With help from Viktor. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>