Bug#829272: [openssl-dev] [openssl.org #4602] Missing accessors

[Salz, Rich]

> That's exactly what we currently do, we provide a verification callback, but
> we do need to be able to set the failing cert in a chain for that.

Stick it in EXDAT?