Improve OpenSSL/GnuTLS; enable DNSSEC for non-smarthost