+1 for not using OS provided SSL. OpenSSL itself is broken enough, old version of broken stuff just tend do to be even more broken.