Tidy certificate verification logic under OpenSSL