I dug a little deeper and put some debug printing into the code.

It's actually returning a:
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY

Perhaps this only happens when the server cert is not self-signed. I'm running https with a GeoTrust issued cert.

I think we may need to use SSL_get_peer_cert_chain and go through the list of certs in order to get an OK return code. I'm not really sure how to do this, but I may come back and look at it later.

As a temporary kludge to remove the annoyance, I think I will just comment out the prompt code, as it's not really necessary unless you are worried about someone spoofing your cert, which, if you're just hitting "a" every time, doesn't really matter anyway.