store instead of the default which is to return an error if we can't build
the complete chain. [backport from HEAD]

Use -1 to check all extensions in CRLs.
Always set flag for freshest CRL.

Submitted by: jean-etienne.schwartz@bull.net

In OCSP_basic_varify return an error if X509_STORE_CTX_init fails.

Submitted by: Dmitry Belyavsky <beldmit@gmail.com>

Fix DH double free if parameter generation fails.

Submitted by: Florian Weimer

Submitted by: "Florian Rüchel" <florian.ruechel@ruhr-uni-bochum.de>

Correctly handle local machine keys in the capi ENGINE.

PR: 2896

Submitted by: Adam Langley

Submitted by: Adam Langley

  debugging code that's seldom used.

Submitted by: Chromium Authors

PR: 2874
Submitted by: Tomas Mraz

change the current certificate (in s->cert->key) to the one used and then
SSL_get_certificate and SSL_get_privatekey will automatically work.

right response is stapled. Also change SSL_get_certificate() so it
returns the certificate actually sent.  See
http://rt.openssl.org/Ticket/Display.html?id=2836.