Move verification errors into x509_vfy

Refs #1140.

Cc @ayrx: it may be a good idea to test this since it touches the
special constant that was secretly added to Fedora 20's OpenSSL 1.0.1e.
2 files changed