I need to figure out the difference between their class 1 and class3 certs, unless someone here already knows.
They have some info at:
http://wiki.cacert.org/FAQ/TechnicalQuestions
Also, the signature algorithms differ; the older class1 uses RSA-MD5 whereas the newer class3 uses RSA-SHA256.
Sha2-256 might be the issue you hit.
-JimC