SSL_SECOP_CA_MD
#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER)
if (!ssl_security_cert_sig(ctx, ssl, x509, SSL_SECOP_CA_MD)) {