Here is a simplified version of the C function. It uses y* or es# "ascii" to parse the argument.

The check for trailing data ensures that the user gets an error message if she tries to load a PEM string with multiple certs. She might expect that add_ca_cert(pem) loads all PEM certs from the string while in fact PEM_read_bio_X509() only loads the first cert. The new patch make the check optional.

I still need to find a good name for the option, though...