OpenSSL: avoid loading server's CA-list-for-client-notification on client