--- a/mercurial/sslutil.py	Fri Jul 01 19:04:39 2016 -0700
+++ b/mercurial/sslutil.py	Fri Jul 01 19:17:45 2016 -0700
@@ -195,7 +195,7 @@
                 if not os.path.exists(cafile):
                     raise error.Abort(_('could not find web.cacerts: %s') %
                                       cafile)
-            else:
+            elif s['allowloaddefaultcerts']:
                 # CAs not defined in config. Try to find system bundles.
                 cafile = _defaultcacerts(ui)
                 if cafile: