Remove retired Thawte/Verisign certificates.
Remove intermediate GoDaddy certificate, this file should just contain roots.

ok beck@ phessler@
Regenerate the text information for all certificates with recent openssl
and include sha1 signatures for all certs (some were missing).

No certificate changes, this is just for consistency.  ok beck@
Additional CA root certificates: GeoTrust/Equifax, Go Daddy, StartCom, thawte.
ok beck@ william@ todd@
New CA root certificates, ok beck@.

- additional cert's from GlobalSign.

- additional cert's from VeriSign and replace existing ones with
'Signature Algorithm: md2WithRSAEncryption' with their currently
distributed sha1WithRSAEncryption versions.

- new CAs: AddTrust (root for most Comodo certificates also heavily
used in academic networks), Comodo (most of their certs are rooted in
AddTrust but TERENA use the Comodo AAA Certificate Services root
for some things so add that separately), UserTrust Network/UTN
(part of Comodo) and Starfield (part of Go Daddy).
remove ACSS, crank libcrypto major; ok markus@ deraadt@
cherry pick bugfixes for http://www.openssl.org/news/secadv_20130205.txt
from the openssl git (changes between openssl 1.0.1c and 1.0.1d).
ok djm@
This commit was manufactured by cvs2git to create branch 'OPENSSL'.

Cherrypick from master 2013-02-14 15:11:44 UTC markus 'cherry pick bugfixes for http://www.openssl.org/news/secadv_20130205.txt':
    src/lib/libssl/src/ssl/s3_cbc.c
Switch to using unhyphenated VIA padlock mnemonics.  VIA abandoned the
hyphen in their official programming guide sometime between 2003 and
2005, and Clang's integrated assembler does not support hyphenated
mnemonics.

ok jsg, deraadt
VAX ELF userland bits. Consists mostly of register prefix additions.
Remove no longer needed vax CFLAGS workarounds.
Switch time_t, ino_t, clock_t, and struct kevent's ident and data
members to 64bit types.  Assign new syscall numbers for (almost
all) the syscalls that involve the affected types, including anything
with time_t, timeval, itimerval, timespec, rusage, dirent, stat,
or kevent arguments.  Add a d_off member to struct dirent and replace
getdirentries() with getdents(), thus immensely simplifying and
accelerating telldir/seekdir.  Build perl with -DBIG_TIME.

Bump the major on every single base library: the compat bits included
here are only good enough to make the transition; the T32 compat
option will be burned as soon as we've reached the new world are
are happy with the snapshots for all architectures.

DANGER: ABI incompatibility.  Updating to this kernel requires extra
work or you won't be able to login: install a snapshot instead.

Much assistance in fixing userland issues from deraadt@ and tedu@
and build assistance from todd@ and otto@
Reliability fix for SHA384 SSL/TLS ciphers on strict alignment
architectures.  ok miod@ djm@

Upstream patch:
    commit cdd1acd788020d2c525331da1712ada778f1373c
    Author: Andy Polyakov <appro@openssl.org>
    Date:   Wed Dec 18 21:27:35 2013 +0100
Install a bunch more of OpenSSL manpages.  ok deraadt@
SECURITY fixes backported from openssl-1.0.1f.  ok mikeb@

CVE-2013-4353 NULL pointer dereference with crafted Next Protocol
 Negotiation record in TLS handshake.
Upstream: 197e0ea

CVE-2013-6449 Fix crash with crafted traffic from a TLS 1.2 client.
Upstream: ca98926, 0294b2b

CVE-2013-6450 Fix DTLS retransmission from previous session.
Upstream: 3462896
prepare manpages for new perl.
Note that I missed two of these in the diff shown initially, thx
to the atrocious Makefile rule...

okay millert@, sthen@, basically
prevent failed command from generating bogus file
okay guenther@
* Fix another instance of directly writing to the target with a utility
that might fail.
* Keep the build log clean.
* Make sure syntax checks run again when doing:  make clean; make
ok espie@
Retire hp300, mvme68k and mvme88k ports. These ports have no users, keeping
this hardware alive is becoming increasingly difficult, and I should heed the
message sent by the three disks which have died on me over the last few days.

Noone sane will mourn these ports anyway. So long, and thanks for the fish.
cherrypick fix for CVE-2014-0160 "heartbleed" vulnerability from
OpenSSL git; ok sthen@
Use root CAs that are used by TeleSec (Deutsche Telekom AG):

- Baltimore CyberTrust Root
- Deutsche Telekom Root CA 2
- T-TeleSec GlobalRoot Class 2
- T-TeleSec GlobalRoot Class 3

ok sthen@