pkcs11: when checking for presence do not give up on the first mismatch
tests: check gnutls_pkcs11_crt_is_known() when multiple same DNs are present
address memory leak in gnutls_pkcs11_crt_is_known()
corrected remove_pkcs11_url()
tests: corrected check with gnutls_x509_trust_list_get_issuer
added FIPS140-2 DH verification functions
removed unused definition
added FIPS140-2 ECDH verification functions
pkcs11: when no CKA_ID can be relied on fallback on checking the SubjectKeyIdentifier

Patch by David Woodhouse.
Return an error if multiple PKCS11 URLs are added to a trust list

Before, the new URL would overwrite the old URL, and the memory of theold URL
would be leaked. It is documented that only one URL can be used, so it should
be safe to reject any attempt to add another one.

Signed-off-by: Armin Burgmeier <armin@arbur.net>
Also iterate over the CA certificates in a PKCS11 token

Signed-off-by: Armin Burgmeier <armin@arbur.net>
Add a test for PKCS11 CA iteration

Signed-off-by: Armin Burgmeier <armin@arbur.net>
pkcs11: always check for a valid subjectKeyIdentifier match

That way, expired certificates can co-exist with their replacements.
pkcs11: do not shortcut checks when GNUTLS_PKCS11_OBJ_FLAG_COMPARE_KEY is specified
certtool: only set the authority key identifier, if there is a corresponding subject key identifier
tests: corrected test for v1 cert signing (removed bogus authorityIdentifier)
Added gnutls_record_discard_queued()

That function allows to discard queued data in DTLS.
tests: added check for gnutls_record_discard_queued()
doc update
corrected the name of exported function