cstp: Don't call dtls_reconnect() when DTLS is disabled

dtls_reconnect() will change dtls_state from DTLS_DISABLED to
DTLS_SLEEPING.  This generates a bunch of spurious "No DTLS address"
errors.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
openssl: Skip password prompt on unencrypted PKCS#12 files

This brings the OpenSSL load_pkcs12_certificate() behavior in line with
GnuTLS behavior.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
openssl: Support unencrypted PKCS#8 private keys

This is verified working with the output from
"openssl pkcs12 -in foo.p12 -nodes" (v1.0.1).

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
http: Handle gateways that skip TLS cert requests on initial connect

Some gateways do not send the TLS client certificate request until they
know that AnyConnect (not a web browser) is connecting from the remote
IP.  In this case it can be problematic to use HTTP keepalive, since
authentication may proceed without giving the client an opportunity to
present its certificate.

So, to be safe, when certs are being used we will defer the use of HTTP
keepalive until the gateway sends the auth form or we've answered an
XML <client-cert-request>.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>