OpenSSL has an error in the certificate validation that could allow an attacker to use a leaf certificate as a fake ca. See upstream advisory for details. Please bump to 1.0.2d/1.0.1p.
*** This bug has been marked as a duplicate of bug 554172 ***