Looks like there are some broken LibreSSL implementations #1127.

Let's start with test_tls_cli_conn_change_cert and tls_conn_change_cert, this does not work within libressl since SSL_certs_clear is not supported (There is usually a good reason why LibreSSL drops some APIs, mostly for security maintenance reasons).

tlstest: TEST_STRCMP: /home/sreimers/projekte/baresip/baresip-linux/re/test/tls.c:539: failed
expected string: (21 bytes)
"Mr Retest Client Cert"
actual string: (9 bytes)
"127.0.0.1"

After studying the usage, I wonder why the ssl object is changed and not the ssl ctx before (or a new one used)? Since within tls_start_tcp a new ssl object is created from ctx. This way SSL_certs_clear can be avoided, I think.

We should keep all SSL implementations very generic.

@cHuberCoffee