OpenSSL: fix double-expansion of tls_verify_certificates