Functests show that verify_cert_file needs CA chain.

Functional testing shows that the verify_cert_file for the CM agent
needs the whole CA cert chain in the file, otherwise you end up with
messages in both the CM agent and server logs complaining about:
 client: SSLError: (32, 'Broken pipe')
 server: javax.net.ssl.SSLHandshakeException: Received fatal alert:
         unknown_ca
Also added example tests for tls_client and tls_server.