error strings and a hash table storing per-thread error state) go via an
ERR_FNS function table. The first time an ERR operation occurs, the
implementation that will be used (from then on) is set to the internal
"defaults" implementation if it has not already been set. The actual LHASH
tables are only accessed by this implementation.

This is primarily for modules that can be loaded at run-time and bound into
an application (or a shared-library version of OpenSSL). If the module has
its own statically-linked copy of OpenSSL code - this mechanism allows it
to *not* create and use ERR information in its own linked "ERR" code, but
instead to use and interact with the state stored in the loader
(application or shared library). The loader calls ERR_get_implementation()
and the return value is what the module should use when calling its own
copy of ERR_set_implementation().

counts in DH, DSA, and RSA structures. Instead they use the new "***_up()"
functions that handle this.

dependant code has to directly increment the "references" value of each
such structure using the corresponding lock. Apart from code duplication,
this provided no "REF_CHECK/REF_PRINT" checking and violated
encapsulation.

(found by Massimiliano Pala <madwolf@hackmasters.net>).

connection so it can prompt for pass phrase on startup
instead of after the first connection.

Add -port switch to usage message.

Hopefully it is clear enough, that it is currently not recommended.

don't disturb the rehashing process.
Spotted and suggested patch from Rudo Thomas <rudo@internet.sk>

Make -passin -passout etc work again.

Fix leak in ca.c when using -passin.

Add CRL utility functions to allow CRLs to be
built up without accessing structures directly.

Update ca.c to use new functions.

Fix ca.c so it now build CRLs correctly again.