Rewrite TBSCertificate, using the new OpenSSL-1.0.2 API

The API around CT changed in 1.0.2-dev. Now that 1.0.2-beta3 is out, this should be stable and good to go.
Could these local temp vars could be const (der_length here & elsewhere, index, etc.) ?