Merge remote-tracking branch 'origin/maint-0.2.2'

diff --cc src/common/tortls.c
index 2b46612aecf7d8a00e315c225e0ddbf17ce15392,ef61f71b3db072e4972897695f9f28e58ff52b9a..b7cd8354444863311a0ede71cf5266b4dfdbda86
--- 1/src/common/tortls.c
--- 2/src/common/tortls.c
+++ b/src/common/tortls.c
@@@ -1158,20 -771,20 +1168,24 @@@ tor_tls_context_new(crypto_pk_env_t *id
    result = tor_malloc_zero(sizeof(tor_tls_context_t));
    result->refcnt = 1;
    if (!is_client) {
 -    result->my_cert = X509_dup(cert);
 -    result->my_id_cert = X509_dup(idcert);
 -    result->key = crypto_pk_dup_key(rsa);
 +    result->my_link_cert = tor_cert_new(X509_dup(cert));
 +    result->my_id_cert = tor_cert_new(X509_dup(idcert));
 +    result->my_auth_cert = tor_cert_new(X509_dup(authcert));
 +    if (!result->my_link_cert || !result->my_id_cert || !result->my_auth_cert)
 +      goto error;
 +    result->link_key = crypto_pk_dup_key(rsa);
 +    result->auth_key = crypto_pk_dup_key(rsa_auth);
    }
  
- #ifdef EVERYONE_HAS_AES
-   /* Tell OpenSSL to only use TLS1 */
+ #if 0
+   /* Tell OpenSSL to only use TLS1. This would actually break compatibility
+    * with clients that are configured to use SSLv23_method(), so we should
+    * probably never use it.
+    */
    if (!(result->ctx = SSL_CTX_new(TLSv1_method())))
      goto error;
- #else
+ #endif
+ 
    /* Tell OpenSSL to use SSL3 or TLS1 but not SSL2. */
    if (!(result->ctx = SSL_CTX_new(SSLv23_method())))
      goto error;