Use ERR_get_error to get last SSL error in openssl.d

[cifvts]

Getting last error should return an error code which is easier to understand
when translated into a error string

[s-ludwig]

I think we may need two versions of enforceSSL and carefully check the documentation of each function for which of the two error codes is actually set. Alternatively, just querying both and displaying only the one(s) that indicate an error would be an option.

[cifvts]

I tried to understand the difference and to me it looks that SSL_get_error() return code is not meant to work with ERR_error_string().

[cifvts]

I dug more into this:

• SSL_get_error() returns a generic SSL Error but the error stays in the error queue so it may affects later calls;
• SSL_get_error() returns the error of the SSL object which is generic error;
• ERR_get_error() returns the correct error code for ERR_error_string() and removes that error from the error queue.

So the right approach IMHO would be to check if an error exists using SSL_get_error() and then get the error (or the errors) using ERR_get_error().

[cifvts]

Trying to refactor the patch I saw there is no need to check both function, we already know an error exists and we only need to give the user a proper error string so he can understand why SSL failed. Using ERR_get_error() / ERR_error_string() we do the job.

[s-ludwig]

Sounds reasonable, thanks for looking up the details. I'll add an additional loop that collects and logs and additional errors in the queue and only throws the last one, just to be sure.