Merge 0.9->0.10

diff --cc core/certmanager.lua
index d6784a968f68d16c2f7f840576df0fcfc7b63913,c88f7a270fb77c964a39f5fcc3fd763704d67346..9dfb8f3a3297d365f775c7ae43e64ef1c158d2bf
--- 1/core/certmanager.lua
--- 2/core/certmanager.lua
+++ b/core/certmanager.lua
@@@ -30,11 -31,20 +31,20 @@@ en
  module "certmanager"
  
  -- Global SSL options if not overridden per-host
- local default_ssl_config = configmanager.get("*", "ssl");
- local default_capath = "/etc/ssl/certs";
- local default_verify = (ssl and ssl.x509 and { "peer", "client_once", }) or "none";
- local default_options = { "no_sslv2", "cipher_server_preference", luasec_has_noticket and "no_ticket" or nil };
- local default_verifyext = { "lsec_continue", "lsec_ignore_purpose" };
+ local global_ssl_config = configmanager.get("*", "ssl");
+ 
+ local core_defaults = {
+       capath = "/etc/ssl/certs";
+       protocol = "sslv23";
+       verify = (ssl and ssl.x509 and { "peer", "client_once", }) or "none";
+       options = { "no_sslv2", "no_sslv3", "cipher_server_preference", luasec_has_noticket and "no_ticket" or nil };
+       verifyext = { "lsec_continue", "lsec_ignore_purpose" };
+       curve = "secp384r1";
 -      ciphers = "HIGH+kEDH:HIGH+kEECDH:HIGH+kRSA:!DSS:!3DES:!aNULL";
++      ciphers = "HIGH+kEDH:HIGH+kEECDH:HIGH:!PSK:!SRP:!3DES:!aNULL";
+ }
+ local path_options = { -- These we pass through resolve_path()
+       key = true, certificate = true, cafile = true, capath = true, dhparam = true
+ }
  
  if ssl and not luasec_has_verifyext and ssl.x509 then
        -- COMPAT mw/luasec-hg