Reorg SSL options and clear cert_store before adding CAs