SSL_SECOP_CA_KEY
{ "Certificate chain CA key", SSL_SECOP_CA_KEY },
#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)
if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_CA_KEY | vfy))