> The validation check happens deep inside X509_verify_cert() in libcrypto. > It should be possible to add some verbosity, but OpenSSL's error reporting > functions make my head spin. X509_verify_cert_error_string() might help you.