The tests now actually check that a specific certificate is being used by only
loading the correct one into the trust chain while running the test. The
problem before was that openssl-req by default generates CA-capable certs which
are not accepted by rustls.