Use new SSL_CONF options in demo. Add intermediate and root CAs and
update all to use SHA256.
Reviewed-by: NViktor Dukhovni <viktor@openssl.org>