Clarify negative return from X509_verify_cert()

OpenSSL internally for certificate validation, in both the S/MIME and

SSL/TLS code.

The negative return value from X509_verify_cert() can only occur if no

certificate is set in B<ctx> (due to a programming error); if X509_verify_cert()

twice without reinitialising B<ctx> in between; or if a retry

operation is requested during internal lookups (which never happens with

standard lookup methods). It is however recommended that application check

for <= 0 return value on error.

A negative return value from X509_verify_cert() can occur if it is invoked

incorrectly, such as with no certificate set in B<ctx>, or when it is called

twice in succession without reinitialising B<ctx> for the second call.

A negative return value can also happen due to internal resource problems or if

a retry operation is requested during internal lookups (which never happens

with standard lookup methods).

Applications must check for <= 0 return value on error.

=head1 BUGS