Signed up just to say thanks. The comments in this thread are pure gold. @futureweb incorporated the comments from many in this thread into a perfect post on building the openssl & ca-certificate packages in post #73. I happened to load these into Spacewalk, and yum is smart enough to install the openssl-libs on upgrade of openssl.
Thanks!