move masks out of CERT structure

Reviewed-by: Rich Salz <rsalz@openssl.org>
7 files changed