Make sure the FIPS startup KAT selftest run for ECDSA (#1673919)

Backported --sni-hostname option which allows overriding the hostname
Improved counter-measures in TLS CBC record padding for lucky13 attack
2018-10844, #1589704, CVE-2018-10845, #1589707)
Added counter-measures for "Just in Time" PRIME + PROBE cache-based attack
2018-10846, #1589708)
Address p11tool issue in object deletion in batch mode (#1375307)
Backport PKCS#11 tests from master branch. Some tests were disabled due to
-load-pubkey and --test-sign options, ECC key
p11tool explicitly marks certificates and public keys as NOT private objects
Enlarge buffer size to support resumption with large keys (#1542461)
Legacy HMAC-SHA384 cipher suites were disabled by default
Added DSA key generation to p11tool (#1464896)
Address session renegotiation issue using client certificate (#1434091)
Address issue when importing private keys into Atos HSM (#1460125)

Address crash in OCSP status request extension, by eliminating the
2017-7507, #1455828)

Address interoperability issue with 3.5.x (#1388932)
Reject CAs which are both trusted and blacklisted in trust module (#1375303)
Added new functions to set issuer and subject ID in certificates (#1378373)
Reject connections with less than 1024-bit DH parameters (#1335931)
Fix issue that made GnuTLS parse only the first 32 extensions (#1383748)
Mention limitations of certtool in manpage (#1375463)
Read PKCS#8 files with HMAC-SHA256 -as generated by openssl 1.1 (#1380642)
Do not link directly to trousers but instead use dlopen (#1379739)
Fix incorrect OCSP validation (#1377569)
Added support for pin-value in PKCS#11 URIs (#1379283)
Added the --id option to p11tool (#1399232)
Improved sanity checks in RSA key generation (#1444780)
Addressed CVE-2017-5334, CVE-2017-5335, CVE-2017-5336, CVE-2017-5337,
2017-7869

Addressed issue with DSA public keys smaller than 2^1024 (#1238279)
Addressed two-byte buffer overflow in the DTLS-0.9 protocol (#1209365)
When writing certificates to smart cards write the CKA_ISSUER and
Use the shared system certificate store (#1110750)
Address MD5 transcript collision attacks in TLS key exchange (#1289888,
2015-7575)
Allow hashing data over 2^32 bytes (#1306953)
Ensure written PKCS#11 public keys are not marked as private (#1339453)
Ensure secure_getenv() is called on all uses of environment variables
Fix issues related to PKCS #11 private key listing on certain HSMs

Corrected reseed and respect of max_number_of_bits_per_request in
2 mode. Also enhanced the initial tests. (#1228199)

corrected fix of handshake buffer resets (#1153106)

Applied fix for urandom FD in FIPS140 mode (#1165047)
Applied fix for FIPS140-2 related regression (#1110696)

Amended fix for urandom FD to avoid regression in FIPS140 mode (#1165047)

Amended fix for FIPS enforcement issue (#1163848)
Fixed issue with applications that close all file descriptors (#1165047)

Applied fix for FIPS enforcement issue when only /etc/system-fips

Applied fix for CVE-2014-8564 (#1161473)

when generating test DH keys, enforce the q_bits.

do not enforce FIPS140-2 policies in non-FIPS140 mode (#1154774)

reverted change to use the p11-kit certificate storage (#1110750)
added functions to test DH/ECDH in FIPS-140-2 mode and fixed
added manual dependencies on libtasn1 3.8 as well as p11-kit 0.20.7
fixed SHA224 in SSSE3 optimized code
fixed issue with handshake buffer resets (#1153106)
fixed issue in RSA key generation with specific seeds in FIPS140-2 mode

added dependency on libtasn1 3.8 (#1110696)