* Fix a slight bug in the state-machine. This caused the client end of a

  tunnel to not pro-actively close down when failing an SSL handshake.

* Change the cert-chain callback - originally this was the same one used in
  s_client and s_server but the output's as ugly as sin, so I've prettied
  tunala's copy output up a bit (and made the output level configurable).

* Remove the superfluous "errors" from the SSL state callback - these are just
  non-blocking side-effects.