The reason for it is that when CE receives the response and before write to cache, it will do a dns lookup to make sure the corresponding ip address of the hostname matches the ip address of the server that served the request (in this case, icap daemon), except for healing requests, icp requests, proxy requests, and requests going to outgoing proxy, for which we will automatically make them "cert checked" ok. In the case of response coming back from icap daemon, the hostname will not
match the the ip address of icap daemon (127.0.0.1), so the cached copy is not "cert checked". When the next request hits on the object, seeing the object is not "cert checked", it will try to the cert check again, and this time, it will consider the object as corrupted if "cert check" fails, and go to origin server again. That is the reason there is no hit with ICAP enabled.
