backport 1.0.1j fixes to 0.6.x

Handle PKCS12 decrypt failures with OpenSSL 1.0.1j