Certification verification

Hi,
  this is my last stopover before release. I wrote a patch to start
doing certificate verification, see
https://github.com/freddy77/freetds/commit/557caf0e0af1c385d6cfd1602f593f9683ed6fc8.

Now the problem is when to check. If a mssql is installed without
certificate a dummy certificate (self signed with a
"Self_Signed_Fallback" common name) is generate every time the sql
instance is started (not during the install so you cannot cache the
certificate of a given server). So there is no way to check these
certificates, FreeTDS (and MSSQL driver too) has to accept by default
these certificates.
The patch add two options to freetds.conf, "ca file" and "crl file",
respectively the file containing the root authorities and the
certificates revocation list (list of certificates to not accept). So
the key of the patch is: if you specify CA list you want to check
certificate, if not accept any certificates sent. Now, the questions
are:
- should FreeTDS check the common name (with server name inside) of
the certificate?
- should I add an option to disable name verification?
- should I read system CA list so to check the global list installed
in the system? I don't know if this is useful, are mssql with proper
certificate using a public CA?

Regards,
  Frediano