Some dude named Tavis Ormandy reported a bug which has gone unfixed.
http://marc.info/?l=openssl-users&m=138014120223264&w=2
Arguably a doc bug, but we argue not. If you parse a new cert into memory
occupied by a previously verified cert, the new cert will inherit that
state, bypassing future verification checks. To avoid this, we will always
start fresh with a new object.

grudging ok from guenther, after i threatened to make him read the code yet
again. "that ok was way more painful and tiring then it should have been"
use the portable construct around asprintf; pointed out by halex
Finish zapping SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION usage; only keep
the #define for compat, but document that it's a no-op now.  Also, neuter
the -legacy_renegotiation option to "openssl s_{client,server}"

ok beck@
Document support for "openssl s_client -starttls lmtp"
remove include files not needed
guenther would prefer more separation
this file is not relevant
Put back i2d_ASN1_SET() and d2i_ASN1_SET() from the NO_ASN1_OLD prune, as there
are still some 3rd-party code using it, and fixing them is not trivial.

As an excuse gift, the memory leaks on failure in resurrected a_set.c have
been fixed.
delete "string to make the random number generator think it has entropy"
another "string to make the random number generator think it has entropy"
another
Check the return value of make_config_name() before attempting to use
the config filename.

ok beck@
Use the cleaned up asprintf-based make_config_name() to make the name of
the config file instead of the malloc/BUF_strlcpy/BUF_strlcat calls with
no return value checks (that make_config_name() also used to do prior to
being cleaned up).

ok beck@