>> I'm trying to figure out how the subject options relate to each other. I
>> found the following on the mailing is from 2003:
>
>There is two verifications done:
>...

Thanks. That was elucidating, and I believe I understand it now.

I have embellished the man page so I believe it's clear to people with less
SSL background. The patch is attached.

I looked at the source code too, and it does not seem to implement
verifyhost == 1 as documented. It seems to make verifyhost == 1
identical to verifyhost == 0 except for a debugging message when
there's no Common Name.