offending record queued as 'pending'. The DTLS code doesn't expect this,
and we end up hitting an OPENSSL_assert() in do_dtls1_write().

The simple fix is just _not_ to leave it queued. In DTLS, dropping
packets is perfectly acceptable -- and even preferable. If we wanted a
service with retries and guaranteed delivery, we'd be using TCP.
PR: #1703
Submitted by: David Woodhouse <dwmw2@infradead.org>

and should avoid any OS date limitations such as the year 2038 bug.

Submitted by: Amadeu A. Barbosa Jr <amadeu@tecgraf.puc-rio.br>

enable disabled ciphersuites.

Also, fix CHANGES (consistency with stable branch).

PR: 1648

overall.
PR: 1604

Submitted by: Nagendra Modadugu

Also, "CHANGES" clean-ups.

PR: 1632

strength "FIPS" to represent all FIPS approved ciphersuites without NULL
encryption.

they are used for mac computation.

test suite.

a delta CRL in addition to a full CRL. Check and search delta in addition to
the base.

Tidy CRL scoring system.

Add new CRL path validation error.

and don't unnecessarily fail on input size 0.

PR: 1679

and CRL signing keys.

CRL issuer is not part of the main path.

Not complete yet and not compiled in because the CRL issuer certificate is
not validated.

Delete X509_POLICY_REF code.

Fix handling of invalid policy extensions to return the correct error.

Add command line option to inhibit policy mappings.