Update to 1.967
    
    - New upstream release 1.967
      - Verify the hostname inside a certificate by default with a superset of
        common verification schemes instead of not verifying identity at all; for
        now it will only complain if name verification failed but in the future it
        will fail certificate verification, forcing you to set the expected
        SSL_verifycn_name if you want to accept the certificate
      - New option SSL_fingerprint and new methods get_fingerprint and
        get_fingerprint_bin; together they can be used to selectively accept
        specific certificates that would otherwise fail verification, like
        self-signed, outdated or from unknown CAs
      - Utils:
        - Default RSA key length 2048
        - Digest algorithm to sign certificate in CERT_create can be given;
          defaults to SHA-256
        - CERT_create can now issue non-CA self-signed certificate
        - CERT_create add some more useful constraints to certificate
      - Spelling fixes