certificates and associated keys, and a revocation certificate which revokes the second client certificate. The server certificate, client certificates and revocation certificate are all signed by the Intermediate CA. The client certificates are for a user named "andrew"

Our test platform is PostgreSQL 9.1 built with openssl, and a config setting of 'ssl = on', a user and database both named "andrew" and the following pg_hba.conf line:

hostssl   all  all 127.0.0.1/32 cert

All the binaries are under $INSTALL and so is the data directory.

To install the server certificates (but not the CRL just yet) we do:

cat root.crt > $INSTALL/data/root.crt
cat server.crt ra.crt > $INSTALL/data/server.crt
cat server.key > $INSTALL/data/server.key
$INSTALL/bin/pg_ctl -D $INSTALL/data -l $INSTALL/logfile -w start

Next we test both client certificates are working:

$ $INSTALL/bin/psql 'host=localhost sslmode=verify-ca sslcert=client.crt sslkey=client.key sslrootcert=root.crt'
psql (9.1.3)
SSL connection (cipher: DHE-RSA-AES256-SHA, bits: 256)
Type "help" for help.

andrew=# \q
$ $INSTALL/bin/psql 'host=localhost sslmode=verify-ca sslcert=client2.crt sslkey=client2.key sslrootcert=root.crt'
psql (9.1.3)
SSL connection (cipher: DHE-RSA-AES256-SHA, bits: 256)
Type "help" for help.

andrew=# \q
$ 

So far, so good. Now let's install the revocation certificate

cat cli2.crl > $INSTALL/data/root.crl
$INSTALL/bin/pg_ctl -D $INSTALL/data -l $INSTALL/logfile -w restart

Is the revocation effective?

$ $INSTALL/bin/psql 'host=localhost sslmode=verify-ca sslcert=client2.crt sslkey=client2.key sslrootcert=root.crt'
psql: SSL error: sslv3 alert certificate revoked
$

Yes, it sure is. So let's make sure we can still use the unrevoked certificate:

$ $INSTALL/bin/psql 'host=localhost sslmode=verify-ca sslcert=client.crt sslkey=client.key sslrootcert=root.crt'
psql: SSL error: tlsv1 alert unknown ca
$

Oops! That's not supposed to happen!

Anyone who can shed some light on what's going on here would earn at least some gratitude from me. I don't think I'm doing anything wrong, but I could certainly be missing something. This looks like a nasty bug, but I'm not sure if it's a bug in Postgres or in OpenSSL.