add KEEP_PEER_CERT flag for non opensslextra peer cert storage, ssn3