Force no SSL2 when custom extensions in use.
Don't clear extension state when cert is set.
Clear on renegotiate.