It seems like this is a "problem" with specific versions of Windows which may not have access to the Internet. We found that the problem "went away" most of the time when we gave the client machine access to the Internet.
[speculation]
Windows has a "Trusted Root" certificate bundle that gets updates periodically -- I've got to believe that there is some kind of timer mechanism that maintains the validity of this bundle - perhaps it is signed by a Microsoft certificate. I haven't checked that out yet.
Regardless, what seems to happen is that the self-signed certificates work fine until some magical date is hit. I am guessing that this date corresponds to the expiration of the Trusted Root certificates bundle. When that expires, Windows tries to hit the Internet to check or update its bundle. If the Internet connection fails, or the system is unable to reach the source of the bundle, it tosses a warning (error?) back to whichever application/service requested validation of a certificate. If this specific warning/error is not handled, it causes a critical certificate validation error -- or maybe the ceritifcate validation subsystem kicks back an "invalid certificate" message -- I suspect this is what "134217857" represents.
By explicitly trusting the self-signed certificate as a Trusted Root certificate, you shortcut the general validation process and eliminate whatever code path leads to that error.
[/speculation]
This is the best explanation I've been able to come up with so far. I'm still collecting data in mt "spare time" 