Partially deopaque SSL_CTX to support a pyopenssl use case

 fixes #783