SSL_SECOP_CA_MD
{ "Certificate chain CA digest", SSL_SECOP_CA_MD },
case SSL_SECOP_CA_MD:
#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
if (!ssl_security_cert_sig(s, ctx, x, SSL_SECOP_CA_MD | vfy))