There seems to be problems in the way the OpenSSL contexts and all the related objects are handled. Here's a summary of the valgrind:
1 cert
==21055== LEAK SUMMARY:
==21055== definitely lost: 0 bytes in 0 blocks
==21055== indirectly lost: 0 bytes in 0 blocks
==21055== possibly lost: 0 bytes in 0 blocks
==21055== still reachable: 96,936 bytes in 2,922 blocks
==21055== suppressed: 0 bytes in 0 blocks
10 certs
==27546== LEAK SUMMARY:
==27546== definitely lost: 1,656 bytes in 9 blocks
==27546== indirectly lost: 44,275 bytes in 1,147 blocks
==27546== possibly lost: 24 bytes in 1 blocks
==27546== still reachable: 198,976 bytes in 4,510 blocks
==27546== suppressed: 0 bytes in 0 blocks
100 certs
==31289== LEAK SUMMARY:
==31289== definitely lost: 18,216 bytes in 99 blocks
==31289== indirectly lost: 488,065 bytes in 12,667 blocks
==31289== possibly lost: 24 bytes in 1 blocks
==31289== still reachable: 1,218,676 bytes in 20,350 blocks
==31289== suppressed: 0 bytes in 0 blocks
1000 certs
==784== LEAK SUMMARY:
==784== definitely lost: 183,816 bytes in 999 blocks
==784== indirectly lost: 4,920,954 bytes in 127,703 blocks
==784== possibly lost: 6,576 bytes in 162 blocks
==784== still reachable: 11,417,625 bytes in 178,753 blocks
==784== suppressed: 0 bytes in 0 blocks
As you can see it scales linearly with the number of certs starting from 10. My OpenSSL fu is nil so I can't see what is missing, or even if it's supposed to be like that.
Thanks,