trusted store instead of the default which is to return an error if
we can't build the complete chain.

Just a sample, real world applications would have to be cleverer.

Use -1 to check all extensions in CRLs.
Always set flag for freshest CRL.

Add new verify options to set checks.

Remove previous -check* commands from s_client and s_server.

is needed to test some profiles/protocols which reject certificates
with unsupported versions.