(cherry picked from commit 406d4af0)

PR#3014
(cherry picked from commit 11da66f8)

PR#2783
(cherry picked from commit b36f35cd)

OIDs with one component don't have an encoding.

PR#2556 (Bug#1)
(cherry picked from commit 95791bf9)

PR#3374
(cherry picked from commit 0436369f)

Document that the certificate passed to SSL_CTX_add_extra_chain_cert()
should not be freed by the application.

PR#3409
(cherry picked from commit 0535c2d6)

PR#3403
(cherry picked from commit d2aea038)

(cherry picked from commit 7be6b27a)

PR#3410
(cherry picked from commit e14e764c0d5d469da63d0819c6ffc0e1e9e7f0bb)

This ensures high performance is situations when assembler supports
AVX2, but not AD*X.
(cherry picked from commit f3f620e1)

Resolved conflicts:

	crypto/bn/asm/rsaz-avx2.pl

(cherry picked from commit 7b8c8c4d)

(cherry picked from commit a48fb040)

(cherry picked from commit 29edebe9)

Just store NUL-terminated strings.  This works better when we add
support for multiple hostnames.
(cherry picked from commit b3012c69)

(cherry picked from commit d241b804)

This is to compensate for higher aes* instruction latency on Cortex-A57.
(cherry picked from commit 015364ba)

(cherry picked from commit 0f777aeb)

In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays.

Bug discovered and fixed by Miod Vallat from the OpenBSD team.

PR#3375

This reverts commit 3d860774.

Incorrect attribution.

properly built.

algorithms MD2 and RC5 don't get built.
Also, disable building the test apps in crypto/des and crypto/pkcs7, as
they have no support at all.

(cherry picked from commit 50cc4f7b)

(cherry picked from commit 1f61d8b5)

Spaces were added in some strings for better readability.  However, those spaces do not belong in file names, so when picking out the individual parts, remove the spaces

(cherry picked from commit 9024b84b)

(cherry picked from commit d435e23959f1c2cb4feadbfba9ad884c59f37db9)

Allow CCS after finished has been sent by client: at this point
keys have been correctly set up so it is OK to accept CCS from
server. Without this renegotiation can sometimes fail.

PR#3400
(cherry picked from commit 99cd6a91fcb0931feaebbb4832681d40a66fad41)

(cherry picked from commit ce00c64d)

compiler supports it.  Otherwise, there are warnings about it lacking
everywhere, which is quite tedious to read through while trying to check
for other warnings.

Partly provided by Zoltan Arpadffy <arpadffy@polarhome.com>

PR: 3405
(cherry picked from commit 91a6bf80)

PR: 3405
(cherry picked from commit c9cf29cc)

Based on an original patch by Joel Sing (OpenBSD) who also originally identified the issue.

This reverts commit 728bd41a.

Missing attribution.

A client reference identity of ".example.com" matches a server
certificate presented identity that is any sub-domain of "example.com"
(e.g. "www.sub.example.com).

With the X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS flag, it matches
only direct child sub-domains (e.g. "www.sub.example.com").
(cherry picked from commit e52c52f10bb8e34aaf8f28f3e5b56939e8f6b357)