ssl: do not choose auto DH groups that are weaker than the security level