Add real SSL questions

There are actually a whole bunch of expected cases that I'm (knowingly) not handling yet. That'll be my next CL. I'll add a NOTREACHED there for the UNKNOWN case, since once they are handled then we really shouldn't get other cases.