Rewrite ssl3_send_client_key_exchange to support extms.

Rewrite ssl3_send_client_key_exchange to retain the premaster secret
instead of using it immediately.

This is needed because the premaster secret is used after the client key
exchange message has been sent to compute the extended master secret.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

ssl/ssl_cert.c

@@ -476,6 +476,11 @@ void ssl_cert_free(CERT *c)
     custom_exts_free(&c->cli_ext);
     custom_exts_free(&c->srv_ext);
 #endif
+    if (c->pms) {
+        OPENSSL_cleanse(c->pms, c->pmslen);
+        OPENSSL_free(c->pms);
+        c->pms = NULL;
+    }
     OPENSSL_free(c);
 }