Since all reseed hosts now have proper certificates with matching CNs, I'm
making this script enforce a stricter policy, requiring matching CNs.

Script would return 0 even connecting to the remote host failed.

It now works with either gnutls or openssl, and both gnutls v2 and gnutls v3.