As OpenSSL >= 1.0.0 is now required, ECDHE is now mandatory. The group has to be validated at runtime, because of RedHat lawyers (P224 support is entirely missing in the OpenSSL RPM, but P256 is present and is the default). Resolves ticket #16140.