Bug 993377: pin openssl to the version in 'updates'; r=Callek