that are disabled for this session (as opposed to always disabled by
configuration).

2% less instructions in SIMD code paths, so 2% improvement in average:-)

details in s_client.

Also add ctrl to set client certificate types. If not used sensible values
will be included based on supported signature algorithms: for example if
we don't include any DSA signing algorithms the DSA certificate type is
omitted.

Fix restriction in old code where certificate types would be truncated
if it exceeded TLS_CT_NUMBER.

Add aliases for SSL_CTX_set_not_resumable_session_callback and
SSL_set_not_resumable_session_callback on top of that.

Reported by: David McCullough <david_mccullough@mcafee.com>

Restore fips configuration module from 0.9.8.

Always perform nexproto callback argument initialisation in s_server
otherwise we use uninitialised data if -nocert is specified.

the permitted signature algorithms for server and client authentication
are the same but it is now possible to set different algorithms for client
authentication only.

PR: 2837

is required by client or server. An application can decide which
certificate chain to present based on arbitrary criteria: for example
supported signature algorithms. Add very simple example to s_server.
This fixes many of the problems and restrictions of the existing client
certificate callback: for example you can now clear existing certificates
and specify the whole chain.

appropriate checks in tls1_check_chain.

the certificate can be used for (if anything). Set valid_flags field
in new tls1_check_chain function. Simplify ssl_set_cert_masks which used
to have similar checks in it.

Add new "cert_flags" field to CERT structure and include a "strict mode".
This enforces some TLS certificate requirements (such as only permitting
certificate signature algorithms contained in the supported algorithms
extension) which some implementations ignore: this option should be used
with caution as it could cause interoperability issues.