openssl verification/ca fixes

default to always verify peer (even on windows)
only use bundled cert as last resort (after attempting default config from OpenSSL)
closes #212