verify logic to try to use an unexpired CRL if possible.

Use cross reference table in ASN1_item_sign(), ASN1_item_verify() to eliminate
the need for algorithm specific code.

PR:662

initial serial numbers.

PR: 842

Use BUF_strlcat() instead of strcat().
Use BIO_snprintf() instead of sprintf().
In some cases, keep better track of buffer lengths.
This is part of a large change submitted by Markus Friedl <markus@openbsd.org>

to apps.c, and give it the hopefully descriptive name parse_yesno().

rationale behind the move is that it's use by several applications.
The rationale behind the name change is that it describes what the
function does a bit better.

to 'openssl req' and 'openssl ca'.

PR: 779
Submitted by: Michael Bell <michael.bell@cms.hu-berlin.de>
Reviewed by: Richard Levitte

(there will be some follow-up changes)

PR: 780
Submitted by: Verdon Walker <VWalker@novell.com>
Reviewed by: Richard Levitte

I have tried to convert 'len' type variable declarations to unsigned as a
means to address these warnings when appropriate, but when in doubt I have
used casts in the comparisons instead. The better solution (that would get
us all lynched by API users) would be to go through and convert all the
function prototypes and structure definitions to use unsigned variables
except when signed is necessary. The proliferation of (signed) "int" for
strictly non-negative uses is unfortunate.

platforms that don't (necessarely) have it.  In the case of VMS, this
means moving a couple of functions from apps/ to crypto/ and make them
general (although only used privately).

Contributed in whole by Laurent Genier <Laurent.Genier@intrinsec.com>
PR: 644

rotate_serial() that works like rotate_index().

the CA certificate part of the CA database, and combined with
'unique_subject=no', it should make operations like CA certificate
roll-over easier.

hasn't been tested in a long while...

subject.

PR: 287

PR: 481

Make sure key is not NULL before freeing it.

This patch was taken from the OpenBSD copy of OpenSSL 0.9.7 beta3 with patches

exit() in whatever way works for the intended platform, and define
OPENSSL_EXIT() to have the old meaning (the name is of course because
it's only used in the openssl program)

I've covered all the memset()s I felt safe modifying, but may have missed some.

apps.h.  For those, it's better to include apps.h after the system
headers where those symbols may be defined, since there's otherwise a
chance that the C compiler will barf when it sees something that looks
like this after expansion:

int VMS_strcasecmp((str1),(str2))(const char *, const char *);

requirement that the serial number always be an even amount of characters.
PR: 248