"但第一个验证我无法避免" -- Of course, how are you supposed to do authentication without the ca cert that signs the server cert? :-)