s_client and s_server take -verify_{host,email,ip}, not -check*