- make FIPS mode keygen bit length restriction enforced only when OPENSSL_ENFORCE_MODULUS_BITS is set
- do not include ECC ciphersuites in SSLv2 client hello (#1090952) - fail on hmac integrity check if the .hmac file is empty