I would prefer a check for "and the resulting string is non-empty" (or some "is this boolean true ?" test).
If the environment variable is set but empty, getenv() returns an empty string, not NULL.
So, in my shell, if I've exported CFENGINE_TEST_PURIFY_OPENSSL, setting it back to empty doesn't turn this feature off; I need to explicitly unexport the environment variable.  This shall be an easy thing to get wrong.  (In bash, export -n NAME; in dash (commonly used as sh), unset NAME; not sure what, if anything, does it in csh; but the main problem is that it'll catch someone out when they thought clearing the variable, by setting it empty, would suffice.)