+1 for the creative same-origin+redirect approach

You can determine which openssl.cnf is being used by adding a spurious XXX to the file and see if openssl chokes.

Here is how you could emulate an if-else-block: