config: normalize opt names to underscores

TLS options were the only ones requiring dashes.

Define everything with underscores but accept both formats.