used, instead of TLSv1+. Similar fix for the "pfs" setting. Report and tests by Mikolaj Kucharski, ok sthen@