- crash: use TLSv1.2 if possible, TLS1 at worst
- crash: checkin vanilla dh files