Require at least OpenSSL 1.0.0

Also enable SHA256 and SHA512 if necessary.
Require empty CAfile name to signal no trusted CAs

Adjust tests accordingly.  This allows us to catch
any actual errors loading the CAfile.

Also improve error handling and layout of main().