The validate routines in the choria TLS handling can eat the exception when openssl fails validation - it should capture the original message.
This is around the validate name / ca validation utilities - particularly if the name / identity doesn't match the CN/a SAN, mco will complain that the certificate "wasn't signed by the CA", which was false.