if(ca) { int ca_ret; ca_ret = ca_check(x); if(!ca_ret) return 0;  if(x->ex_flags & EXFLAG_NSCERT) { if(x->ex_nscert & NS_SSL_CA) return ca_ret; return 0; } if(ca_ret != 2) return ca_ret; else return 0; }
if(ca) return check_ssl_ca(x);
static int check_purpose_ssl_client(X509_PURPOSE *xp, X509 *x, int ca){	if(xku_reject(x,XKU_SSL_CLIENT)) return 0;	if(ca) {		int ca_ret;		ca_ret = ca_check(x);		if(!ca_ret) return 0;		/* check nsCertType if present */		if(x->ex_flags & EXFLAG_NSCERT) {			if(x->ex_nscert & NS_SSL_CA) return ca_ret;			return 0;		}		if(ca_ret != 2) return ca_ret;		else return 0;	}	/* We need to do digital signatures with it */	if(ku_reject(x,KU_DIGITAL_SIGNATURE)) return 0;	/* nsCertType if present should allow SSL client use */		if(ns_reject(x, NS_SSL_CLIENT)) return 0;	return 1;}