OTP-8695 New ssl default

Ssl has now switched default implementation and removed deprecated
certificate handling. All certificate handling is done by the public_key
application.

53 files changed, 1536 insertions, 4976 deletions

diff --git a/lib/ssl/Makefile b/lib/ssl/Makefile
index a3dec8da38..b8b51270c9 100644
--- a/lib/ssl/Makefile
+++ b/lib/ssl/Makefile
@@ -1,19 +1,19 @@
 #
 # %CopyrightBegin%
-# 
-# Copyright Ericsson AB 1999-2009. All Rights Reserved.
-# 
+#
+# Copyright Ericsson AB 1999-2010. All Rights Reserved.
+#
 # The contents of this file are subject to the Erlang Public License,
 # Version 1.1, (the "License"); you may not use this file except in
 # compliance with the License. You should have received a copy of the
 # Erlang Public License along with this software. If not, it can be
 # retrieved online at http://www.erlang.org/.
-# 
+#
 # Software distributed under the License is distributed on an "AS IS"
 # basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 # the License for the specific language governing rights and limitations
 # under the License.
-# 
+#
 # %CopyrightEnd%
 #
 
@@ -36,9 +36,9 @@ SKIP_BUILDING_BINARIES := false
 endif
 
 ifeq ($(SKIP_BUILDING_BINARIES), true)
-SUB_DIRECTORIES = pkix src c_src doc/src 
+SUB_DIRECTORIES = src c_src doc/src 
 else
-SUB_DIRECTORIES = pkix src c_src doc/src examples/certs examples/src
+SUB_DIRECTORIES = src c_src doc/src examples/certs examples/src
 endif
 
 include vsn.mk
diff --git a/lib/ssl/doc/src/Makefile b/lib/ssl/doc/src/Makefile
index fa263d28ab..d6788c1633 100644
--- a/lib/ssl/doc/src/Makefile
+++ b/lib/ssl/doc/src/Makefile
@@ -37,7 +37,7 @@ RELSYSDIR = $(RELEASE_PATH)/lib/$(APPLICATION)-$(VSN)
 # Target Specs
 # ----------------------------------------------------
 XML_APPLICATION_FILES = refman.xml
-XML_REF3_FILES = ssl.xml new_ssl.xml
+XML_REF3_FILES = ssl.xml old_ssl.xml
 XML_REF6_FILES = ssl_app.xml
 
 XML_PART_FILES = release_notes.xml usersguide.xml
diff --git a/lib/ssl/doc/src/make.dep b/lib/ssl/doc/src/make.dep
deleted file mode 100644
index 2ff81bee1f..0000000000
--- a/lib/ssl/doc/src/make.dep
+++ /dev/null
@@ -1,30 +0,0 @@
-# ----------------------------------------------------
-# >>>> Do not edit this file <<<<
-# This file was automaticly generated by
-# /home/otp/bin/docdepend
-# ----------------------------------------------------
-
-
-# ----------------------------------------------------
-# TeX files that the DVI file depend on
-# ----------------------------------------------------
-
-book.dvi: book.tex create_certs.tex licenses.tex new_ssl.tex \
-		pkix_certs.tex refman.tex ssl.tex ssl_app.tex \
-		ssl_distribution.tex ssl_protocol.tex usersguide.tex \
-		using_ssl.tex
-
-# ----------------------------------------------------
-# Source inlined when transforming from source to LaTeX
-# ----------------------------------------------------
-
-book.tex: refman.xml
-
-create_certs.tex: ../../examples/certs/src/make_certs.erl
-
-using_ssl.tex: ../../examples/src/client_server.erl
-
-pkix_certs.tex: ../../../../system/doc/definitions/cite.defs
-
-ssl_protocol.tex: ../../../../system/doc/definitions/cite.defs
-
diff --git a/lib/ssl/doc/src/new_ssl.xml b/lib/ssl/doc/src/new_ssl.xml
deleted file mode 100644
index 69298759bd..0000000000
--- a/lib/ssl/doc/src/new_ssl.xml
+++ /dev/null
@@ -1,694 +0,0 @@
-<?xml version="1.0" encoding="latin1" ?>
-<!DOCTYPE erlref SYSTEM "erlref.dtd">
-
-<erlref>
-  <header>
-    <copyright>
-      <year>1999</year>
-      <year>2007</year>
-      <holder>Ericsson AB, All Rights Reserved</holder>
-    </copyright>
-    <legalnotice>
-  The contents of this file are subject to the Erlang Public License,
-  Version 1.1, (the "License"); you may not use this file except in
-  compliance with the License. You should have received a copy of the
-  Erlang Public License along with this software. If not, it can be
-  retrieved aniline's at http://www.erlang.org/.
-
-  Software distributed under the License is distributed on an "AS IS"
-  basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-  the License for the specific language governing rights and limitations
-  under the License.
-
-  The Initial Developer of the Original Code is Ericsson AB.
-    </legalnotice>
-    <title>ssl</title>
-    <prepared>Ingela Anderton Andin</prepared>
-    <responsible>Ingela Anderton Andin</responsible>
-    <docno></docno>
-    <approved></approved>
-    <checked></checked>
-    <date>2003-03-25</date>
-    <rev></rev>
-    <file>new_ssl.xml</file>
-  </header>
-  <module>new_ssl</module>
-  <modulesummary>Interface Functions for Secure Socket Layer</modulesummary>
-  <description>
-    <p>This module contains interface functions to the Secure Socket
-      Layer. 
-    </p>
-  </description>
-  
-  <section>
-    <title>NEW SSL</title>
-
-    <p>This manual page describes functions that are defined
-      in the ssl module and represents the new ssl implementation
-      that coexists with the old one, as the new implementation
-      is not yet complete enough to replace the old one.</p>
-       
-    <p>The new implementation can be
-      accessed by providing the option {ssl_imp, new} to the
-      ssl:connect and ssl:listen functions.</p>
-    
-    <p>The new implementation is Erlang based and all logic
-      is in Erlang and only payload encryption calculations are
-      done in C via the crypto application. The main reason for
-      making a new implementation is that the old solution was
-      very crippled as the control of the ssl-socket was deep
-      down in openssl making it hard if not impossible to
-      support all inet options, ipv6 and upgrade of a tcp
-      connection to a ssl connection. This version has a
-      few limitations that will be removed before the ssl-4.0
-      release. Main differences and limitations are listed below.</p>
-
-    <list type="bulleted">
-      <item>New ssl requires the crypto
-	application.</item>
-      <item>The option reuseaddr is
-	supported and the default value is false as in gen_tcp.
-	Old ssl is patched to accept that the option is set to
-	true to provide a smoother migration between the
-	versions. In old ssl the option is hard coded to
-	true.</item>
-      <item>ssl:version/0 is replaced by
-            ssl:versions/0</item>
-      <item>ssl:ciphers/0 is replaced by
-            ssl:cipher_suites/0</item>
-      <item>ssl:pid/1 is a
-            meaningless function in new ssl and will be deprecated in
-            ssl-4.0 until it is removed it will return a valid but
-            meaningless pid.</item>
-      <item>New API functions are
-            ssl:shutdown/2, ssl:cipher_suites/[0,1] and
-            ssl:versions/0, ssl:renegotiate/1</item>
-      <item>CRL and policy certificate
-            extensions are not supported yet. </item>
-      <item>Supported SSL/TLS-versions are SSL-3.0 and TLS-1.0 </item>
-      <item>For security reasons sslv2 is not supported.</item>
-      <item>Ephemeral Diffie-Hellman cipher suites are supported
-      but not Diffie Hellman Certificates cipher suites.</item>
-      <item>Export cipher suites are not supported as the
-      U.S. lifted its export restrictions in early 2000.</item>
-    </list>
- 
-  </section>
-  
-  <section>
-    <title>COMMON DATA TYPES</title>
-    <p>The following data types are used in the functions below:
-    </p>
-
-    <p><c>boolean() = true | false</c></p> 
-    
-    <p><c>property() = atom()</c></p>
-    
-    <p><c>option() = socketoption() | ssloption() | transportoption()</c></p>
-
-     <p><c>socketoption() = [{property(), term()}] - defaults to
-      [{mode,list},{packet, 0},{header, 0},{active, true}].
-    </c></p>
-
-    <p>For valid options
-      see <seealso marker="kernel:inet">inet(3) </seealso> and
-      <seealso marker="kernel:gen_tcp">gen_tcp(3) </seealso>.
-    </p>
-    
-    <p> <c>ssloption() = {verify, verify_type()} |
-      {fail_if_no_peer_cert, boolean()}
-      {depth, integer()} |
-      {certfile, path()} | {keyfile, path()} | {password, string()} |
-      {cacertfile, path()} | {dhfile, path()} | {ciphers, ciphers()} |
-      {ssl_imp, ssl_imp()} | {reuse_sessions, boolean()} | {reuse_session, fun()} 
-    </c></p>
-
-    <p><c>transportoption() = {CallbackModule, DataTag, ClosedTag}
-	- defaults to {gen_tcp, tcp, tcp_closed}. Ssl may be
-	run over any reliable transport protocol that has
-	an equivalent API to gen_tcp's.</c></p>
-    
-    <p><c>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CallbackModule =
-	atom()</c>
-    </p> <p><c>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DataTag =
-	atom() - tag used in socket data message.</c></p>
-    <p><c>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ClosedTag = atom() - tag used in
-    socket close message.</c></p>
-
-    <p><c>verify_type() = verify_none | verify_peer</c></p>
-    
-    <p><c>path() = string() - representing a file path.</c></p>
-    
-    <p><c>host() = hostname() | ipaddress()</c></p>
-        
-    <p><c>hostname() = string()</c></p>
-    
-    <p><c>
-      ip_address() = {N1,N2,N3,N4}  % IPv4
-      | {K1,K2,K3,K4,K5,K6,K7,K8}  % IPv6    </c></p>
-
-    <p><c>sslsocket() - opaque to the user. </c></p>
-    
-    <p><c>protocol() = sslv3 | tlsv1 </c></p>
-    
-    <p><c>ciphers() = [ciphersuite()] | string() (according to old API)</c></p>
-    
-    <p><c>ciphersuite() =
-      {key_exchange(), cipher(), hash()}</c></p>
-    
-    <p><c>key_exchange() =  rsa | dhe_dss | dhe_rsa
-    </c></p>
-
-   <p><c>cipher() = rc4_128 | des_cbc | '3des_ede_cbc'
-      | aes_128_cbc | aes_256_cbc </c></p>
-
-   <p> <c>hash() = md5 | sha
-    </c></p>
-
-    <p><c>ssl_imp() = new | old - default is old.</c></p>
-    
-  </section>
-  
-<section>
-    <title>SSL OPTION DESCRIPTIONS</title>
-    
-    <taglist>
-      <tag>{verify, verify_type()}</tag>
-      <item> If <c>verify_none</c> is specified x509-certificate
-      path validation errors at the client side
-      will not  automatically cause the connection to fail, as
-      it will if the verify type is <c>verify_peer</c>. See also
-      the option verify_fun.
-      Servers only do the path validation if <c>verify_peer</c> is set to
-      true, as it then will 
-      send a certificate request to
-      the client (this message is not sent if the verify option is
-      <c>verify_none</c>) and you may then also want to specify
-      the option <c>fail_if_no_peer_cert</c>.
-      </item>
-
-      <tag>{fail_if_no_peer_cert, boolean()}</tag>
-      <item>Used together with {verify, verify_peer} by a ssl server.
-      If set to true,
-      the server will fail if the client does not have a certificate
-      to send, e.i sends a empty certificate, if set to false it will
-      only fail if the client sends a invalid certificate (an empty
-      certificate is considered valid).
-      </item>
-      
-      <tag>{verify_fun, fun(ErrorList) -> boolean()}</tag>
-      <item>Used by the ssl client to determine if 
-	x509-certificate path validations errors are acceptable or
-	if the connection should fail. Defaults to:
-       
-<code>
-fun(ErrorList) ->
-	case lists:foldl(fun({bad_cert,unknown_ca}, Acc) ->
-						  Acc;
-			    (Other, Acc) ->
-				 [Other | Acc]
-			 end, [], ErrorList) of
-	    [] ->
-		true;
-	    [_|_] ->
-		false
-	end
-end
-</code>
-       I.e. by default if the only error found was that the CA-certificate
-       holder was unknown this will be accepted.
-
-       Possible errors in the error list are: 
-       {bad_cert, cert_expired}, {bad_cert, invalid_issuer},
-       {bad_cert, invalid_signature}, {bad_cert, name_not_permitted},
-       {bad_cert, unknown_ca},
-       {bad_cert, cert_expired}, {bad_cert, invalid_issuer},
-       {bad_cert, invalid_signature}, {bad_cert, name_not_permitted},
-       {bad_cert, cert_revoked} (not implemented yet),
-       {bad_cert, unknown_critical_extension} or {bad_cert, term()} (Will
-								    be relevant later when an option is added for the user to be able to verify application specific extensions.) 
-      </item>
-      
-      <tag>{depth, integer()}</tag>
-      <item>Specifies the maximum
-      verification depth, i.e. how far in a chain of certificates the
-      verification process can proceed before the verification is
-      considered to fail. Peer certificate = 0, CA certificate = 1,
-      higher level CA certificate = 2, etc.  The value 2 thus means
-      that a chain can at most contain peer cert, CA cert, next CA
-      cert, and an additional CA cert. The default value is 1.
-      </item>
-
-      <tag>{certfile, path()}</tag>
-      <item>Path to a file containing the
-          user's certificate. Optional for clients but note
-      that some servers requires that the client can certify
-      itself. </item>
-      <tag>{keyfile, path()}</tag>
-      <item>Path to file containing user's
-      private PEM encoded key. As PEM-files may contain several
-      entries this option defaults to the same file as given by
-      certfile option.</item>
-      <tag>{password, string()}</tag>
-      <item>String containing the user's password.
-	Only used if the private keyfile is password protected.
-      </item>
-      <tag>{cacertfile, path()}</tag>
-      <item>Path to file containing PEM encoded
-      CA certificates (trusted certificates used for verifying a peer
-      certificate). May be omitted if you do not want to verify
-      the peer.</item>
-
-      <tag>{dhfile, path()}</tag>
-      <item>Path to file containing PEM encoded Diffie Hellman parameters,
-      for the server to use if a cipher suite using Diffie Hellman key exchange
-      is negotiated. If not specified hardcode parameters will be used.
-      </item>
-      
-      <tag>{ciphers, ciphers()}</tag>
-      <item>The function <c>ciphers_suites/0</c> can
-	be used to find all available ciphers.
-      </item>
-
-      <tag>{ssl_imp, ssl_imp()}</tag>
-      <item>Specify which ssl implementation you want to use.
-      </item>
-
-      <tag>{reuse_sessions, boolean()}</tag>
-      <item>Specifies if ssl sessions should be reused
-	when possible.
-      </item>
-
-       <tag>{reuse_session, fun(SuggestedSessionId,
-       PeerCert, Compression, CipherSuite) -> boolean()}</tag>
-      <item>Enables the ssl server to have a local policy
-      for deciding if a session should be reused or not,
-      only meaning full if <c>reuse_sessions</c> is set to true.
-      SuggestedSessionId is a binary(),  PeerCert is a DER encoded
-      certificate, Compression is an enumeration integer
-      and CipherSuite of type ciphersuite().      
-      </item>
-    </taglist>
-  </section>
-  
-  <section>
-    <title>General</title>
-      
-    <p>When a ssl socket is in active mode (the default), data from the
-      socket is delivered to the owner of the socket in the form of
-      messages:
-    </p>
-    <list type="bulleted">
-      <item>{ssl, Socket, Data}
-      </item>
-      <item>{ssl_closed, Socket}
-      </item>
-      <item>
-        {ssl_error, Socket, Reason}
-      </item>
-    </list>
-    
-    <p>A <c>Timeout</c> argument specifies a timeout in milliseconds. The 
-      default value for a <c>Timeout</c> argument is <c>infinity</c>.
-    </p>
-  </section>
-  
-  <funcs>
-    <func>
-      <name>cipher_suites() -></name>
-      <name>cipher_suites(Type) -> ciphers()</name>
-      <fsummary> Returns a list of supported cipher suites</fsummary>
-      <type>
-        <v>Type = erlang | openssl</v>
-
-      </type>
-      <desc><p>Returns a list of supported cipher suites.
-	cipher_suites() is equivalent to cipher_suites(erlang).
-	Type openssl is provided for backwards compatibility with
-	old ssl that used openssl.
-	</p>
-    </desc>
-    </func>
-    
-    <func>
-      <name>connect(Socket, SslOptions) -> </name>
-      <name>connect(Socket, SslOptions, Timeout) -> {ok, SslSocket}
-	| {error, Reason}</name>
-      <fsummary> Upgrades a gen_tcp, or
-	equivalent, connected socket to a ssl socket. </fsummary>
-      <type>
-        <v>Socket = socket()</v>
-        <v>SslOptions = [ssloption()]</v>
-	<v>Timeout = integer() | infinity</v>
-	<v>SslSocket = sslsocket()</v>
-	<v>Reason = term()</v>
-      </type>
-      <desc> <p>Upgrades a gen_tcp, or equivalent,
-	  connected socket to a ssl socket e.i performs the
-	  client-side ssl handshake.</p>
-    </desc>
-    </func>
-
-    <func>
-      <name>connect(Host, Port, Options) -></name>
-      <name>connect(Host, Port, Options, Timeout) ->
-	  {ok, SslSocket} | {error, Reason}</name>
-      <fsummary>Opens an ssl connection to Host, Port. </fsummary>
-      <type>
-	  <v>Host = host()</v>
-	  <v>Port = integer()</v>
-	  <v>Options = [option()]</v>
-	  <v>Timeout = integer() | infinity</v>
-	  <v>SslSocket = sslsocket()</v>
-	  <v>Reason = term()</v>
-      </type>
-      <desc> <p>Opens an ssl connection to Host, Port.</p> </desc>
-    </func>
-
-    <func>
-      <name>close(SslSocket) -> ok | {error, Reason}</name>
-      <fsummary>Close a ssl connection</fsummary>
-      <type>
-	  <v>SslSocket = sslsocket()</v>
-	  <v>Reason = term()</v>
-      </type>
-      <desc><p>Close a ssl connection.</p>
-      </desc>
-    </func>
-
-    <func>
-      <name>controlling_process(SslSocket, NewOwner) ->
-	ok | {error, Reason}</name>
-      
-	<fsummary>Assigns a new controlling process to the
-	ssl-socket.</fsummary>
-      
-	<type>
-	  <v>SslSocket = sslsocket()</v>
-	  <v>NewOwner = pid()</v>
-	  <v>Reason = term()</v>
-	</type>
-	<desc><p>Assigns a new controlling process to the ssl-socket. A
-      controlling process is the owner of a ssl-socket, and receives
-      all messages from the socket.</p>
-      </desc>
-    </func>
-
-    <func>
-	<name>connection_info(SslSocket) ->
-	  {ok, {ProtocolVersion, CipherSuite}} |  {error, Reason} </name>
-      <fsummary>Returns the negotiated protocol version and cipher suite.
-      </fsummary>
-      <type>
-        <v>CipherSuite = ciphersuite()</v>
-        <v>ProtocolVersion = protocol()</v>
-      </type>
-      <desc><p>Returns the negotiated protocol version and cipher suite.</p> 
-      </desc>
-    </func>
-
-     <func>
-      <name>format_error(Reason) -> string()</name>
-      <fsummary>Return an error string.</fsummary>
-      <type>
-        <v>Reason = term()</v>
-      </type>
-      <desc>
-        <p>Presents the error returned by an ssl function as a printable string.</p>
-      </desc>
-    </func>
-   
-    <func>
-      <name>getopts(Socket) -> </name>
-      <name>getopts(Socket, OptionNames) ->
-	{ok, [socketoption()]} | {error, Reason}</name>
-      <fsummary>Get the value of the specified options.</fsummary>
-      <type>
-	<v>Socket = sslsocket()</v>
-	<v>OptionNames = [property()]</v>
-      </type>
-      <desc>
-	<p>Get the value of the specified socket options, if no
-	  options are specified all options are returned.
-	</p>
-      </desc>
-    </func>
-
-    <func>
-      <name>listen(Port, Options) ->
-	{ok, ListenSocket} | {error, Reason}</name>
-      <fsummary>Creates a ssl listen socket.</fsummary>
-      <type>
-	<v>Port = integer()</v>
-	<v>Options = options()</v>
-	<v>ListenSocket = sslsocket()</v>
-      </type>
-      <desc>
-	<p>Creates a ssl listen socket.</p>
-      </desc>
-    </func>
-
-    <func>
-      <name>peercert(Socket) -> {ok, Cert} | {error, Reason}</name>
-      <fsummary>Return the peer certificate.</fsummary>
-     <type>
-        <v>Socket = sslsocket()</v>
-        <v>Cert = binary()</v>
-        <v>Subject = term()</v>
-      </type>
-      <desc>
-        <p>The peer certificate is returned as a DER encoded binary.
-	  The certificate can be decoded with <c>public_key:pkix_decode_cert/2</c>.
-        </p>
-      </desc>
-    </func>
-    <func>
-      <name>peername(Socket) -> {ok, {Address, Port}} |
-	{error, Reason}</name>
-      <fsummary>Return peer address and port.</fsummary>
-      <type>
-        <v>Socket = sslsocket()</v>
-        <v>Address = ipaddress()</v>
-        <v>Port = integer()</v>
-      </type>
-      <desc>
-        <p>Returns the address and port number of the peer.</p>
-      </desc>
-    </func>
-    
-    <func>
-      <name>recv(Socket, Length) -> </name>
-      <name>recv(Socket, Length, Timeout) -> {ok, Data} | {error,
-	Reason}</name>
-      <fsummary>Receive data on a socket.</fsummary>
-      <type>
-        <v>Socket = sslsocket()</v>
-        <v>Length = integer()</v>
-        <v>Timeout = integer()</v>
-        <v>Data = [char()] | binary()</v>
-      </type>
-      <desc>
-        <p>This function receives a packet from a socket in passive
-          mode. A closed socket is indicated by a return value
-          <c>{error, closed}</c>.</p>
-        <p>The <c>Length</c> argument is only meaningful when
-          the socket is in <c>raw</c> mode and denotes the number of
-          bytes to read. If <c>Length</c> = 0, all available bytes are
-          returned. If <c>Length</c> &gt; 0, exactly <c>Length</c>
-          bytes are returned, or an error; possibly discarding less
-          than <c>Length</c> bytes of data when the socket gets closed
-          from the other side.</p>
-        <p>The optional <c>Timeout</c> parameter specifies a timeout in
-          milliseconds. The default value is <c>infinity</c>.</p>
-      </desc>
-    </func>
-    
-    <func>
-      <name>renegotiate(Socket) -> ok | {error, Reason}</name>
-      <fsummary> Initiates a new handshake.</fsummary>
-      <type>
-	<v>Socket = sslsocket()</v>
-      </type>
-      <desc><p>Initiates a new handshake. A notable return value is
-      <c>{error, renegotiation_rejected}</c> indicating that the peer
-      refused to go through with the renegotiation but the connection
-      is still active using the previously negotiated session.</p>
-      </desc>
-    </func>
-    
-    <func>
-      <name>send(Socket, Data) -> ok | {error, Reason}</name>
-      <fsummary>Write data to a socket.</fsummary>
-      <type>
-        <v>Socket = sslsocket()</v>
-        <v>Data = iolist() | binary()</v>
-      </type>
-      <desc>
-        <p>Writes <c>Data</c> to <c>Socket</c>. </p>
-        <p>A notable return value is <c>{error, closed}</c> indicating that
-          the socket is closed.</p>
-      </desc>
-    </func>
-    <func>
-      <name>setopts(Socket, Options) -> ok | {error, Reason}</name>
-      <fsummary>Set socket options.</fsummary>
-      <type>
-        <v>Socket = sslsocket()</v>
-        <v>Options = [socketoption]()</v>
-      </type>
-      <desc>
-        <p>Sets options according to <c>Options</c> for the socket 
-          <c>Socket</c>. </p>
-      </desc>
-    </func>
-
-    <func>
-      <name>shutdown(Socket, How) -> ok | {error, Reason}</name>
-      <fsummary>Immediately close a socket</fsummary>
-      <type>
-        <v>Socket = sslsocket()</v>
-        <v>How = read | write | read_write</v>
-        <v>Reason = reason()</v>
-      </type>
-      <desc>
-        <p>Immediately close a socket in one or two directions.</p>
-        <p><c>How == write</c> means closing the socket for writing,
-          reading from it is still possible.</p>
-        <p>To be able to handle that the peer has done a shutdown on
-          the write side, the <c>{exit_on_close, false}</c> option
-          is useful.</p>
-      </desc>
-    </func>
-    
-    <func>
-      <name>ssl_accept(ListenSocket) -> </name>
-      <name>ssl_accept(ListenSocket, Timeout) -> ok | {error, Reason}</name>
-      <fsummary>Perform server-side SSL handshake</fsummary>
-      <type>
-        <v>ListenSocket = sslsocket()</v>
-        <v>Timeout = integer()</v>
-        <v>Reason = term()</v>
-      </type>
-      <desc>
-        <p>The <c>ssl_accept</c> function establish the SSL connection
-          on the server side. It should be called directly after
-          <c>transport_accept</c>, in the spawned server-loop.</p>
-      </desc>
-    </func>
-
-    <func>
-      <name>ssl_accept(ListenSocket, SslOptions) -> </name>
-      <name>ssl_accept(ListenSocket, SslOptions, Timeout) -> {ok, Socket} | {error, Reason}</name>
-      <fsummary>Perform server-side SSL handshake</fsummary>
-      <type>
-        <v>ListenSocket = socket()</v>
-	<v>SslOptions = ssloptions()</v>
-        <v>Timeout = integer()</v>
-        <v>Reason = term()</v>
-      </type>
-      <desc>
-        <p> Upgrades a gen_tcp, or
-	  equivalent, socket to a ssl socket e.i performs the
-	ssl server-side handshake.</p>
-	<p><note>Note that the listen socket should be in {active, false} mode
-	before telling the client that the server is ready to upgrade
-	and calling this function, otherwise the upgrade may
-	or may not succeed depending on timing.</note></p>
-      </desc>
-    </func>
-    
-    <func>
-      <name>sockname(Socket) -> {ok, {Address, Port}} |
-	{error, Reason}</name>
-      <fsummary>Return the local address and port.</fsummary>
-      <type>
-        <v>Socket = sslsocket()</v>
-        <v>Address = ipaddress()</v>
-        <v>Port = integer()</v>
-      </type>
-      <desc>
-        <p>Returns the local address and port number of the socket
-          <c>Socket</c>.</p>
-      </desc>
-    </func>
-    
-    <func>
-      <name>start() -> </name>
-      <name>start(Type) -> ok | {error, Reason}</name>
-      <fsummary>Starts the Ssl application. </fsummary>
-      <type>
-        <v>Type =  permanent | transient | temporary</v>
-      </type>
-      <desc>
-        <p>Starts the Ssl application. Default type
-          is temporary.
-          <seealso marker="kernel:application">application(3)</seealso></p>
-      </desc>
-    </func>
-    <func>
-      <name>stop() -> ok </name>
-      <fsummary>Stops the Ssl application.</fsummary>
-      <desc>
-        <p>Stops the Ssl application.
-          <seealso marker="kernel:application">application(3)</seealso></p>
-      </desc>
-    </func>
-
-    <func>
-      <name>transport_accept(Socket) -></name>
-      <name>transport_accept(Socket, Timeout) ->
-	{ok, NewSocket} | {error, Reason}</name>
-      <fsummary>Accept an incoming connection and
-	prepare for <c>ssl_accept</c></fsummary>
-      <type>
-        <v>Socket = NewSocket = sslsocket()</v>
-        <v>Timeout = integer()</v>
-        <v>Reason = reason()</v>
-      </type>
-      <desc>
-        <p>Accepts an incoming connection request on a listen socket.
-          <c>ListenSocket</c> must be a socket returned from
-          <c>listen/2</c>.  The socket returned should be passed to
-          <c>ssl_accept</c> to complete ssl handshaking and
-          establishing the connection.</p>
-        <warning>
-          <p>The socket returned can only be used with <c>ssl_accept</c>,
-            no traffic can be sent or received before that call.</p>
-        </warning>
-        <p>The accepted socket inherits the options set for
-          <c>ListenSocket</c> in <c>listen/2</c>.</p>
-	<p>The default
-          value for <c>Timeout</c> is <c>infinity</c>. If
-          <c>Timeout</c> is specified, and no connection is accepted
-          within the given time, <c>{error, timeout}</c> is
-          returned.</p>
-      </desc>
-    </func>
-    
-    <func>
-      <name>versions() ->
-	[{SslAppVer, SupportedSslVer, AvailableSslVsn}]</name>
-      <fsummary>Returns version information relevant for the
-	ssl application.</fsummary>
-      <type>
-	<v>SslAppVer = string()</v>
-      	<v>SupportedSslVer = [protocol()]</v>
-      	<v>AvailableSslVsn = [protocol()]</v>
-      </type>
-      <desc>
-	<p>
-	  Returns version information relevant for the
-	  ssl application.</p>
-      </desc>
-    </func>
-  </funcs> 
-      
-  <section>
-    <title>SEE ALSO</title>
-    <p><seealso marker="kernel:inet">inet(3) </seealso> and 
-      <seealso marker="kernel:gen_tcp">gen_tcp(3) </seealso>
-    </p>
-  </section>
-
-</erlref>
-
diff --git a/lib/ssl/doc/src/notes.xml b/lib/ssl/doc/src/notes.xml
index f213bd11ae..151b685941 100644
--- a/lib/ssl/doc/src/notes.xml
+++ b/lib/ssl/doc/src/notes.xml
@@ -31,6 +31,31 @@
   <p>This document describes the changes made to the SSL application.
     </p>
 
+    <section><title>SSL 4.0</title>
+    
+    <section><title>Improvements and New Features</title>
+    <list>
+      <item>
+	<p>
+	  New ssl now support client/server-certificates signed by
+	dsa keys.</p>
+	<p>
+	Own Id: OTP-8587</p>
+      </item>
+      <item>
+	<p>
+	  Ssl has now switched default implementation and removed
+	  deprecated certificate handling. All certificate handling
+	is done by the public_key application.</p>
+	<p>
+	Own Id: OTP-8695</p>
+      </item>
+    </list>
+    </section>
+    
+    </section>
+
+    
     <section><title>SSL 3.11.1</title>
     
     <section><title>Fixed Bugs and Malfunctions</title>
diff --git a/lib/ssl/doc/src/old_ssl.xml b/lib/ssl/doc/src/old_ssl.xml
new file mode 100644
index 0000000000..884e8f67b7
--- /dev/null
+++ b/lib/ssl/doc/src/old_ssl.xml
@@ -0,0 +1,709 @@
+<?xml version="1.0" encoding="latin1" ?>
+<!DOCTYPE erlref SYSTEM "erlref.dtd">
+
+<erlref>
+  <header>
+    <copyright>
+      <year>1999</year><year>2010</year>
+      <holder>Ericsson AB. All Rights Reserved.</holder>
+    </copyright>
+    <legalnotice>
+      The contents of this file are subject to the Erlang Public License,
+      Version 1.1, (the "License"); you may not use this file except in
+      compliance with the License. You should have received a copy of the
+      Erlang Public License along with this software. If not, it can be
+      retrieved online at http://www.erlang.org/.
+
+      Software distributed under the License is distributed on an "AS IS"
+      basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+      the License for the specific language governing rights and limitations
+      under the License.
+
+    </legalnotice>
+
+    <title>ssl</title>
+    <prepared>Peter H&ouml;gfeldt</prepared>
+    <responsible>Peter H&ouml;gfeldt</responsible>
+    <docno></docno>
+    <approved>Peter H&ouml;gfeldt</approved>
+    <checked></checked>
+    <date>2003-03-25</date>
+    <rev>D</rev>
+    <file>old_ssl.xml</file>
+  </header>
+  <module>old_ssl</module>
+  <modulesummary>Interface Functions for Secure Socket Layer</modulesummary>
+  <description>
+    <p>This module contains interface functions to the Secure Socket Layer.</p>
+  </description>
+
+  <section>
+    <title>General</title>
+
+    <p>This manual page describes functions that are defined
+      in the ssl module and represents the old ssl implementation
+      that coexists with the new one until it has been
+      totally phased out. </p>
+
+   <p>The new implementation can be
+      accessed by providing the option {ssl_imp, old} to the
+      ssl:connect and ssl:listen functions.</p>
+      
+    <p>The reader is advised to also read the <c>ssl(6)</c> manual page
+      describing the SSL application.
+      </p>
+    <warning>
+      <p>It is strongly advised to seed the random generator after
+        the ssl application has been started (see <c>seed/1</c>
+        below), and before any connections are established. Although
+        the port program interfacing to the ssl libraries does a
+        "random" seeding of its own in order to make everything work
+        properly, that seeding is by no means random for the world
+        since it has a constant value which is known to everyone
+        reading the source code of the port program.</p>
+    </warning>
+  </section>
+
+  <section>
+    <title>Common data types</title>
+    <p>The following datatypes are used in the functions below:
+      </p>
+    <list type="bulleted">
+      <item>
+        <p><c>options() = [option()]</c></p>
+      </item>
+      <item>
+        <p><c>option() = socketoption() | ssloption()</c></p>
+      </item>
+      <item>
+        <p><c>socketoption() = {mode, list} | {mode, binary} |  binary | {packet, packettype()} | {header, integer()} | {nodelay, boolean()} | {active, activetype()} |  {backlog, integer()} | {ip, ipaddress()} | {port, integer()}</c></p>
+      </item>
+      <item>
+        <p><c>ssloption() = {verify, code()} | {depth, depth()} |  {certfile, path()} | {keyfile, path()} | {password, string()} | {cacertfile, path()} | {ciphers, string()}</c></p>
+      </item>
+      <item>
+        <p><c>packettype()</c>  (see inet(3))</p>
+      </item>
+      <item>
+        <p><c>activetype()</c>  (see inet(3))</p>
+      </item>
+      <item>
+        <p><c>reason() = atom() | {atom(), string()}</c></p>
+      </item>
+      <item>
+        <p><c>bytes() = [byte()]</c></p>
+      </item>
+      <item>
+        <p><c>string() = [byte()]</c></p>
+      </item>
+      <item>
+        <p><c>byte() = 0 | 1 | 2 | ... | 255</c></p>
+      </item>
+      <item>
+        <p><c>code() = 0 | 1 | 2</c></p>
+      </item>
+      <item>
+        <p><c>depth() = byte()</c></p>
+      </item>
+      <item>
+        <p><c>address() = hostname() | ipstring() | ipaddress()</c></p>
+      </item>
+      <item>
+        <p><c>ipaddress() = ipstring() | iptuple()</c></p>
+      </item>
+      <item>
+        <p><c>hostname() = string()</c></p>
+      </item>
+      <item>
+        <p><c>ipstring() = string()</c></p>
+      </item>
+      <item>
+        <p><c>iptuple() = {byte(), byte(), byte(), byte()}</c></p>
+      </item>
+      <item>
+        <p><c>sslsocket()</c></p>
+      </item>
+      <item>
+        <p><c>protocol() = sslv2 | sslv3 | tlsv1</c></p>
+      </item>
+      <item>
+        <p><c></c></p>
+      </item>
+    </list>
+    <p>The socket option <c>{backlog, integer()}</c> is for
+      <c>listen/2</c> only, and the option <c>{port, integer()}</c>
+      is for <c>connect/3/4</c> only. 
+      </p>
+    <p>The following socket options are set by default: <c>{mode, list}</c>, <c>{packet, 0}</c>, <c>{header, 0}</c>, <c>{nodelay, false}</c>, <c>{active, true}</c>, <c>{backlog, 5}</c>,
+      <c>{ip, {0,0,0,0}}</c>, and <c>{port, 0}</c>.
+      </p>
+    <p>Note that the options <c>{mode, binary}</c> and <c>binary</c>
+      are equivalent. Similarly <c>{mode, list}</c> and the absence of
+      option <c>binary</c> are equivalent. 
+      </p>
+    <p>The ssl options are for setting specific SSL parameters as follows:
+      </p>
+    <list type="bulleted">
+      <item>
+        <p><c>{verify, code()}</c> Specifies type of verification:
+          0 = do not verify peer; 1 = verify peer, 2 = verify peer,
+          fail if no peer certificate.  The default value is 0.
+          </p>
+      </item>
+      <item>
+        <p><c>{depth, depth()}</c> Specifies the maximum
+          verification depth, i.e. how far in a chain of certificates
+          the verification process can proceed before the verification
+          is considered to fail. 
+          </p>
+        <p>Peer certificate = 0, CA certificate = 1, higher level CA
+          certificate = 2, etc.  The value 2 thus means that a chain
+          can at most contain peer cert, CA cert, next CA cert, and an
+          additional CA cert.
+          </p>
+        <p>The default value is 1.
+          </p>
+      </item>
+      <item>
+        <p><c>{certfile, path()}</c> Path to a file containing the
+          user's certificate.
+          chain of PEM encoded certificates.</p>
+      </item>
+      <item>
+        <p><c>{keyfile, path()}</c> Path to file containing user's
+          private PEM encoded key.</p>
+      </item>
+      <item>
+        <p><c>{password, string()}</c> String containing the user's
+          password. Only used if the private keyfile is password protected.</p>
+      </item>
+      <item>
+        <p><c>{cacertfile, path()}</c> Path to file containing PEM encoded
+          CA certificates (trusted certificates used for verifying a peer
+          certificate).</p>
+      </item>
+      <item>
+        <p><c>{ciphers, string()}</c> String of ciphers as a colon
+          separated list of ciphers. The function <c>ciphers/0</c> can
+          be used to find all available ciphers.</p>
+      </item>
+    </list>
+    <p>The type <c>sslsocket()</c> is opaque to the user.
+      </p>
+    <p>The owner of a socket is the one that created it by a call to
+      <c>transport_accept/[1,2]</c>,  <c>connect/[3,4]</c>,
+      or <c>listen/2</c>.
+      </p>
+    <p>When a socket is in active mode (the default), data from the
+      socket is delivered to the owner of the socket in the form of
+      messages:
+      </p>
+    <list type="bulleted">
+      <item>
+        <p><c>{ssl, Socket, Data}</c></p>
+      </item>
+      <item>
+        <p><c>{ssl_closed, Socket}</c></p>
+      </item>
+      <item>
+        <p><c>{ssl_error, Socket, Reason}</c></p>
+      </item>
+    </list>
+    <p>A <c>Timeout</c> argument specifies a timeout in milliseconds. The 
+      default value for a <c>Timeout</c> argument is <c>infinity</c>.
+      </p>
+    <p>Functions listed below may return the value <c>{error, closed}</c>, which only indicates that the SSL socket is
+      considered closed for the operation in question. It is for
+      instance possible to have <c>{error, closed}</c> returned from
+      an call to <c>send/2</c>, and a subsequent call to <c>recv/3</c>
+      returning <c>{ok, Data}</c>.
+      </p>
+    <p>Hence a return value of <c>{error, closed}</c> must not be
+      interpreted as if the socket was completely closed. On the
+      contrary, in order to free all resources occupied by an SSL
+      socket, <c>close/1</c> must be called, or else the process owning
+      the socket has to terminate.
+      </p>
+    <p>For each SSL socket there is an Erlang process representing the
+      socket.  When a socket is opened, that process links to the
+      calling client process.  Implementations that want to detect
+      abnormal exits from the socket process by receiving <c>{'EXIT', Pid, Reason}</c> messages, should use the function <c>pid/1</c>
+      to retrieve the process identifier from the socket, in order to
+      be able to match exit messages properly.</p>
+  </section>
+  <funcs>
+    <func>
+      <name>ciphers() -> {ok, string()} | {error, enotstarted}</name>
+      <fsummary>Get supported ciphers.</fsummary>
+      <desc>
+        <p>Returns a string consisting of colon separated cipher
+          designations that are supported by the current SSL library
+          implementation.
+          </p>
+        <p>The SSL application has to be started to return the string
+          of ciphers.</p>
+      </desc>
+    </func>
+    <func>
+      <name>close(Socket) -> ok | {error, Reason}</name>
+      <fsummary>Close a socket returned by <c>transport_accept/[1,2]</c>, <c>connect/3/4</c>, or <c>listen/2</c>.</fsummary>
+      <type>
+        <v>Socket = sslsocket()</v>
+      </type>
+      <desc>
+	<p>Closes a socket returned by <c>transport_accept/[1,2]</c>,
+	<c>connect/[3,4]</c>, or <c>listen/2</c></p>
+      </desc>
+    </func>
+    <func>
+      <name>connect(Address, Port, Options) -> {ok, Socket} | {error, Reason}</name>
+      <name>connect(Address, Port, Options, Timeout) -> {ok, Socket} | {error, Reason}</name>
+      <fsummary>Connect to <c>Port</c>at <c>Address</c>.</fsummary>
+      <type>
+        <v>Address = address()</v>
+        <v>Port = integer()</v>
+        <v>Options = [connect_option()]</v>
+        <v>connect_option() = {mode, list} | {mode, binary} | binary | {packet, packettype()} | {header, integer()} | {nodelay, boolean()} | {active, activetype()} | {ip, ipaddress()} | {port, integer()} | {verify, code()} | {depth, depth()} | {certfile, path()} | {keyfile, path()} | {password, string()} | {cacertfile, path()} | {ciphers, string()}</v>
+        <v>Timeout = integer()</v>
+        <v>Socket = sslsocket()</v>
+      </type>
+      <desc>
+        <p>Connects to <c>Port</c> at <c>Address</c>. If the optional 
+          <c>Timeout</c> argument is specified, and a connection could not
+          be established within the given time, <c>{error, timeout}</c> is
+          returned. The default value for <c>Timeout</c> is <c>infinity</c>.
+          </p>
+        <p>The <c>ip</c> and <c>port</c> options are for binding to a 
+          particular <em>local</em> address and port, respectively.</p>
+      </desc>
+    </func>
+    <func>
+      <name>connection_info(Socket) -> {ok, {Protocol, Cipher}} | {error, Reason}</name>
+      <fsummary>Get current protocol version and cipher.</fsummary>
+      <type>
+        <v>Socket = sslsocket()</v>
+        <v>Protocol = protocol()</v>
+        <v>Cipher = string()</v>
+      </type>
+      <desc>
+        <p>Gets the chosen protocol version and cipher for an established
+          connection (accepted och connected). </p>
+      </desc>
+    </func>
+    <func>
+      <name>controlling_process(Socket, NewOwner) -> ok | {error, Reason}</name>
+      <fsummary>Assign a new controlling process to the socket.</fsummary>
+      <type>
+        <v>Socket = sslsocket()</v>
+        <v>NewOwner = pid()</v>
+      </type>
+      <desc>
+        <p>Assigns a new controlling process to <c>Socket</c>. A controlling
+          process is the owner of a socket, and receives all messages from
+          the socket.</p>
+      </desc>
+    </func>
+    <func>
+      <name>format_error(ErrorCode) -> string()</name>
+      <fsummary>Return an error string.</fsummary>
+      <type>
+        <v>ErrorCode = term()</v>
+      </type>
+      <desc>
+        <p>Returns a diagnostic string describing an error.</p>
+      </desc>
+    </func>
+    <func>
+      <name>getopts(Socket, OptionsTags) -> {ok, Options} | {error, Reason}</name>
+      <fsummary>Get options set for socket</fsummary>
+      <type>
+        <v>Socket = sslsocket()</v>
+        <v>OptionTags = [optiontag()]()</v>
+      </type>
+      <desc>
+        <p>Returns the options the tags of which are <c>OptionTags</c> for
+          for the socket <c>Socket</c>. </p>
+      </desc>
+    </func>
+    <func>
+      <name>listen(Port, Options) -> {ok, ListenSocket} | {error, Reason}</name>
+      <fsummary>Set up a socket to listen on a port on the local host.</fsummary>
+      <type>
+        <v>Port = integer()</v>
+        <v>Options = [listen_option()]</v>
+        <v>listen_option() = {mode, list} | {mode, binary} | binary | {packet, packettype()} | {header, integer()} | {active, activetype()} | {backlog, integer()} | {ip, ipaddress()} | {verify, code()} | {depth, depth()} | {certfile, path()} | {keyfile, path()} | {password, string()} | {cacertfile, path()} | {ciphers, string()}</v>
+        <v>ListenSocket = sslsocket()</v>
+      </type>
+      <desc>
+        <p>Sets up a socket to listen on port <c>Port</c> at the local host.
+          If <c>Port</c> is zero, <c>listen/2</c> picks an available port
+          number (use <c>port/1</c> to retrieve it).
+          </p>
+        <p>The listen queue size defaults to 5. If a different value is 
+          wanted, the option <c>{backlog, Size}</c> should be added to the 
+          list of options.
+          </p>
+        <p>An empty <c>Options</c> list is considered an error, and
+          <c>{error, enooptions}</c> is returned.
+          </p>
+        <p>The returned <c>ListenSocket</c> can only be used in calls to 
+          <c>transport_accept/[1,2]</c>.</p>
+      </desc>
+    </func>
+    <func>
+      <name>peercert(Socket) -> {ok, Cert} |  {error, Reason}</name>
+      <fsummary>Return the peer certificate.</fsummary>
+      <type>
+        <v>Socket = sslsocket()</v>
+        <v>Cert = binary()()</v>
+        <v>Subject = term()()</v>
+      </type>
+      <desc>
+	<p>Returns the DER encoded peer certificate, the certificate can be decoded with
+	  <c>public_key:pkix_decode_cert/2</c>.
+	</p>
+      </desc>
+    </func>
+    <func>
+      <name>peername(Socket) -> {ok, {Address, Port}} | {error, Reason}</name>
+      <fsummary>Return peer address and port.</fsummary>
+      <type>
+        <v>Socket = sslsocket()</v>
+        <v>Address = ipaddress()</v>
+        <v>Port = integer()</v>
+      </type>
+      <desc>
+        <p>Returns the address and port number of the peer.</p>
+      </desc>
+    </func>
+    <func>
+      <name>pid(Socket) -> pid()</name>
+      <fsummary>Return the pid of the socket process.</fsummary>
+      <type>
+        <v>Socket = sslsocket()</v>
+      </type>
+      <desc>
+        <p>Returns the pid of the socket process. The returned pid should
+          only be used for receiving exit messages.</p>
+      </desc>
+    </func>
+    <func>
+      <name>recv(Socket, Length) -> {ok, Data} | {error, Reason}</name>
+      <name>recv(Socket, Length, Timeout) -> {ok, Data} | {error, Reason}</name>
+      <fsummary>Receive data on socket.</fsummary>
+      <type>
+        <v>Socket = sslsocket()</v>
+        <v>Length = integer() >= 0</v>
+        <v>Timeout = integer()</v>
+        <v>Data = bytes() | binary()</v>
+      </type>
+      <desc>
+        <p>Receives data on socket <c>Socket</c> when the socket is in
+          passive mode, i.e. when the option <c>{active, false}</c>
+          has been specified.
+          </p>
+        <p>A notable return value is <c>{error, closed}</c> which
+          indicates that the socket is closed.
+          </p>
+        <p>A positive value of the <c>Length</c> argument is only
+          valid when the socket is in raw mode (option <c>{packet, 0}</c> is set, and the option <c>binary</c> is <em>not</em>
+          set); otherwise it should be set to 0, whence all available
+          bytes are returned.
+          </p>
+        <p>If the optional <c>Timeout</c> parameter is specified, and
+          no data was available within the given time, <c>{error, timeout}</c> is returned. The default value for
+          <c>Timeout</c> is <c>infinity</c>.</p>
+      </desc>
+    </func>
+    <func>
+      <name>seed(Data) -> ok | {error, Reason}</name>
+      <fsummary>Seed the ssl random generator.</fsummary>
+      <type>
+        <v>Data = iolist() | binary()</v>
+      </type>
+      <desc>
+        <p>Seeds the ssl random generator.
+          </p>
+        <p>It is strongly advised to seed the random generator after
+          the ssl application has been started, and before any
+          connections are established. Although the port program
+          interfacing to the OpenSSL libraries does a "random" seeding
+          of its own in order to make everything work properly, that
+          seeding is by no means random for the world since it has a 
+          constant value which is known to everyone reading the source
+          code of the seeding. 
+          </p>
+        <p>A notable return value is <c>{error, edata}}</c> indicating that
+          <c>Data</c> was not a binary nor an iolist.</p>
+      </desc>
+    </func>
+    <func>
+      <name>send(Socket, Data) -> ok | {error, Reason}</name>
+      <fsummary>Write data to a socket.</fsummary>
+      <type>
+        <v>Socket = sslsocket()</v>
+        <v>Data = iolist() | binary()</v>
+      </type>
+      <desc>
+        <p>Writes <c>Data</c> to <c>Socket</c>. </p>
+        <p>A notable return value is <c>{error, closed}</c> indicating that
+          the socket is closed.</p>
+      </desc>
+    </func>
+    <func>
+      <name>setopts(Socket, Options) -> ok | {error, Reason}</name>
+      <fsummary>Set socket options.</fsummary>
+      <type>
+        <v>Socket = sslsocket()</v>
+        <v>Options = [socketoption]()</v>
+      </type>
+      <desc>
+        <p>Sets options according to <c>Options</c> for the socket 
+          <c>Socket</c>. </p>
+      </desc>
+    </func>
+    <func>
+      <name>ssl_accept(Socket) -> ok | {error, Reason}</name>
+      <name>ssl_accept(Socket, Timeout) -> ok | {error, Reason}</name>
+      <fsummary>Perform server-side SSL handshake and key exchange</fsummary>
+      <type>
+        <v>Socket = sslsocket()</v>
+        <v>Timeout = integer()</v>
+        <v>Reason = atom()</v>
+      </type>
+      <desc>
+        <p>The <c>ssl_accept</c> function establish the SSL connection
+          on the server side. It should be called directly after
+          <c>transport_accept</c>, in the spawned server-loop.</p>
+        <p>Note that the ssl connection is not complete until <c>ssl_accept</c>
+          has returned <c>true</c>, and if an error is returned, the socket
+          is unavailable and for instance <c>close/1</c> will crash.</p>
+      </desc>
+    </func>
+    <func>
+      <name>sockname(Socket) -> {ok, {Address, Port}} | {error, Reason}</name>
+      <fsummary>Return the local address and port.</fsummary>
+      <type>
+        <v>Socket = sslsocket()</v>
+        <v>Address = ipaddress()</v>
+        <v>Port = integer()</v>
+      </type>
+      <desc>
+        <p>Returns the local address and port number of the socket
+          <c>Socket</c>.</p>
+      </desc>
+    </func>
+    <func>
+      <name>transport_accept(Socket) -> {ok, NewSocket} | {error, Reason}</name>
+      <name>transport_accept(Socket, Timeout) -> {ok, NewSocket} | {error, Reason}</name>
+      <fsummary>Accept an incoming connection and prepare for <c>ssl_accept</c></fsummary>
+      <type>
+        <v>Socket = NewSocket = sslsocket()</v>
+        <v>Timeout = integer()</v>
+        <v>Reason = atom()</v>
+      </type>
+      <desc>
+        <p>Accepts an incoming connection request on a listen socket.
+          <c>ListenSocket</c> must be a socket returned from <c>listen/2</c>.
+          The socket returned should be passed to <c>ssl_accept</c> to
+          complete ssl handshaking and establishing the connection.</p>
+        <warning>
+          <p>The socket returned can only be used with <c>ssl_accept</c>,
+            no traffic can be sent or received before that call.</p>
+        </warning>
+        <p>The accepted socket inherits the options set for <c>ListenSocket</c>
+          in <c>listen/2</c>.</p>
+        <p>The default value for <c>Timeout</c> is <c>infinity</c>. If 
+          <c>Timeout</c> is specified, and no connection is accepted within
+          the given time, <c>{error, timeout}</c> is returned.</p>
+      </desc>
+    </func>
+    <func>
+      <name>version() -> {ok, {SSLVsn, CompVsn, LibVsn}}</name>
+      <fsummary>Return the version of SSL.</fsummary>
+      <type>
+        <v>SSLVsn = CompVsn = LibVsn = string()()</v>
+      </type>
+      <desc>
+        <p>Returns the SSL application version (<c>SSLVsn</c>), the library
+          version used when compiling the SSL application port program
+          (<c>CompVsn</c>), and the actual library version used when
+          dynamically linking in runtime (<c>LibVsn</c>).
+          </p>
+        <p>If the SSL application has not been started, <c>CompVsn</c> and
+          <c>LibVsn</c> are empty strings.
+          </p>
+      </desc>
+    </func>
+  </funcs>
+
+  <section>
+    <title>ERRORS</title>
+    <p>The possible error reasons and the corresponding diagnostic strings 
+      returned by <c>format_error/1</c> are either the same as those defined
+      in the <c>inet(3)</c> reference manual, or as follows:
+      </p>
+    <taglist>
+      <tag><c>closed</c></tag>
+      <item>
+        <p>Connection closed for the operation in question.
+          </p>
+      </item>
+      <tag><c>ebadsocket</c></tag>
+      <item>
+        <p>Connection not found (internal error).
+          </p>
+      </item>
+      <tag><c>ebadstate</c></tag>
+      <item>
+        <p>Connection not in connect state (internal error).
+          </p>
+      </item>
+      <tag><c>ebrokertype</c></tag>
+      <item>
+        <p>Wrong broker type (internal error).
+          </p>
+      </item>
+      <tag><c>ecacertfile</c></tag>
+      <item>
+        <p>Own CA certificate file is invalid.
+          </p>
+      </item>
+      <tag><c>ecertfile</c></tag>
+      <item>
+        <p>Own certificate file is invalid.
+          </p>
+      </item>
+      <tag><c>echaintoolong</c></tag>
+      <item>
+        <p>The chain of certificates provided by peer is too long.
+          </p>
+      </item>
+      <tag><c>ecipher</c></tag>
+      <item>
+        <p>Own list of specified ciphers is invalid.
+          </p>
+      </item>
+      <tag><c>ekeyfile</c></tag>
+      <item>
+        <p>Own private key file is invalid.
+          </p>
+      </item>
+      <tag><c>ekeymismatch</c></tag>
+      <item>
+        <p>Own private key does not match own certificate.
+          </p>
+      </item>
+      <tag><c>enoissuercert</c></tag>
+      <item>
+        <p>Cannot find certificate of issuer of certificate provided
+          by peer.
+          </p>
+      </item>
+      <tag><c>enoservercert</c></tag>
+      <item>
+        <p>Attempt to do accept without having set own certificate.
+          </p>
+      </item>
+      <tag><c>enotlistener</c></tag>
+      <item>
+        <p>Attempt to accept on a non-listening socket.
+          </p>
+      </item>
+      <tag><c>enoproxysocket</c></tag>
+      <item>
+        <p>No proxy socket found (internal error).
+          </p>
+      </item>
+      <tag><c>enooptions</c></tag>
+      <item>
+        <p>The list of options is empty.
+          </p>
+      </item>
+      <tag><c>enotstarted</c></tag>
+      <item>
+        <p>The SSL application has not been started.
+          </p>
+      </item>
+      <tag><c>eoptions</c></tag>
+      <item>
+        <p>Invalid list of options.
+          </p>
+      </item>
+      <tag><c>epeercert</c></tag>
+      <item>
+        <p>Certificate provided by peer is in error.
+          </p>
+      </item>
+      <tag><c>epeercertexpired</c></tag>
+      <item>
+        <p>Certificate provided by peer has expired.
+          </p>
+      </item>
+      <tag><c>epeercertinvalid</c></tag>
+      <item>
+        <p>Certificate provided by peer is invalid.
+          </p>
+      </item>
+      <tag><c>eselfsignedcert</c></tag>
+      <item>
+        <p>Certificate provided by peer is self signed.
+          </p>
+      </item>
+      <tag><c>esslaccept</c></tag>
+      <item>
+        <p>Server SSL handshake procedure between client and server failed.
+          </p>
+      </item>
+      <tag><c>esslconnect</c></tag>
+      <item>
+        <p>Client SSL handshake procedure between client and server failed.
+          </p>
+      </item>
+      <tag><c>esslerrssl</c></tag>
+      <item>
+        <p>SSL protocol failure. Typically because of a fatal alert 
+          from peer.
+          </p>
+      </item>
+      <tag><c>ewantconnect</c></tag>
+      <item>
+        <p>Protocol wants to connect, which is not supported in
+          this version of the SSL application.
+          </p>
+      </item>
+      <tag><c>ex509lookup</c></tag>
+      <item>
+        <p>Protocol wants X.509 lookup, which is not supported in
+          this version of the SSL application.
+          </p>
+      </item>
+      <tag><c>{badcall, Call}</c></tag>
+      <item>
+        <p>Call not recognized for current mode (active or passive) and
+          state of socket.
+          </p>
+      </item>
+      <tag><c>{badcast, Cast}</c></tag>
+      <item>
+        <p>Call not recognized for current mode (active or passive) and
+          state of socket. 
+          </p>
+      </item>
+      <tag><c>{badinfo, Info}</c></tag>
+      <item>
+        <p>Call not recognized for current mode (active or passive) and
+          state of socket.
+          </p>
+      </item>
+    </taglist>
+  </section>
+
+  <section>
+    <title>SEE ALSO</title>
+    <p>gen_tcp(3), inet(3) public_key(3) </p>
+  </section>
+  
+</erlref>
+
+
diff --git a/lib/ssl/doc/src/refman.xml b/lib/ssl/doc/src/refman.xml
index 3ad5a01b46..9658e229eb 100644
--- a/lib/ssl/doc/src/refman.xml
+++ b/lib/ssl/doc/src/refman.xml
@@ -4,7 +4,7 @@
 <application xmlns:xi="http://www.w3.org/2001/XInclude">
   <header>
     <copyright>
-      <year>1999</year><year>2009</year>
+      <year>1999</year><year>2010</year>
       <holder>Ericsson AB. All Rights Reserved.</holder>
     </copyright>
     <legalnotice>
@@ -13,12 +13,12 @@
       compliance with the License. You should have received a copy of the
       Erlang Public License along with this software. If not, it can be
       retrieved online at http://www.erlang.org/.
-    
+
       Software distributed under the License is distributed on an "AS IS"
       basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
       the License for the specific language governing rights and limitations
       under the License.
-    
+
     </legalnotice>
 
     <title>SSL Reference Manual</title>
@@ -45,7 +45,7 @@
   </description>
   <xi:include href="ssl_app.xml"/>
   <xi:include href="ssl.xml"/>
-  <xi:include href="new_ssl.xml"/>  
+  <xi:include href="old_ssl.xml"/>  
 </application>
 
 
diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml
index 217eb791d0..75aa8f2fe9 100644
--- a/lib/ssl/doc/src/ssl.xml
+++ b/lib/ssl/doc/src/ssl.xml
@@ -4,7 +4,7 @@
 <erlref>
   <header>
     <copyright>
-      <year>1999</year><year>2009</year>
+      <year>1999</year><year>2010</year>
       <holder>Ericsson AB. All Rights Reserved.</holder>
     </copyright>
     <legalnotice>
@@ -13,355 +13,418 @@
       compliance with the License. You should have received a copy of the
       Erlang Public License along with this software. If not, it can be
       retrieved online at http://www.erlang.org/.
-    
+
       Software distributed under the License is distributed on an "AS IS"
       basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
       the License for the specific language governing rights and limitations
       under the License.
-    
-    </legalnotice>
 
+    </legalnotice>
     <title>ssl</title>
-    <prepared>Peter H&ouml;gfeldt</prepared>
-    <responsible>Peter H&ouml;gfeldt</responsible>
+    <prepared>Ingela Anderton Andin</prepared>
+    <responsible>Ingela Anderton Andin</responsible>
     <docno></docno>
-    <approved>Peter H&ouml;gfeldt</approved>
+    <approved></approved>
     <checked></checked>
     <date>2003-03-25</date>
-    <rev>D</rev>
-    <file>ssl.sgml</file>
+    <rev></rev>
+    <file>ssl.xml</file>
   </header>
   <module>ssl</module>
   <modulesummary>Interface Functions for Secure Socket Layer</modulesummary>
   <description>
-    <p>This module contains interface functions to the Secure Socket Layer.</p>
+    <p>This module contains interface functions to the Secure Socket
+      Layer. 
+    </p>
   </description>
+  
+  <section>
+    <title>SSL</title>
 
+    <list type="bulleted">
+      <item>ssl requires the crypto an public_key applications.</item>
+      <item>Supported SSL/TLS-versions are SSL-3.0 and TLS-1.0 </item>
+      <item>For security reasons sslv2 is not supported.</item>
+      <item>Ephemeral Diffie-Hellman cipher suites are supported
+      but not Diffie Hellman Certificates cipher suites.</item>
+      <item>Export cipher suites are not supported as the
+      U.S. lifted its export restrictions in early 2000.</item>
+      <item>CRL and policy certificate
+            extensions are not supported yet. </item>
+    </list>
+ 
+  </section>
+  
   <section>
-    <title>General</title>
+    <title>COMMON DATA TYPES</title>
+    <p>The following data types are used in the functions below:
+    </p>
 
-    <p>There is a new implementation of ssl available in 
-    this module but until it is 100 % complete, so that it can replace
-    the old implementation in all aspects it will be
-    described here <seealso marker="new_ssl"> new ssl API </seealso></p>
+    <p><c>boolean() = true | false</c></p> 
     
-    <p>The reader is advised to also read the <c>ssl(6)</c> manual page
-      describing the SSL application.
-      </p>
-    <warning>
-      <p>It is strongly advised to seed the random generator after
-        the ssl application has been started (see <c>seed/1</c>
-        below), and before any connections are established. Although
-        the port program interfacing to the ssl libraries does a
-        "random" seeding of its own in order to make everything work
-        properly, that seeding is by no means random for the world
-        since it has a constant value which is known to everyone
-        reading the source code of the port program.</p>
-    </warning>
-  </section>
+    <p><c>property() = atom()</c></p>
+    
+    <p><c>option() = socketoption() | ssloption() | transportoption()</c></p>
 
-  <section>
-    <title>Common data types</title>
-    <p>The following datatypes are used in the functions below:
-      </p>
-    <list type="bulleted">
-      <item>
-        <p><c>options() = [option()]</c></p>
-      </item>
-      <item>
-        <p><c>option() = socketoption() | ssloption()</c></p>
-      </item>
-      <item>
-        <p><c>socketoption() = {mode, list} | {mode, binary} |  binary | {packet, packettype()} | {header, integer()} | {nodelay, boolean()} | {active, activetype()} |  {backlog, integer()} | {ip, ipaddress()} | {port, integer()}</c></p>
-      </item>
-      <item>
-        <p><c>ssloption() = {verify, code()} | {depth, depth()} |  {certfile, path()} | {keyfile, path()} | {password, string()} | {cacertfile, path()} | {ciphers, string()}</c></p>
-      </item>
-      <item>
-        <p><c>packettype()</c>  (see inet(3))</p>
-      </item>
-      <item>
-        <p><c>activetype()</c>  (see inet(3))</p>
-      </item>
-      <item>
-        <p><c>reason() = atom() | {atom(), string()}</c></p>
-      </item>
-      <item>
-        <p><c>bytes() = [byte()]</c></p>
-      </item>
-      <item>
-        <p><c>string() = [byte()]</c></p>
-      </item>
-      <item>
-        <p><c>byte() = 0 | 1 | 2 | ... | 255</c></p>
-      </item>
-      <item>
-        <p><c>code() = 0 | 1 | 2</c></p>
-      </item>
-      <item>
-        <p><c>depth() = byte()</c></p>
-      </item>
-      <item>
-        <p><c>address() = hostname() | ipstring() | ipaddress()</c></p>
-      </item>
-      <item>
-        <p><c>ipaddress() = ipstring() | iptuple()</c></p>
-      </item>
-      <item>
-        <p><c>hostname() = string()</c></p>
-      </item>
-      <item>
-        <p><c>ipstring() = string()</c></p>
-      </item>
-      <item>
-        <p><c>iptuple() = {byte(), byte(), byte(), byte()}</c></p>
-      </item>
-      <item>
-        <p><c>sslsocket()</c></p>
-      </item>
-      <item>
-        <p><c>protocol() = sslv2 | sslv3 | tlsv1</c></p>
-      </item>
-      <item>
-        <p><c></c></p>
-      </item>
-    </list>
-    <p>The socket option <c>{backlog, integer()}</c> is for
-      <c>listen/2</c> only, and the option <c>{port, integer()}</c>
-      is for <c>connect/3/4</c> only. 
-      </p>
-    <p>The following socket options are set by default: <c>{mode, list}</c>, <c>{packet, 0}</c>, <c>{header, 0}</c>, <c>{nodelay, false}</c>, <c>{active, true}</c>, <c>{backlog, 5}</c>,
-      <c>{ip, {0,0,0,0}}</c>, and <c>{port, 0}</c>.
-      </p>
-    <p>Note that the options <c>{mode, binary}</c> and <c>binary</c>
-      are equivalent. Similarly <c>{mode, list}</c> and the absence of
-      option <c>binary</c> are equivalent. 
-      </p>
-    <p>The ssl options are for setting specific SSL parameters as follows:
-      </p>
-    <list type="bulleted">
-      <item>
-        <p><c>{verify, code()}</c> Specifies type of verification:
-          0 = do not verify peer; 1 = verify peer, 2 = verify peer,
-          fail if no peer certificate.  The default value is 0.
-          </p>
+     <p><c>socketoption() = [{property(), term()}] - defaults to
+      [{mode,list},{packet, 0},{header, 0},{active, true}].
+    </c></p>
+
+    <p>For valid options
+      see <seealso marker="kernel:inet">inet(3) </seealso> and
+      <seealso marker="kernel:gen_tcp">gen_tcp(3) </seealso>.
+    </p>
+    
+    <p> <c>ssloption() = {verify, verify_type()} |
+      {fail_if_no_peer_cert, boolean()}
+      {depth, integer()} |
+      {certfile, path()} | {keyfile, path()} | {password, string()} |
+      {cacertfile, path()} | {dhfile, path()} | {ciphers, ciphers()} |
+      {ssl_imp, ssl_imp()} | {reuse_sessions, boolean()} | {reuse_session, fun()} 
+    </c></p>
+
+    <p><c>transportoption() = {CallbackModule, DataTag, ClosedTag}
+	- defaults to {gen_tcp, tcp, tcp_closed}. Ssl may be
+	run over any reliable transport protocol that has
+	an equivalent API to gen_tcp's.</c></p>
+    
+    <p><c>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CallbackModule =
+	atom()</c>
+    </p> <p><c>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DataTag =
+	atom() - tag used in socket data message.</c></p>
+    <p><c>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ClosedTag = atom() - tag used in
+    socket close message.</c></p>
+
+    <p><c>verify_type() = verify_none | verify_peer</c></p>
+    
+    <p><c>path() = string() - representing a file path.</c></p>
+    
+    <p><c>host() = hostname() | ipaddress()</c></p>
+        
+    <p><c>hostname() = string()</c></p>
+    
+    <p><c>
+      ip_address() = {N1,N2,N3,N4}  % IPv4
+      | {K1,K2,K3,K4,K5,K6,K7,K8}  % IPv6    </c></p>
+
+    <p><c>sslsocket() - opaque to the user. </c></p>
+    
+    <p><c>protocol() = sslv3 | tlsv1 </c></p>
+    
+    <p><c>ciphers() = [ciphersuite()] | string() (according to old API)</c></p>
+    
+    <p><c>ciphersuite() =
+      {key_exchange(), cipher(), hash()}</c></p>
+    
+    <p><c>key_exchange() =  rsa | dhe_dss | dhe_rsa
+    </c></p>
+
+   <p><c>cipher() = rc4_128 | des_cbc | '3des_ede_cbc'
+      | aes_128_cbc | aes_256_cbc </c></p>
+
+   <p> <c>hash() = md5 | sha
+    </c></p>
+
+    <p><c>ssl_imp() = new | old - default is new.</c></p>
+    
+  </section>
+  
+<section>
+    <title>SSL OPTION DESCRIPTIONS</title>
+    
+    <taglist>
+      <tag>{verify, verify_type()}</tag>
+      <item> If <c>verify_none</c> is specified x509-certificate
+      path validation errors at the client side
+      will not  automatically cause the connection to fail, as
+      it will if the verify type is <c>verify_peer</c>. See also
+      the option verify_fun.
+      Servers only do the path validation if <c>verify_peer</c> is set to
+      true, as it then will 
+      send a certificate request to
+      the client (this message is not sent if the verify option is
+      <c>verify_none</c>) and you may then also want to specify
+      the option <c>fail_if_no_peer_cert</c>.
       </item>
-      <item>
-        <p><c>{depth, depth()}</c> Specifies the maximum
-          verification depth, i.e. how far in a chain of certificates
-          the verification process can proceed before the verification
-          is considered to fail. 
-          </p>
-        <p>Peer certificate = 0, CA certificate = 1, higher level CA
-          certificate = 2, etc.  The value 2 thus means that a chain
-          can at most contain peer cert, CA cert, next CA cert, and an
-          additional CA cert.
-          </p>
-        <p>The default value is 1.
-          </p>
+
+      <tag>{fail_if_no_peer_cert, boolean()}</tag>
+      <item>Used together with {verify, verify_peer} by a ssl server.
+      If set to true,
+      the server will fail if the client does not have a certificate
+      to send, e.i sends a empty certificate, if set to false it will
+      only fail if the client sends a invalid certificate (an empty
+      certificate is considered valid).
+      </item>
+      
+      <tag>{verify_fun, fun(ErrorList) -> boolean()}</tag>
+      <item>Used by the ssl client to determine if 
+	x509-certificate path validations errors are acceptable or
+	if the connection should fail. Defaults to:
+       
+<code>
+fun(ErrorList) ->
+	case lists:foldl(fun({bad_cert,unknown_ca}, Acc) ->
+						  Acc;
+			    (Other, Acc) ->
+				 [Other | Acc]
+			 end, [], ErrorList) of
+	    [] ->
+		true;
+	    [_|_] ->
+		false
+	end
+end
+</code>
+       I.e. by default if the only error found was that the CA-certificate
+       holder was unknown this will be accepted.
+
+       Possible errors in the error list are: 
+       {bad_cert, cert_expired}, {bad_cert, invalid_issuer},
+       {bad_cert, invalid_signature}, {bad_cert, name_not_permitted},
+       {bad_cert, unknown_ca},
+       {bad_cert, cert_expired}, {bad_cert, invalid_issuer},
+       {bad_cert, invalid_signature}, {bad_cert, name_not_permitted},
+       {bad_cert, cert_revoked} (not implemented yet),
+       {bad_cert, unknown_critical_extension} or {bad_cert, term()} (Will
+								    be relevant later when an option is added for the user to be able to verify application specific extensions.) 
+      </item>
+      
+      <tag>{depth, integer()}</tag>
+      <item>Specifies the maximum
+      verification depth, i.e. how far in a chain of certificates the
+      verification process can proceed before the verification is
+      considered to fail. Peer certificate = 0, CA certificate = 1,
+      higher level CA certificate = 2, etc.  The value 2 thus means
+      that a chain can at most contain peer cert, CA cert, next CA
+      cert, and an additional CA cert. The default value is 1.
       </item>
-      <item>
-        <p><c>{certfile, path()}</c> Path to a file containing the
-          user's certificate.
-          chain of PEM encoded certificates.</p>
+
+      <tag>{certfile, path()}</tag>
+      <item>Path to a file containing the
+          user's certificate. Optional for clients but note
+      that some servers requires that the client can certify
+      itself. </item>
+      <tag>{keyfile, path()}</tag>
+      <item>Path to file containing user's
+      private PEM encoded key. As PEM-files may contain several
+      entries this option defaults to the same file as given by
+      certfile option.</item>
+      <tag>{password, string()}</tag>
+      <item>String containing the user's password.
+	Only used if the private keyfile is password protected.
+      </item>
+      <tag>{cacertfile, path()}</tag>
+      <item>Path to file containing PEM encoded
+      CA certificates (trusted certificates used for verifying a peer
+      certificate). May be omitted if you do not want to verify
+      the peer.</item>
+
+      <tag>{dhfile, path()}</tag>
+      <item>Path to file containing PEM encoded Diffie Hellman parameters,
+      for the server to use if a cipher suite using Diffie Hellman key exchange
+      is negotiated. If not specified hardcode parameters will be used.
       </item>
-      <item>
-        <p><c>{keyfile, path()}</c> Path to file containing user's
-          private PEM encoded key.</p>
+      
+      <tag>{ciphers, ciphers()}</tag>
+      <item>The function <c>ciphers_suites/0</c> can
+	be used to find all available ciphers.
       </item>
-      <item>
-        <p><c>{password, string()}</c> String containing the user's
-          password. Only used if the private keyfile is password protected.</p>
+
+      <tag>{ssl_imp, ssl_imp()}</tag>
+      <item>Specify which ssl implementation you want to use.
       </item>
-      <item>
-        <p><c>{cacertfile, path()}</c> Path to file containing PEM encoded
-          CA certificates (trusted certificates used for verifying a peer
-          certificate).</p>
+
+      <tag>{reuse_sessions, boolean()}</tag>
+      <item>Specifies if ssl sessions should be reused
+	when possible.
       </item>
-      <item>
-        <p><c>{ciphers, string()}</c> String of ciphers as a colon
-          separated list of ciphers. The function <c>ciphers/0</c> can
-          be used to find all available ciphers.</p>
+
+       <tag>{reuse_session, fun(SuggestedSessionId,
+       PeerCert, Compression, CipherSuite) -> boolean()}</tag>
+      <item>Enables the ssl server to have a local policy
+      for deciding if a session should be reused or not,
+      only meaning full if <c>reuse_sessions</c> is set to true.
+      SuggestedSessionId is a binary(),  PeerCert is a DER encoded
+      certificate, Compression is an enumeration integer
+      and CipherSuite of type ciphersuite().      
       </item>
-    </list>
-    <p>The type <c>sslsocket()</c> is opaque to the user.
-      </p>
-    <p>The owner of a socket is the one that created it by a call to
-      <c>transport_accept/[1,2]</c>,  <c>connect/[3,4]</c>,
-      or <c>listen/2</c>.
-      </p>
-    <p>When a socket is in active mode (the default), data from the
+    </taglist>
+  </section>
+  
+  <section>
+    <title>General</title>
+      
+    <p>When a ssl socket is in active mode (the default), data from the
       socket is delivered to the owner of the socket in the form of
       messages:
-      </p>
+    </p>
     <list type="bulleted">
-      <item>
-        <p><c>{ssl, Socket, Data}</c></p>
+      <item>{ssl, Socket, Data}
       </item>
-      <item>
-        <p><c>{ssl_closed, Socket}</c></p>
+      <item>{ssl_closed, Socket}
       </item>
       <item>
-        <p><c>{ssl_error, Socket, Reason}</c></p>
+        {ssl_error, Socket, Reason}
       </item>
     </list>
+    
     <p>A <c>Timeout</c> argument specifies a timeout in milliseconds. The 
       default value for a <c>Timeout</c> argument is <c>infinity</c>.
-      </p>
-    <p>Functions listed below may return the value <c>{error, closed}</c>, which only indicates that the SSL socket is
-      considered closed for the operation in question. It is for
-      instance possible to have <c>{error, closed}</c> returned from
-      an call to <c>send/2</c>, and a subsequent call to <c>recv/3</c>
-      returning <c>{ok, Data}</c>.
-      </p>
-    <p>Hence a return value of <c>{error, closed}</c> must not be
-      interpreted as if the socket was completely closed. On the
-      contrary, in order to free all resources occupied by an SSL
-      socket, <c>close/1</c> must be called, or else the process owning
-      the socket has to terminate.
-      </p>
-    <p>For each SSL socket there is an Erlang process representing the
-      socket.  When a socket is opened, that process links to the
-      calling client process.  Implementations that want to detect
-      abnormal exits from the socket process by receiving <c>{'EXIT', Pid, Reason}</c> messages, should use the function <c>pid/1</c>
-      to retrieve the process identifier from the socket, in order to
-      be able to match exit messages properly.</p>
+    </p>
   </section>
+  
   <funcs>
     <func>
-      <name>ciphers() -> {ok, string()} | {error, enotstarted}</name>
-      <fsummary>Get supported ciphers.</fsummary>
-      <desc>
-        <p>Returns a string consisting of colon separated cipher
-          designations that are supported by the current SSL library
-          implementation.
-          </p>
-        <p>The SSL application has to be started to return the string
-          of ciphers.</p>
-      </desc>
+      <name>cipher_suites() -></name>
+      <name>cipher_suites(Type) -> ciphers()</name>
+      <fsummary> Returns a list of supported cipher suites</fsummary>
+      <type>
+        <v>Type = erlang | openssl</v>
+
+      </type>
+      <desc><p>Returns a list of supported cipher suites.
+	cipher_suites() is equivalent to cipher_suites(erlang).
+	Type openssl is provided for backwards compatibility with
+	old ssl that used openssl.
+	</p>
+    </desc>
     </func>
+    
     <func>
-      <name>close(Socket) -> ok | {error, Reason}</name>
-      <fsummary>Close a socket returned by <c>transport_accept/[1,2]</c>, <c>connect/3/4</c>, or <c>listen/2</c>.</fsummary>
+      <name>connect(Socket, SslOptions) -> </name>
+      <name>connect(Socket, SslOptions, Timeout) -> {ok, SslSocket}
+	| {error, Reason}</name>
+      <fsummary> Upgrades a gen_tcp, or
+	equivalent, connected socket to a ssl socket. </fsummary>
       <type>
-        <v>Socket = sslsocket()</v>
+        <v>Socket = socket()</v>
+        <v>SslOptions = [ssloption()]</v>
+	<v>Timeout = integer() | infinity</v>
+	<v>SslSocket = sslsocket()</v>
+	<v>Reason = term()</v>
       </type>
-      <desc>
-	<p>Closes a socket returned by <c>transport_accept/[1,2]</c>,
-	<c>connect/[3,4]</c>, or <c>listen/2</c></p>
-      </desc>
+      <desc> <p>Upgrades a gen_tcp, or equivalent,
+	  connected socket to a ssl socket e.i performs the
+	  client-side ssl handshake.</p>
+    </desc>
     </func>
+
     <func>
-      <name>connect(Address, Port, Options) -> {ok, Socket} | {error, Reason}</name>
-      <name>connect(Address, Port, Options, Timeout) -> {ok, Socket} | {error, Reason}</name>
-      <fsummary>Connect to <c>Port</c>at <c>Address</c>.</fsummary>
+      <name>connect(Host, Port, Options) -></name>
+      <name>connect(Host, Port, Options, Timeout) ->
+	  {ok, SslSocket} | {error, Reason}</name>
+      <fsummary>Opens an ssl connection to Host, Port. </fsummary>
       <type>
-        <v>Address = address()</v>
-        <v>Port = integer()</v>
-        <v>Options = [connect_option()]</v>
-        <v>connect_option() = {mode, list} | {mode, binary} | binary | {packet, packettype()} | {header, integer()} | {nodelay, boolean()} | {active, activetype()} | {ip, ipaddress()} | {port, integer()} | {verify, code()} | {depth, depth()} | {certfile, path()} | {keyfile, path()} | {password, string()} | {cacertfile, path()} | {ciphers, string()}</v>
-        <v>Timeout = integer()</v>
-        <v>Socket = sslsocket()</v>
+	  <v>Host = host()</v>
+	  <v>Port = integer()</v>
+	  <v>Options = [option()]</v>
+	  <v>Timeout = integer() | infinity</v>
+	  <v>SslSocket = sslsocket()</v>
+	  <v>Reason = term()</v>
       </type>
-      <desc>
-        <p>Connects to <c>Port</c> at <c>Address</c>. If the optional 
-          <c>Timeout</c> argument is specified, and a connection could not
-          be established within the given time, <c>{error, timeout}</c> is
-          returned. The default value for <c>Timeout</c> is <c>infinity</c>.
-          </p>
-        <p>The <c>ip</c> and <c>port</c> options are for binding to a 
-          particular <em>local</em> address and port, respectively.</p>
-      </desc>
+      <desc> <p>Opens an ssl connection to Host, Port.</p> </desc>
     </func>
+
     <func>
-      <name>connection_info(Socket) -> {ok, {Protocol, Cipher}} | {error, Reason}</name>
-      <fsummary>Get current protocol version and cipher.</fsummary>
+      <name>close(SslSocket) -> ok | {error, Reason}</name>
+      <fsummary>Close a ssl connection</fsummary>
       <type>
-        <v>Socket = sslsocket()</v>
-        <v>Protocol = protocol()</v>
-        <v>Cipher = string()</v>
+	  <v>SslSocket = sslsocket()</v>
+	  <v>Reason = term()</v>
       </type>
-      <desc>
-        <p>Gets the chosen protocol version and cipher for an established
-          connection (accepted och connected). </p>
+      <desc><p>Close a ssl connection.</p>
       </desc>
     </func>
+
     <func>
-      <name>controlling_process(Socket, NewOwner) -> ok | {error, Reason}</name>
-      <fsummary>Assign a new controlling process to the socket.</fsummary>
+      <name>controlling_process(SslSocket, NewOwner) ->
+	ok | {error, Reason}</name>
+      
+	<fsummary>Assigns a new controlling process to the
+	ssl-socket.</fsummary>
+      
+	<type>
+	  <v>SslSocket = sslsocket()</v>
+	  <v>NewOwner = pid()</v>
+	  <v>Reason = term()</v>
+	</type>
+	<desc><p>Assigns a new controlling process to the ssl-socket. A
+      controlling process is the owner of a ssl-socket, and receives
+      all messages from the socket.</p>
+      </desc>
+    </func>
+
+    <func>
+	<name>connection_info(SslSocket) ->
+	  {ok, {ProtocolVersion, CipherSuite}} |  {error, Reason} </name>
+      <fsummary>Returns the negotiated protocol version and cipher suite.
+      </fsummary>
       <type>
-        <v>Socket = sslsocket()</v>
-        <v>NewOwner = pid()</v>
+        <v>CipherSuite = ciphersuite()</v>
+        <v>ProtocolVersion = protocol()</v>
       </type>
-      <desc>
-        <p>Assigns a new controlling process to <c>Socket</c>. A controlling
-          process is the owner of a socket, and receives all messages from
-          the socket.</p>
+      <desc><p>Returns the negotiated protocol version and cipher suite.</p> 
       </desc>
     </func>
-    <func>
-      <name>format_error(ErrorCode) -> string()</name>
+
+     <func>
+      <name>format_error(Reason) -> string()</name>
       <fsummary>Return an error string.</fsummary>
       <type>
-        <v>ErrorCode = term()</v>
+        <v>Reason = term()</v>
       </type>
       <desc>
-        <p>Returns a diagnostic string describing an error.</p>
+        <p>Presents the error returned by an ssl function as a printable string.</p>
       </desc>
     </func>
+   
     <func>
-      <name>getopts(Socket, OptionsTags) -> {ok, Options} | {error, Reason}</name>
-      <fsummary>Get options set for socket</fsummary>
+      <name>getopts(Socket) -> </name>
+      <name>getopts(Socket, OptionNames) ->
+	{ok, [socketoption()]} | {error, Reason}</name>
+      <fsummary>Get the value of the specified options.</fsummary>
       <type>
-        <v>Socket = sslsocket()</v>
-        <v>OptionTags = [optiontag()]()</v>
+	<v>Socket = sslsocket()</v>
+	<v>OptionNames = [property()]</v>
       </type>
       <desc>
-        <p>Returns the options the tags of which are <c>OptionTags</c> for
-          for the socket <c>Socket</c>. </p>
+	<p>Get the value of the specified socket options, if no
+	  options are specified all options are returned.
+	</p>
       </desc>
     </func>
+
     <func>
-      <name>listen(Port, Options) -> {ok, ListenSocket} | {error, Reason}</name>
-      <fsummary>Set up a socket to listen on a port on the local host.</fsummary>
+      <name>listen(Port, Options) ->
+	{ok, ListenSocket} | {error, Reason}</name>
+      <fsummary>Creates a ssl listen socket.</fsummary>
       <type>
-        <v>Port = integer()</v>
-        <v>Options = [listen_option()]</v>
-        <v>listen_option() = {mode, list} | {mode, binary} | binary | {packet, packettype()} | {header, integer()} | {active, activetype()} | {backlog, integer()} | {ip, ipaddress()} | {verify, code()} | {depth, depth()} | {certfile, path()} | {keyfile, path()} | {password, string()} | {cacertfile, path()} | {ciphers, string()}</v>
-        <v>ListenSocket = sslsocket()</v>
+	<v>Port = integer()</v>
+	<v>Options = options()</v>
+	<v>ListenSocket = sslsocket()</v>
       </type>
       <desc>
-        <p>Sets up a socket to listen on port <c>Port</c> at the local host.
-          If <c>Port</c> is zero, <c>listen/2</c> picks an available port
-          number (use <c>port/1</c> to retrieve it).
-          </p>
-        <p>The listen queue size defaults to 5. If a different value is 
-          wanted, the option <c>{backlog, Size}</c> should be added to the 
-          list of options.
-          </p>
-        <p>An empty <c>Options</c> list is considered an error, and
-          <c>{error, enooptions}</c> is returned.
-          </p>
-        <p>The returned <c>ListenSocket</c> can only be used in calls to 
-          <c>transport_accept/[1,2]</c>.</p>
+	<p>Creates a ssl listen socket.</p>
       </desc>
     </func>
+
     <func>
-      <name>peercert(Socket) -> {ok, Cert} |  {error, Reason}</name>
+      <name>peercert(Socket) -> {ok, Cert} | {error, Reason}</name>
       <fsummary>Return the peer certificate.</fsummary>
-      <type>
+     <type>
         <v>Socket = sslsocket()</v>
-        <v>Cert = binary()()</v>
-        <v>Subject = term()()</v>
+        <v>Cert = binary()</v>
+        <v>Subject = term()</v>
       </type>
       <desc>
-	<p>Returns the DER encoded peer certificate, the certificate can be decoded with
-	  <c>public_key:pkix_decode_cert/2</c>.
-	</p>
+        <p>The peer certificate is returned as a DER encoded binary.
+	  The certificate can be decoded with <c>public_key:pkix_decode_cert/2</c>.
+        </p>
       </desc>
     </func>
     <func>
-      <name>peername(Socket) -> {ok, {Address, Port}} | {error, Reason}</name>
+      <name>peername(Socket) -> {ok, {Address, Port}} |
+	{error, Reason}</name>
       <fsummary>Return peer address and port.</fsummary>
       <type>
         <v>Socket = sslsocket()</v>
@@ -372,67 +435,47 @@
         <p>Returns the address and port number of the peer.</p>
       </desc>
     </func>
+    
     <func>
-      <name>pid(Socket) -> pid()</name>
-      <fsummary>Return the pid of the socket process.</fsummary>
-      <type>
-        <v>Socket = sslsocket()</v>
-      </type>
-      <desc>
-        <p>Returns the pid of the socket process. The returned pid should
-          only be used for receiving exit messages.</p>
-      </desc>
-    </func>
-    <func>
-      <name>recv(Socket, Length) -> {ok, Data} | {error, Reason}</name>
-      <name>recv(Socket, Length, Timeout) -> {ok, Data} | {error, Reason}</name>
-      <fsummary>Receive data on socket.</fsummary>
+      <name>recv(Socket, Length) -> </name>
+      <name>recv(Socket, Length, Timeout) -> {ok, Data} | {error,
+	Reason}</name>
+      <fsummary>Receive data on a socket.</fsummary>
       <type>
         <v>Socket = sslsocket()</v>
-        <v>Length = integer() >= 0</v>
+        <v>Length = integer()</v>
         <v>Timeout = integer()</v>
-        <v>Data = bytes() | binary()</v>
+        <v>Data = [char()] | binary()</v>
       </type>
       <desc>
-        <p>Receives data on socket <c>Socket</c> when the socket is in
-          passive mode, i.e. when the option <c>{active, false}</c>
-          has been specified.
-          </p>
-        <p>A notable return value is <c>{error, closed}</c> which
-          indicates that the socket is closed.
-          </p>
-        <p>A positive value of the <c>Length</c> argument is only
-          valid when the socket is in raw mode (option <c>{packet, 0}</c> is set, and the option <c>binary</c> is <em>not</em>
-          set); otherwise it should be set to 0, whence all available
-          bytes are returned.
-          </p>
-        <p>If the optional <c>Timeout</c> parameter is specified, and
-          no data was available within the given time, <c>{error, timeout}</c> is returned. The default value for
-          <c>Timeout</c> is <c>infinity</c>.</p>
+        <p>This function receives a packet from a socket in passive
+          mode. A closed socket is indicated by a return value
+          <c>{error, closed}</c>.</p>
+        <p>The <c>Length</c> argument is only meaningful when
+          the socket is in <c>raw</c> mode and denotes the number of
+          bytes to read. If <c>Length</c> = 0, all available bytes are
+          returned. If <c>Length</c> &gt; 0, exactly <c>Length</c>
+          bytes are returned, or an error; possibly discarding less
+          than <c>Length</c> bytes of data when the socket gets closed
+          from the other side.</p>
+        <p>The optional <c>Timeout</c> parameter specifies a timeout in
+          milliseconds. The default value is <c>infinity</c>.</p>
       </desc>
     </func>
+    
     <func>
-      <name>seed(Data) -> ok | {error, Reason}</name>
-      <fsummary>Seed the ssl random generator.</fsummary>
+      <name>renegotiate(Socket) -> ok | {error, Reason}</name>
+      <fsummary> Initiates a new handshake.</fsummary>
       <type>
-        <v>Data = iolist() | binary()</v>
+	<v>Socket = sslsocket()</v>
       </type>
-      <desc>
-        <p>Seeds the ssl random generator.
-          </p>
-        <p>It is strongly advised to seed the random generator after
-          the ssl application has been started, and before any
-          connections are established. Although the port program
-          interfacing to the OpenSSL libraries does a "random" seeding
-          of its own in order to make everything work properly, that
-          seeding is by no means random for the world since it has a 
-          constant value which is known to everyone reading the source
-          code of the seeding. 
-          </p>
-        <p>A notable return value is <c>{error, edata}}</c> indicating that
-          <c>Data</c> was not a binary nor an iolist.</p>
+      <desc><p>Initiates a new handshake. A notable return value is
+      <c>{error, renegotiation_rejected}</c> indicating that the peer
+      refused to go through with the renegotiation but the connection
+      is still active using the previously negotiated session.</p>
       </desc>
     </func>
+    
     <func>
       <name>send(Socket, Data) -> ok | {error, Reason}</name>
       <fsummary>Write data to a socket.</fsummary>
@@ -458,26 +501,65 @@
           <c>Socket</c>. </p>
       </desc>
     </func>
+
     <func>
-      <name>ssl_accept(Socket) -> ok | {error, Reason}</name>
-      <name>ssl_accept(Socket, Timeout) -> ok | {error, Reason}</name>
-      <fsummary>Perform server-side SSL handshake and key exchange</fsummary>
+      <name>shutdown(Socket, How) -> ok | {error, Reason}</name>
+      <fsummary>Immediately close a socket</fsummary>
       <type>
         <v>Socket = sslsocket()</v>
+        <v>How = read | write | read_write</v>
+        <v>Reason = reason()</v>
+      </type>
+      <desc>
+        <p>Immediately close a socket in one or two directions.</p>
+        <p><c>How == write</c> means closing the socket for writing,
+          reading from it is still possible.</p>
+        <p>To be able to handle that the peer has done a shutdown on
+          the write side, the <c>{exit_on_close, false}</c> option
+          is useful.</p>
+      </desc>
+    </func>
+    
+    <func>
+      <name>ssl_accept(ListenSocket) -> </name>
+      <name>ssl_accept(ListenSocket, Timeout) -> ok | {error, Reason}</name>
+      <fsummary>Perform server-side SSL handshake</fsummary>
+      <type>
+        <v>ListenSocket = sslsocket()</v>
         <v>Timeout = integer()</v>
-        <v>Reason = atom()</v>
+        <v>Reason = term()</v>
       </type>
       <desc>
         <p>The <c>ssl_accept</c> function establish the SSL connection
           on the server side. It should be called directly after
           <c>transport_accept</c>, in the spawned server-loop.</p>
-        <p>Note that the ssl connection is not complete until <c>ssl_accept</c>
-          has returned <c>true</c>, and if an error is returned, the socket
-          is unavailable and for instance <c>close/1</c> will crash.</p>
       </desc>
     </func>
+
+    <func>
+      <name>ssl_accept(ListenSocket, SslOptions) -> </name>
+      <name>ssl_accept(ListenSocket, SslOptions, Timeout) -> {ok, Socket} | {error, Reason}</name>
+      <fsummary>Perform server-side SSL handshake</fsummary>
+      <type>
+        <v>ListenSocket = socket()</v>
+	<v>SslOptions = ssloptions()</v>
+        <v>Timeout = integer()</v>
+        <v>Reason = term()</v>
+      </type>
+      <desc>
+        <p> Upgrades a gen_tcp, or
+	  equivalent, socket to a ssl socket e.i performs the
+	ssl server-side handshake.</p>
+	<p><note>Note that the listen socket should be in {active, false} mode
+	before telling the client that the server is ready to upgrade
+	and calling this function, otherwise the upgrade may
+	or may not succeed depending on timing.</note></p>
+      </desc>
+    </func>
+    
     <func>
-      <name>sockname(Socket) -> {ok, {Address, Port}} | {error, Reason}</name>
+      <name>sockname(Socket) -> {ok, {Address, Port}} |
+	{error, Reason}</name>
       <fsummary>Return the local address and port.</fsummary>
       <type>
         <v>Socket = sslsocket()</v>
@@ -489,217 +571,84 @@
           <c>Socket</c>.</p>
       </desc>
     </func>
+    
     <func>
-      <name>transport_accept(Socket) -> {ok, NewSocket} | {error, Reason}</name>
-      <name>transport_accept(Socket, Timeout) -> {ok, NewSocket} | {error, Reason}</name>
-      <fsummary>Accept an incoming connection and prepare for <c>ssl_accept</c></fsummary>
+      <name>start() -> </name>
+      <name>start(Type) -> ok | {error, Reason}</name>
+      <fsummary>Starts the Ssl application. </fsummary>
+      <type>
+        <v>Type =  permanent | transient | temporary</v>
+      </type>
+      <desc>
+        <p>Starts the Ssl application. Default type
+          is temporary.
+          <seealso marker="kernel:application">application(3)</seealso></p>
+      </desc>
+    </func>
+    <func>
+      <name>stop() -> ok </name>
+      <fsummary>Stops the Ssl application.</fsummary>
+      <desc>
+        <p>Stops the Ssl application.
+          <seealso marker="kernel:application">application(3)</seealso></p>
+      </desc>
+    </func>
+
+    <func>
+      <name>transport_accept(Socket) -></name>
+      <name>transport_accept(Socket, Timeout) ->
+	{ok, NewSocket} | {error, Reason}</name>
+      <fsummary>Accept an incoming connection and
+	prepare for <c>ssl_accept</c></fsummary>
       <type>
         <v>Socket = NewSocket = sslsocket()</v>
         <v>Timeout = integer()</v>
-        <v>Reason = atom()</v>
+        <v>Reason = reason()</v>
       </type>
       <desc>
         <p>Accepts an incoming connection request on a listen socket.
-          <c>ListenSocket</c> must be a socket returned from <c>listen/2</c>.
-          The socket returned should be passed to <c>ssl_accept</c> to
-          complete ssl handshaking and establishing the connection.</p>
+          <c>ListenSocket</c> must be a socket returned from
+          <c>listen/2</c>.  The socket returned should be passed to
+          <c>ssl_accept</c> to complete ssl handshaking and
+          establishing the connection.</p>
         <warning>
           <p>The socket returned can only be used with <c>ssl_accept</c>,
             no traffic can be sent or received before that call.</p>
         </warning>
-        <p>The accepted socket inherits the options set for <c>ListenSocket</c>
-          in <c>listen/2</c>.</p>
-        <p>The default value for <c>Timeout</c> is <c>infinity</c>. If 
-          <c>Timeout</c> is specified, and no connection is accepted within
-          the given time, <c>{error, timeout}</c> is returned.</p>
+        <p>The accepted socket inherits the options set for
+          <c>ListenSocket</c> in <c>listen/2</c>.</p>
+	<p>The default
+          value for <c>Timeout</c> is <c>infinity</c>. If
+          <c>Timeout</c> is specified, and no connection is accepted
+          within the given time, <c>{error, timeout}</c> is
+          returned.</p>
       </desc>
     </func>
+    
     <func>
-      <name>version() -> {ok, {SSLVsn, CompVsn, LibVsn}}</name>
-      <fsummary>Return the version of SSL.</fsummary>
+      <name>versions() ->
+	[{SslAppVer, SupportedSslVer, AvailableSslVsn}]</name>
+      <fsummary>Returns version information relevant for the
+	ssl application.</fsummary>
       <type>
-        <v>SSLVsn = CompVsn = LibVsn = string()()</v>
+	<v>SslAppVer = string()</v>
+      	<v>SupportedSslVer = [protocol()]</v>
+      	<v>AvailableSslVsn = [protocol()]</v>
       </type>
       <desc>
-        <p>Returns the SSL application version (<c>SSLVsn</c>), the library
-          version used when compiling the SSL application port program
-          (<c>CompVsn</c>), and the actual library version used when
-          dynamically linking in runtime (<c>LibVsn</c>).
-          </p>
-        <p>If the SSL application has not been started, <c>CompVsn</c> and
-          <c>LibVsn</c> are empty strings.
-          </p>
+	<p>
+	  Returns version information relevant for the
+	  ssl application.</p>
       </desc>
     </func>
-  </funcs>
-
-  <section>
-    <title>ERRORS</title>
-    <p>The possible error reasons and the corresponding diagnostic strings 
-      returned by <c>format_error/1</c> are either the same as those defined
-      in the <c>inet(3)</c> reference manual, or as follows:
-      </p>
-    <taglist>
-      <tag><c>closed</c></tag>
-      <item>
-        <p>Connection closed for the operation in question.
-          </p>
-      </item>
-      <tag><c>ebadsocket</c></tag>
-      <item>
-        <p>Connection not found (internal error).
-          </p>
-      </item>
-      <tag><c>ebadstate</c></tag>
-      <item>
-        <p>Connection not in connect state (internal error).
-          </p>
-      </item>
-      <tag><c>ebrokertype</c></tag>
-      <item>
-        <p>Wrong broker type (internal error).
-          </p>
-      </item>
-      <tag><c>ecacertfile</c></tag>
-      <item>
-        <p>Own CA certificate file is invalid.
-          </p>
-      </item>
-      <tag><c>ecertfile</c></tag>
-      <item>
-        <p>Own certificate file is invalid.
-          </p>
-      </item>
-      <tag><c>echaintoolong</c></tag>
-      <item>
-        <p>The chain of certificates provided by peer is too long.
-          </p>
-      </item>
-      <tag><c>ecipher</c></tag>
-      <item>
-        <p>Own list of specified ciphers is invalid.
-          </p>
-      </item>
-      <tag><c>ekeyfile</c></tag>
-      <item>
-        <p>Own private key file is invalid.
-          </p>
-      </item>
-      <tag><c>ekeymismatch</c></tag>
-      <item>
-        <p>Own private key does not match own certificate.
-          </p>
-      </item>
-      <tag><c>enoissuercert</c></tag>
-      <item>
-        <p>Cannot find certificate of issuer of certificate provided
-          by peer.
-          </p>
-      </item>
-      <tag><c>enoservercert</c></tag>
-      <item>
-        <p>Attempt to do accept without having set own certificate.
-          </p>
-      </item>
-      <tag><c>enotlistener</c></tag>
-      <item>
-        <p>Attempt to accept on a non-listening socket.
-          </p>
-      </item>
-      <tag><c>enoproxysocket</c></tag>
-      <item>
-        <p>No proxy socket found (internal error).
-          </p>
-      </item>
-      <tag><c>enooptions</c></tag>
-      <item>
-        <p>The list of options is empty.
-          </p>
-      </item>
-      <tag><c>enotstarted</c></tag>
-      <item>
-        <p>The SSL application has not been started.
-          </p>
-      </item>
-      <tag><c>eoptions</c></tag>
-      <item>
-        <p>Invalid list of options.
-          </p>
-      </item>
-      <tag><c>epeercert</c></tag>
-      <item>
-        <p>Certificate provided by peer is in error.
-          </p>
-      </item>
-      <tag><c>epeercertexpired</c></tag>
-      <item>
-        <p>Certificate provided by peer has expired.
-          </p>
-      </item>
-      <tag><c>epeercertinvalid</c></tag>
-      <item>
-        <p>Certificate provided by peer is invalid.
-          </p>
-      </item>
-      <tag><c>eselfsignedcert</c></tag>
-      <item>
-        <p>Certificate provided by peer is self signed.
-          </p>
-      </item>
-      <tag><c>esslaccept</c></tag>
-      <item>
-        <p>Server SSL handshake procedure between client and server failed.
-          </p>
-      </item>
-      <tag><c>esslconnect</c></tag>
-      <item>
-        <p>Client SSL handshake procedure between client and server failed.
-          </p>
-      </item>
-      <tag><c>esslerrssl</c></tag>
-      <item>
-        <p>SSL protocol failure. Typically because of a fatal alert 
-          from peer.
-          </p>
-      </item>
-      <tag><c>ewantconnect</c></tag>
-      <item>
-        <p>Protocol wants to connect, which is not supported in
-          this version of the SSL application.
-          </p>
-      </item>
-      <tag><c>ex509lookup</c></tag>
-      <item>
-        <p>Protocol wants X.509 lookup, which is not supported in
-          this version of the SSL application.
-          </p>
-      </item>
-      <tag><c>{badcall, Call}</c></tag>
-      <item>
-        <p>Call not recognized for current mode (active or passive) and
-          state of socket.
-          </p>
-      </item>
-      <tag><c>{badcast, Cast}</c></tag>
-      <item>
-        <p>Call not recognized for current mode (active or passive) and
-          state of socket. 
-          </p>
-      </item>
-      <tag><c>{badinfo, Info}</c></tag>
-      <item>
-        <p>Call not recognized for current mode (active or passive) and
-          state of socket.
-          </p>
-      </item>
-    </taglist>
-  </section>
-
+  </funcs> 
+      
   <section>
     <title>SEE ALSO</title>
-    <p>gen_tcp(3), inet(3) public_key(3) </p>
+    <p><seealso marker="kernel:inet">inet(3) </seealso> and 
+      <seealso marker="kernel:gen_tcp">gen_tcp(3) </seealso>
+    </p>
   </section>
-  
-</erlref>
 
+</erlref>
 
diff --git a/lib/ssl/doc/src/ssl_app.xml b/lib/ssl/doc/src/ssl_app.xml
index ae8bd87781..fac2053532 100644
--- a/lib/ssl/doc/src/ssl_app.xml
+++ b/lib/ssl/doc/src/ssl_app.xml
@@ -4,7 +4,7 @@
 <appref>
   <header>
     <copyright>
-      <year>1999</year><year>2009</year>
+      <year>1999</year><year>2010</year>
       <holder>Ericsson AB. All Rights Reserved.</holder>
     </copyright>
     <legalnotice>
@@ -13,12 +13,12 @@
       compliance with the License. You should have received a copy of the
       Erlang Public License along with this software. If not, it can be
       retrieved online at http://www.erlang.org/.
-    
+
       Software distributed under the License is distributed on an "AS IS"
       basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
       the License for the specific language governing rights and limitations
       under the License.
-    
+
     </legalnotice>
 
     <title>ssl</title>
@@ -35,7 +35,9 @@
   <appsummary>The SSL Application</appsummary>
   <description>
     <p>The Secure Socket Layer (SSL) application provides secure
-      socket communication over TCP/IP.
+      socket communication over TCP/IP. Note that this documentation
+      is mainly valid for the old ssl implementation and will
+      be replaced in a future release.
       </p>
   </description>
 
diff --git a/lib/ssl/doc/src/usersguide.xml b/lib/ssl/doc/src/usersguide.xml
index 98071f5742..76ee13dd23 100644
--- a/lib/ssl/doc/src/usersguide.xml
+++ b/lib/ssl/doc/src/usersguide.xml
@@ -4,7 +4,7 @@
 <part xmlns:xi="http://www.w3.org/2001/XInclude">
   <header>
     <copyright>
-      <year>2000</year><year>2009</year>
+      <year>2000</year><year>2010</year>
       <holder>Ericsson AB. All Rights Reserved.</holder>
     </copyright>
     <legalnotice>
@@ -13,12 +13,12 @@
       compliance with the License. You should have received a copy of the
       Erlang Public License along with this software. If not, it can be
       retrieved online at http://www.erlang.org/.
-    
+
       Software distributed under the License is distributed on an "AS IS"
       basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
       the License for the specific language governing rights and limitations
       under the License.
-    
+
     </legalnotice>
 
     <title>SSL User's Guide</title>
@@ -30,7 +30,9 @@
   </header>
   <description>
     <p>The <em>SSL</em> application provides secure communication over
-      sockets.
+      sockets. Note that this users guide was written for
+      the old ssl implementation that is now being phased out and
+      will be replaced by a new guide in a future release.
       </p>
     <p>This product includes software developed by the OpenSSL Project for
       use in the OpenSSL Toolkit (http://www.openssl.org/).
diff --git a/lib/ssl/pkix/Makefile b/lib/ssl/pkix/Makefile
deleted file mode 100644
index 260361c025..0000000000
--- a/lib/ssl/pkix/Makefile
+++ /dev/null
@@ -1,121 +0,0 @@
-#
-# %CopyrightBegin%
-# 
-# Copyright Ericsson AB 2003-2009. All Rights Reserved.
-# 
-# The contents of this file are subject to the Erlang Public License,
-# Version 1.1, (the "License"); you may not use this file except in
-# compliance with the License. You should have received a copy of the
-# Erlang Public License along with this software. If not, it can be
-# retrieved online at http://www.erlang.org/.
-# 
-# Software distributed under the License is distributed on an "AS IS"
-# basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-# the License for the specific language governing rights and limitations
-# under the License.
-# 
-# %CopyrightEnd%
-#
-
-#
-
-include $(ERL_TOP)/make/target.mk
-include $(ERL_TOP)/make/$(TARGET)/otp.mk
-
-# ----------------------------------------------------
-# Application version
-# ----------------------------------------------------
-include ../vsn.mk
-VSN=$(SSL_VSN)
-
-# ----------------------------------------------------
-# Release directory specification
-# ----------------------------------------------------
-RELSYSDIR = $(RELEASE_PATH)/lib/ssl-$(VSN)
-
-# ----------------------------------------------------
-# Common Macros
-# ----------------------------------------------------
-
-.SUFFIXES: .asn1
-.PRECIOUS: %.erl
-
-ASN_TOP = OTP-PKIX
-ASN_MODULES = PKIX1Explicit88 PKIX1Implicit88 PKIX1Algorithms88 \
-	PKIXAttributeCertificate SSL-PKIX 
-ASN_ASNS = $(ASN_MODULES:%=%.asn1)
-ASN_ERLS = $(ASN_TOP).erl
-ASN_HRLS = $(ASN_TOP).hrl
-ASN_CONFIGS = OTP-PKIX.asn1config
-ASN_DBS = $(ASN_MODULES:%=%.asn1db)
-ASN_TABLES = $(ASN_MODULES:%=%.table)
-
-GEN_MODULES = ssl_pkix_oid $(ORBER_TMP_FIX_ERL)
-GEN_ERLS    = $(GEN_MODULES:%=%.erl)
-ERL_MODULES = $(ASN_TOP) $(GEN_MODULES)
-
-TARGET_FILES= $(ERL_MODULES:%=$(EBIN)/%.$(EMULATOR))
-
-HRL_FILES = $(ASN_HRLS:%=$(INCLUDE)/%)
-
-ORBER_TMP_FIX_HRL = PKIX1Algorithms88.hrl PKIX1Explicit88.hrl \
-	PKIX1Implicit88.hrl PKIXAttributeCertificate.hrl
-
-INCLUDE = ../include
-EBIN = ../ebin
-
-# ----------------------------------------------------
-# FLAGS
-# ----------------------------------------------------
-EXTRA_ERLC_FLAGS = 
-ERL_COMPILE_FLAGS += $(EXTRA_ERLC_FLAGS)
-
-ASN_FLAGS = -bber_bin +der +compact_bit_string +optimize +noobj +asn1config +inline
-
-# ----------------------------------------------------
-# Targets
-# ----------------------------------------------------
-
-debug opt: $(TARGET_FILES) $(HRL_FILES)
-
-clean:
-	-rm -f $(ASN_ERLS) $(GEN_ERLS) $(ASN_HRLS) $(HRL_FILES) $(ASN_DBS) \
-		$(ASN_TABLES)  $(TARGET_FILES) *.beam *~
-
-docs:
-
-%.erl: %.set.asn
-	erlc $(ASN_FLAGS) $<
-
-ssl_pkix_oid.erl:	mk_ssl_pkix_oid.beam $(EBIN)/OTP-PKIX.beam
-	erl -pa $(EBIN) -noshell -s mk_ssl_pkix_oid make -s erlang halt
-
-$(HRL_FILES):	$(ASN_HRLS)
-	cp -p $(ASN_HRLS) $(INCLUDE)
-
-# ----------------------------------------------------
-# Release Target
-# ---------------------------------------------------- 
-include $(ERL_TOP)/make/otp_release_targets.mk
-
-release_spec: opt
-	$(INSTALL_DIR) $(RELSYSDIR)/include
-	$(INSTALL_DATA) $(HRL_FILES) $(RELSYSDIR)/include
-	$(INSTALL_DIR) $(RELSYSDIR)/pkix
-	$(INSTALL_DATA) $(ASN_ASNS) $(ASN_ERLS) $(ASN_HRLS) $(ASN_CONFIGS) \
-		$(ORBER_TMP_FIX_HRL) $(GEN_ERLS) mk_ssl_pkix_oid.erl $(RELSYSDIR)/pkix
-	$(INSTALL_DIR) $(RELSYSDIR)/ebin
-	$(INSTALL_DATA) $(TARGET_FILES) $(RELSYSDIR)/ebin
-
-release_docs_spec:
-
-#
-# Dependencies
-
-$(EBIN)/OTP-PKIX.beam: 	OTP-PKIX.erl OTP-PKIX.hrl
-OTP-PKIX.erl OTP-PKIX.hrl:	OTP-PKIX.asn1db
-OTP-PKIX.asn1db:		PKIX1Algorithms88.asn1 \
-				PKIX1Explicit88.asn1 \
-				PKIX1Implicit88.asn1 \
-				PKIXAttributeCertificate.asn1 \
-				SSL-PKIX.asn1
diff --git a/lib/ssl/pkix/OTP-PKIX.asn1config b/lib/ssl/pkix/OTP-PKIX.asn1config
deleted file mode 100644
index 0caa158f52..0000000000
--- a/lib/ssl/pkix/OTP-PKIX.asn1config
+++ /dev/null
@@ -1,2 +0,0 @@
-{exclusive_decode,{'OTP-PKIX',
-        [{decode_TBSCert_exclusive,['Certificate',[{tbsCertificate,undecoded}]]}]}}.
diff --git a/lib/ssl/pkix/OTP-PKIX.set.asn b/lib/ssl/pkix/OTP-PKIX.set.asn
deleted file mode 100644
index 1c3483d519..0000000000
--- a/lib/ssl/pkix/OTP-PKIX.set.asn
+++ /dev/null
@@ -1,6 +0,0 @@
-SSL-PKIX.asn1
-PKIX1Explicit88.asn1
-PKIX1Implicit88.asn1
-PKIXAttributeCertificate.asn1
-PKIX1Algorithms88.asn1
-PKCS-1.asn1
diff --git a/lib/ssl/pkix/PKCS-1.asn1 b/lib/ssl/pkix/PKCS-1.asn1
deleted file mode 100755
index 547cc2e072..0000000000
--- a/lib/ssl/pkix/PKCS-1.asn1
+++ /dev/null
@@ -1,54 +0,0 @@
-PKCS-1 {
-    iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1)
-    modules(0) pkcs-1(1)
-}
-
-
-DEFINITIONS IMPLICIT TAGS ::= BEGIN
-
--- EXPORTS ALL --
-
-IMPORTS
-  AlgorithmIdentifier
-    FROM PKIX1Explicit88 {iso(1) identified-organization(3)
-                          dod(6) internet(1) security(5) mechanisms(5)
-                          pkix(7) id-mod(0) id-pkix1-explicit-88(1)} ;
-
-pkcs-1    OBJECT IDENTIFIER ::= {
-    iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1 }
-
-RSAPrivateKey ::= SEQUENCE {
-    version           Version,
-    modulus           INTEGER,  -- n
-    publicExponent    INTEGER,  -- e
-    privateExponent   INTEGER,  -- d
-    prime1            INTEGER,  -- p
-    prime2            INTEGER,  -- q
-    exponent1         INTEGER,  -- d mod (p-1)
-    exponent2         INTEGER,  -- d mod (q-1)
-    coefficient       INTEGER,  -- (inverse of q) mod p
-    otherPrimeInfos   OtherPrimeInfos OPTIONAL
-}
-
-Version ::= INTEGER { two-prime(0), multi(1) }
-     (CONSTRAINED BY {
-         -- version must be multi if otherPrimeInfos present --
-     })
-
-OtherPrimeInfos ::= SEQUENCE SIZE(1..MAX) OF OtherPrimeInfo
-
-OtherPrimeInfo ::= SEQUENCE {
-    prime             INTEGER,  -- ri
-    exponent          INTEGER,  -- di
-    coefficient       INTEGER   -- ti
-}
-
-DigestInfo ::= SEQUENCE {
-	digestAlgorithm DigestAlgorithmIdentifier,
-	digest OCTET STRING
-}
-
-DigestAlgorithmIdentifier ::= AlgorithmIdentifier
-
-END  -- PKCS1Definitions
-
diff --git a/lib/ssl/pkix/PKIX1Algorithms88.asn1 b/lib/ssl/pkix/PKIX1Algorithms88.asn1
deleted file mode 100644
index e78de69b0e..0000000000
--- a/lib/ssl/pkix/PKIX1Algorithms88.asn1
+++ /dev/null
@@ -1,274 +0,0 @@
-   PKIX1Algorithms88 { iso(1) identified-organization(3) dod(6)
-   internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
-   id-mod-pkix1-algorithms(17) }
-
-   DEFINITIONS EXPLICIT TAGS ::= BEGIN
-
-   -- EXPORTS All;
-
-   -- IMPORTS NONE;
-
-   --
-   --   One-way Hash Functions
-   --
-
-   md2  OBJECT IDENTIFIER ::= {
-     iso(1) member-body(2) us(840) rsadsi(113549)
-     digestAlgorithm(2) 2 }
-
-   md5  OBJECT IDENTIFIER ::= {
-     iso(1) member-body(2) us(840) rsadsi(113549)
-     digestAlgorithm(2) 5 }
-
-   id-sha1  OBJECT IDENTIFIER ::= {
-     iso(1) identified-organization(3) oiw(14) secsig(3)
-     algorithms(2) 26 }
-
-   --
-   --   DSA Keys and Signatures
-   --
-
-   -- OID for DSA public key
-
-   id-dsa OBJECT IDENTIFIER ::= {
-        iso(1) member-body(2) us(840) x9-57(10040) x9algorithm(4) 1 }
-
-   -- encoding for DSA public key
-
-   DSAPublicKey ::= INTEGER  -- public key, y
-
-   Dss-Parms  ::=  SEQUENCE  {
-      p             INTEGER,
-      q             INTEGER,
-      g             INTEGER  }
-
-   -- OID for DSA signature generated with SHA-1 hash
-
-   id-dsa-with-sha1 OBJECT IDENTIFIER ::=  {
-        iso(1) member-body(2) us(840) x9-57 (10040) x9algorithm(4) 3 }
-
-   -- encoding for DSA signature generated with SHA-1 hash
-
-   Dss-Sig-Value  ::=  SEQUENCE  {
-      r       INTEGER,
-      s       INTEGER  }
-
-   --
-   --   RSA Keys and Signatures
-   --
-
-   -- arc for RSA public key and RSA signature OIDs
-
-   pkcs-1 OBJECT IDENTIFIER ::= {
-         iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1 }
-
-   -- OID for RSA public keys
-
-   rsaEncryption OBJECT IDENTIFIER ::=  { pkcs-1 1 }
-
-   -- OID for RSA signature generated with MD2 hash
-
-   md2WithRSAEncryption OBJECT IDENTIFIER  ::=  { pkcs-1 2 }
-
-   -- OID for RSA signature generated with MD5 hash
-
-   md5WithRSAEncryption OBJECT IDENTIFIER  ::=  { pkcs-1 4 }
-
-   -- OID for RSA signature generated with SHA-1 hash
-
-   sha1WithRSAEncryption OBJECT IDENTIFIER  ::=  { pkcs-1 5 }
-
-   -- encoding for RSA public key
-
-   RSAPublicKey ::= SEQUENCE {
-      modulus            INTEGER,    -- n
-      publicExponent     INTEGER  }  -- e
-
-   --
-   --   Diffie-Hellman Keys
-   --
-
-   dhpublicnumber OBJECT IDENTIFIER ::= {
-        iso(1) member-body(2) us(840) ansi-x942(10046)
-        number-type(2) 1 }
-
-   -- encoding for DSA public key
-
-   DHPublicKey ::= INTEGER  -- public key, y = g^x mod p
-
-   DomainParameters ::= SEQUENCE {
-      p       INTEGER,           -- odd prime, p=jq +1
-      g       INTEGER,           -- generator, g
-      q       INTEGER,           -- factor of p-1
-      j       INTEGER OPTIONAL,  -- subgroup factor, j>= 2
-      validationParms  ValidationParms OPTIONAL }
-
-   ValidationParms ::= SEQUENCE {
-      seed             BIT STRING,
-      pgenCounter      INTEGER }
-
-   --
-   --   KEA Keys
-   --
-
-   id-keyExchangeAlgorithm  OBJECT IDENTIFIER  ::=
-        { 2 16 840 1 101 2 1 1 22 }
-
-   KEA-Parms-Id ::= OCTET STRING
-
-   --
-   --   Elliptic Curve Keys, Signatures, and Curves
-   --
-
-   ansi-X9-62 OBJECT IDENTIFIER ::= {
-        iso(1) member-body(2) us(840) 10045 }
-
-   FieldID ::= SEQUENCE {                    -- Finite field
-      fieldType   OBJECT IDENTIFIER,
-      parameters  ANY DEFINED BY fieldType }
-
-   -- Arc for ECDSA signature OIDS
-
-   id-ecSigType OBJECT IDENTIFIER ::= { ansi-X9-62 signatures(4) }
-
-   -- OID for ECDSA signatures with SHA-1
-
-   ecdsa-with-SHA1 OBJECT IDENTIFIER ::= { id-ecSigType 1 }
-
-   -- OID for an elliptic curve signature
-   -- format for the value of an ECDSA signature value
-
-   ECDSA-Sig-Value ::= SEQUENCE {
-      r     INTEGER,
-      s     INTEGER }
-
-   -- recognized field type OIDs are defined in the following arc
-
-   id-fieldType OBJECT IDENTIFIER ::= { ansi-X9-62 fieldType(1) }
-
-   -- where fieldType is prime-field, the parameters are of type Prime-p
-
-   prime-field OBJECT IDENTIFIER ::= { id-fieldType 1 }
-
-   Prime-p ::= INTEGER -- Finite field F(p), where p is an odd prime
-
-   -- where fieldType is characteristic-two-field, the parameters are
-   -- of type Characteristic-two
-
-   characteristic-two-field OBJECT IDENTIFIER ::= { id-fieldType 2 }
-
-   Characteristic-two ::= SEQUENCE {
-      m           INTEGER,                   -- Field size 2^m
-      basis       OBJECT IDENTIFIER,
-      parameters  ANY DEFINED BY basis }
-
-   -- recognized basis type OIDs are defined in the following arc
-
-   id-characteristic-two-basis OBJECT IDENTIFIER ::= {
-        characteristic-two-field basisType(3) }
-
-   -- gnbasis is identified by OID gnBasis and indicates
-   -- parameters are NULL
-
-   gnBasis OBJECT IDENTIFIER ::= { id-characteristic-two-basis 1 }
-
-   -- parameters for this basis are NULL
-
-   -- trinomial basis is identified by OID tpBasis and indicates
-   -- parameters of type Pentanomial
-
-   tpBasis OBJECT IDENTIFIER ::= { id-characteristic-two-basis 2 }
-
-   -- Trinomial basis representation of F2^m
-   -- Integer k for reduction polynomial xm + xk + 1
-
-   Trinomial ::= INTEGER
-
-   -- for pentanomial basis is identified by OID ppBasis and indicates
-   -- parameters of type Pentanomial
-
-   ppBasis OBJECT IDENTIFIER ::= { id-characteristic-two-basis 3 }
-
-   -- Pentanomial basis representation of F2^m
-   -- reduction polynomial integers k1, k2, k3
-   -- f(x) = x**m + x**k3 + x**k2 + x**k1 + 1
-
-   Pentanomial ::= SEQUENCE {
-      k1  INTEGER,
-      k2  INTEGER,
-      k3  INTEGER }
-
-   -- The object identifiers gnBasis, tpBasis and ppBasis name
-   -- three kinds of basis for characteristic-two finite fields
-
-   FieldElement ::= OCTET STRING             -- Finite field element
-
-   ECPoint  ::= OCTET STRING                 -- Elliptic curve point
-
-   -- Elliptic Curve parameters may be specified explicitly,
-   -- specified implicitly through a "named curve", or
-   -- inherited from the CA
-
-   EcpkParameters ::= CHOICE {
-      ecParameters  ECParameters,
-      namedCurve    OBJECT IDENTIFIER,
-      implicitlyCA  NULL }
-
-   ECParameters  ::= SEQUENCE {         -- Elliptic curve parameters
-      version   ECPVer,
-      fieldID   FieldID,
-      curve     Curve,
-      base      ECPoint,                -- Base point G
-      order     INTEGER,                -- Order n of the base point
-      cofactor  INTEGER  OPTIONAL }     -- The integer h = #E(Fq)/n
-
-   ECPVer ::= INTEGER {ecpVer1(1)}
-
-   Curve  ::= SEQUENCE {
-      a     FieldElement,            -- Elliptic curve coefficient a
-      b     FieldElement,            -- Elliptic curve coefficient b
-      seed  BIT STRING  OPTIONAL }
-
-   id-publicKeyType OBJECT IDENTIFIER  ::= { ansi-X9-62 keyType(2) }
-
-   id-ecPublicKey OBJECT IDENTIFIER ::= { id-publicKeyType 1 }
-
-   -- Named Elliptic Curves in ANSI X9.62.
-
-   ellipticCurve OBJECT IDENTIFIER ::= { ansi-X9-62 curves(3) }
-
-   c-TwoCurve OBJECT IDENTIFIER ::= {
-        ellipticCurve characteristicTwo(0) }
-
-   c2pnb163v1  OBJECT IDENTIFIER  ::=  { c-TwoCurve  1 }
-   c2pnb163v2  OBJECT IDENTIFIER  ::=  { c-TwoCurve  2 }
-   c2pnb163v3  OBJECT IDENTIFIER  ::=  { c-TwoCurve  3 }
-   c2pnb176w1  OBJECT IDENTIFIER  ::=  { c-TwoCurve  4 }
-   c2tnb191v1  OBJECT IDENTIFIER  ::=  { c-TwoCurve  5 }
-   c2tnb191v2  OBJECT IDENTIFIER  ::=  { c-TwoCurve  6 }
-   c2tnb191v3  OBJECT IDENTIFIER  ::=  { c-TwoCurve  7 }
-   c2onb191v4  OBJECT IDENTIFIER  ::=  { c-TwoCurve  8 }
-   c2onb191v5  OBJECT IDENTIFIER  ::=  { c-TwoCurve  9 }
-   c2pnb208w1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 10 }
-   c2tnb239v1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 11 }
-   c2tnb239v2  OBJECT IDENTIFIER  ::=  { c-TwoCurve 12 }
-   c2tnb239v3  OBJECT IDENTIFIER  ::=  { c-TwoCurve 13 }
-   c2onb239v4  OBJECT IDENTIFIER  ::=  { c-TwoCurve 14 }
-   c2onb239v5  OBJECT IDENTIFIER  ::=  { c-TwoCurve 15 }
-   c2pnb272w1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 16 }
-   c2pnb304w1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 17 }
-   c2tnb359v1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 18 }
-   c2pnb368w1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 19 }
-   c2tnb431r1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 20 }
-
-   primeCurve OBJECT IDENTIFIER ::= { ellipticCurve prime(1) }
-
-   prime192v1  OBJECT IDENTIFIER  ::=  { primeCurve  1 }
-   prime192v2  OBJECT IDENTIFIER  ::=  { primeCurve  2 }
-   prime192v3  OBJECT IDENTIFIER  ::=  { primeCurve  3 }
-   prime239v1  OBJECT IDENTIFIER  ::=  { primeCurve  4 }
-   prime239v2  OBJECT IDENTIFIER  ::=  { primeCurve  5 }
-   prime239v3  OBJECT IDENTIFIER  ::=  { primeCurve  6 }
-   prime256v1  OBJECT IDENTIFIER  ::=  { primeCurve  7 }
-
-   END
diff --git a/lib/ssl/pkix/PKIX1Algorithms88.hrl b/lib/ssl/pkix/PKIX1Algorithms88.hrl
deleted file mode 100644
index a11793618d..0000000000
--- a/lib/ssl/pkix/PKIX1Algorithms88.hrl
+++ /dev/null
@@ -1,94 +0,0 @@
-%% Generated by the Erlang ASN.1 compiler version:1.4.4.8
-%% Purpose: Erlang record definitions for each named and unnamed
-%% SEQUENCE and SET, and macro definitions for each value
-%% definition,in module PKIX1Algorithms88
-
-
-
--record('Dss-Parms',{
-p, q, g}).
-
--record('Dss-Sig-Value',{
-r, s}).
-
--record('RSAPublicKey',{
-modulus, publicExponent}).
-
--record('DomainParameters',{
-p, g, q, j = asn1_NOVALUE, validationParms = asn1_NOVALUE}).
-
--record('ValidationParms',{
-seed, pgenCounter}).
-
--record('FieldID',{
-fieldType, parameters}).
-
--record('ECDSA-Sig-Value',{
-r, s}).
-
--record('Characteristic-two',{
-m, basis, parameters}).
-
--record('Pentanomial',{
-k1, k2, k3}).
-
--record('ECParameters',{
-version, fieldID, curve, base, order, cofactor = asn1_NOVALUE}).
-
--record('Curve',{
-a, b, seed = asn1_NOVALUE}).
-
--define('md2', {1,2,840,113549,2,2}).
--define('md5', {1,2,840,113549,2,5}).
--define('id-sha1', {1,3,14,3,2,26}).
--define('id-dsa', {1,2,840,10040,4,1}).
--define('id-dsa-with-sha1', {1,2,840,10040,4,3}).
--define('pkcs-1', {1,2,840,113549,1,1}).
--define('rsaEncryption', {1,2,840,113549,1,1,1}).
--define('md2WithRSAEncryption', {1,2,840,113549,1,1,2}).
--define('md5WithRSAEncryption', {1,2,840,113549,1,1,4}).
--define('sha1WithRSAEncryption', {1,2,840,113549,1,1,5}).
--define('dhpublicnumber', {1,2,840,10046,2,1}).
--define('id-keyExchangeAlgorithm', {2,16,840,1,101,2,1,1,22}).
--define('ansi-X9-62', {1,2,840,10045}).
--define('id-ecSigType', {1,2,840,10045,4}).
--define('ecdsa-with-SHA1', {1,2,840,10045,4,1}).
--define('id-fieldType', {1,2,840,10045,1}).
--define('prime-field', {1,2,840,10045,1,1}).
--define('characteristic-two-field', {1,2,840,10045,1,2}).
--define('id-characteristic-two-basis', {1,2,840,10045,1,2,3}).
--define('gnBasis', {1,2,840,10045,1,2,3,1}).
--define('tpBasis', {1,2,840,10045,1,2,3,2}).
--define('ppBasis', {1,2,840,10045,1,2,3,3}).
--define('id-publicKeyType', {1,2,840,10045,2}).
--define('id-ecPublicKey', {1,2,840,10045,2,1}).
--define('ellipticCurve', {1,2,840,10045,3}).
--define('c-TwoCurve', {1,2,840,10045,3,0}).
--define('c2pnb163v1', {1,2,840,10045,3,0,1}).
--define('c2pnb163v2', {1,2,840,10045,3,0,2}).
--define('c2pnb163v3', {1,2,840,10045,3,0,3}).
--define('c2pnb176w1', {1,2,840,10045,3,0,4}).
--define('c2tnb191v1', {1,2,840,10045,3,0,5}).
--define('c2tnb191v2', {1,2,840,10045,3,0,6}).
--define('c2tnb191v3', {1,2,840,10045,3,0,7}).
--define('c2onb191v4', {1,2,840,10045,3,0,8}).
--define('c2onb191v5', {1,2,840,10045,3,0,9}).
--define('c2pnb208w1', {1,2,840,10045,3,0,10}).
--define('c2tnb239v1', {1,2,840,10045,3,0,11}).
--define('c2tnb239v2', {1,2,840,10045,3,0,12}).
--define('c2tnb239v3', {1,2,840,10045,3,0,13}).
--define('c2onb239v4', {1,2,840,10045,3,0,14}).
--define('c2onb239v5', {1,2,840,10045,3,0,15}).
--define('c2pnb272w1', {1,2,840,10045,3,0,16}).
--define('c2pnb304w1', {1,2,840,10045,3,0,17}).
--define('c2tnb359v1', {1,2,840,10045,3,0,18}).
--define('c2pnb368w1', {1,2,840,10045,3,0,19}).
--define('c2tnb431r1', {1,2,840,10045,3,0,20}).
--define('primeCurve', {1,2,840,10045,3,1}).
--define('prime192v1', {1,2,840,10045,3,1,1}).
--define('prime192v2', {1,2,840,10045,3,1,2}).
--define('prime192v3', {1,2,840,10045,3,1,3}).
--define('prime239v1', {1,2,840,10045,3,1,4}).
--define('prime239v2', {1,2,840,10045,3,1,5}).
--define('prime239v3', {1,2,840,10045,3,1,6}).
--define('prime256v1', {1,2,840,10045,3,1,7}).
diff --git a/lib/ssl/pkix/PKIX1Explicit88.asn1 b/lib/ssl/pkix/PKIX1Explicit88.asn1
deleted file mode 100644
index 9b8068fed0..0000000000
--- a/lib/ssl/pkix/PKIX1Explicit88.asn1
+++ /dev/null
@@ -1,619 +0,0 @@
-PKIX1Explicit88 { iso(1) identified-organization(3) dod(6) internet(1)
-  security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-explicit(18) }
-
-DEFINITIONS EXPLICIT TAGS ::=
-
-BEGIN
-
--- EXPORTS ALL --
-
--- IMPORTS NONE --
-
--- UNIVERSAL Types defined in 1993 and 1998 ASN.1
--- and required by this specification
-
--- UniversalString ::= [UNIVERSAL 28] IMPLICIT OCTET STRING
-        -- UniversalString is defined in ASN.1:1993
-
--- BMPString ::= [UNIVERSAL 30] IMPLICIT OCTET STRING
-      -- BMPString is the subtype of UniversalString and models
-      -- the Basic Multilingual Plane of ISO/IEC/ITU 10646-1
-
--- UTF8String ::= [UNIVERSAL 12] IMPLICIT OCTET STRING
-      -- The content of this type conforms to RFC 2279.
-
--- PKIX specific OIDs
-
-id-pkix  OBJECT IDENTIFIER  ::=
-         { iso(1) identified-organization(3) dod(6) internet(1)
-                    security(5) mechanisms(5) pkix(7) }
-
--- PKIX arcs
-
-id-pe OBJECT IDENTIFIER  ::=  { id-pkix 1 }
-        -- arc for private certificate extensions
-id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
-        -- arc for policy qualifier types
-id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
-        -- arc for extended key purpose OIDS
-id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
-        -- arc for access descriptors
-
--- policyQualifierIds for Internet policy qualifiers
-
-id-qt-cps      OBJECT IDENTIFIER ::=  { id-qt 1 }
-      -- OID for CPS qualifier
-id-qt-unotice  OBJECT IDENTIFIER ::=  { id-qt 2 }
-      -- OID for user notice qualifier
-
--- access descriptor definitions
-
-id-ad-ocsp         OBJECT IDENTIFIER ::= { id-ad 1 }
-id-ad-caIssuers    OBJECT IDENTIFIER ::= { id-ad 2 }
-id-ad-timeStamping OBJECT IDENTIFIER ::= { id-ad 3 }
-id-ad-caRepository OBJECT IDENTIFIER ::= { id-ad 5 }
-
--- attribute data types
-
-Attribute       ::=     SEQUENCE {
-      type              AttributeType,
-      values    SET OF AttributeValue }
-            -- at least one value is required
-
-AttributeType           ::=  OBJECT IDENTIFIER
-
-AttributeValue          ::=  ANY
-
-AttributeTypeAndValue           ::=     SEQUENCE {
-        type    AttributeType,
-        value   AttributeValue }
-
--- suggested naming attributes: Definition of the following
---   information object set may be augmented to meet local
---   requirements.  Note that deleting members of the set may
---   prevent interoperability with conforming implementations.
--- presented in pairs: the AttributeType followed by the
---   type definition for the corresponding AttributeValue
---Arc for standard naming attributes
-id-at OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) ds(5) 4 }
-
--- Naming attributes of type X520name
-
-id-at-name              AttributeType ::= { id-at 41 }
-id-at-surname           AttributeType ::= { id-at 4 }
-id-at-givenName         AttributeType ::= { id-at 42 }
-id-at-initials          AttributeType ::= { id-at 43 }
-id-at-generationQualifier AttributeType ::= { id-at 44 }
-
-X520name ::= CHOICE {
-      teletexString     TeletexString   (SIZE (1..ub-name)),
-      printableString   PrintableString (SIZE (1..ub-name)),
-      universalString   UniversalString (SIZE (1..ub-name)),
-      utf8String        UTF8String      (SIZE (1..ub-name)),
-      bmpString         BMPString       (SIZE (1..ub-name)) }
-
--- Naming attributes of type X520CommonName
-
-id-at-commonName        AttributeType ::= { id-at 3 }
-
-X520CommonName ::= CHOICE {
-      teletexString     TeletexString   (SIZE (1..ub-common-name)),
-      printableString   PrintableString (SIZE (1..ub-common-name)),
-      universalString   UniversalString (SIZE (1..ub-common-name)),
-      utf8String        UTF8String      (SIZE (1..ub-common-name)),
-      bmpString         BMPString       (SIZE (1..ub-common-name)) }
-
--- Naming attributes of type X520LocalityName
-
-id-at-localityName      AttributeType ::= { id-at 7 }
-
-X520LocalityName ::= CHOICE {
-      teletexString     TeletexString   (SIZE (1..ub-locality-name)),
-      printableString   PrintableString (SIZE (1..ub-locality-name)),
-      universalString   UniversalString (SIZE (1..ub-locality-name)),
-      utf8String        UTF8String      (SIZE (1..ub-locality-name)),
-      bmpString         BMPString       (SIZE (1..ub-locality-name)) }
-
--- Naming attributes of type X520StateOrProvinceName
-
-id-at-stateOrProvinceName AttributeType ::= { id-at 8 }
-
-X520StateOrProvinceName ::= CHOICE {
-      teletexString     TeletexString   (SIZE (1..ub-state-name)),
-      printableString   PrintableString (SIZE (1..ub-state-name)),
-      universalString   UniversalString (SIZE (1..ub-state-name)),
-      utf8String        UTF8String      (SIZE (1..ub-state-name)),
-      bmpString         BMPString       (SIZE(1..ub-state-name)) }
-
--- Naming attributes of type X520OrganizationName
-
-id-at-organizationName  AttributeType ::= { id-at 10 }
-
-X520OrganizationName ::= CHOICE {
-      teletexString     TeletexString
-                          (SIZE (1..ub-organization-name)),
-      printableString   PrintableString
-                          (SIZE (1..ub-organization-name)),
-      universalString   UniversalString
-                          (SIZE (1..ub-organization-name)),
-      utf8String        UTF8String
-                          (SIZE (1..ub-organization-name)),
-      bmpString         BMPString
-                          (SIZE (1..ub-organization-name))  }
-
--- Naming attributes of type X520OrganizationalUnitName
-
-id-at-organizationalUnitName AttributeType ::= { id-at 11 }
-
-X520OrganizationalUnitName ::= CHOICE {
-      teletexString     TeletexString
-                          (SIZE (1..ub-organizational-unit-name)),
-      printableString   PrintableString
-                          (SIZE (1..ub-organizational-unit-name)),
-      universalString   UniversalString
-                          (SIZE (1..ub-organizational-unit-name)),
-      utf8String        UTF8String
-                          (SIZE (1..ub-organizational-unit-name)),
-      bmpString         BMPString
-                          (SIZE (1..ub-organizational-unit-name)) }
-
--- Naming attributes of type X520Title
-
-id-at-title             AttributeType ::= { id-at 12 }
-
-X520Title ::= CHOICE {
-      teletexString     TeletexString   (SIZE (1..ub-title)),
-      printableString   PrintableString (SIZE (1..ub-title)),
-      universalString   UniversalString (SIZE (1..ub-title)),
-      utf8String        UTF8String      (SIZE (1..ub-title)),
-      bmpString         BMPString       (SIZE (1..ub-title)) }
-
--- Naming attributes of type X520dnQualifier
-
-id-at-dnQualifier       AttributeType ::= { id-at 46 }
-
-X520dnQualifier ::=     PrintableString
-
--- Naming attributes of type X520countryName (digraph from IS 3166)
-
-id-at-countryName       AttributeType ::= { id-at 6 }
-
-X520countryName ::=     PrintableString (SIZE (2))
-
--- Naming attributes of type X520SerialNumber
-
-id-at-serialNumber      AttributeType ::= { id-at 5 }
-
-X520SerialNumber ::=    PrintableString (SIZE (1..ub-serial-number))
-
--- Naming attributes of type X520Pseudonym
-
-id-at-pseudonym         AttributeType ::= { id-at 65 }
-
-X520Pseudonym ::= CHOICE {
-   teletexString     TeletexString   (SIZE (1..ub-pseudonym)),
-   printableString   PrintableString (SIZE (1..ub-pseudonym)),
-   universalString   UniversalString (SIZE (1..ub-pseudonym)),
-   utf8String        UTF8String      (SIZE (1..ub-pseudonym)),
-   bmpString         BMPString       (SIZE (1..ub-pseudonym)) }
-
--- Naming attributes of type DomainComponent (from RFC 2247)
-
-id-domainComponent      AttributeType ::=
-                          { 0 9 2342 19200300 100 1 25 }
-
-DomainComponent ::=     IA5String
-
--- Legacy attributes
-
-pkcs-9 OBJECT IDENTIFIER ::=
-       { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 9 }
-
-id-emailAddress          AttributeType ::= { pkcs-9 1 }
-
-EmailAddress ::=         IA5String (SIZE (1..ub-emailaddress-length))
-
--- naming data types --
-
-Name ::= CHOICE { -- only one possibility for now --
-      rdnSequence  RDNSequence }
-
-RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
-
-DistinguishedName ::=   RDNSequence
-
-RelativeDistinguishedName  ::=
-                    SET SIZE (1 .. MAX) OF AttributeTypeAndValue
-
--- Directory string type --
-
-DirectoryString ::= CHOICE {
-      teletexString             TeletexString   (SIZE (1..MAX)),
-      printableString           PrintableString (SIZE (1..MAX)),
-      universalString           UniversalString (SIZE (1..MAX)),
-      utf8String              UTF8String      (SIZE (1..MAX)),
-      bmpString               BMPString       (SIZE (1..MAX)) }
-
--- certificate and CRL specific structures begin here
-
-Certificate  ::=  SEQUENCE  {
-     tbsCertificate       TBSCertificate,
-     signatureAlgorithm   AlgorithmIdentifier,
-     signature            BIT STRING  }
-
-TBSCertificate  ::=  SEQUENCE  {
-     version         [0]  Version DEFAULT v1,
-     serialNumber         CertificateSerialNumber,
-     signature            AlgorithmIdentifier,
-     issuer               Name,
-     validity             Validity,
-     subject              Name,
-     subjectPublicKeyInfo SubjectPublicKeyInfo,
-     issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
-                          -- If present, version MUST be v2 or v3
-     subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
-                          -- If present, version MUST be v2 or v3
-     extensions      [3]  Extensions OPTIONAL
-                          -- If present, version MUST be v3 --  }
-
-Version  ::=  INTEGER  {  v1(0), v2(1), v3(2)  }
-
-CertificateSerialNumber  ::=  INTEGER
-
-Validity ::= SEQUENCE {
-     notBefore      Time,
-     notAfter       Time  }
-
-Time ::= CHOICE {
-     utcTime        UTCTime,
-     generalTime    GeneralizedTime }
-
-UniqueIdentifier  ::=  BIT STRING
-
-SubjectPublicKeyInfo  ::=  SEQUENCE  {
-     algorithm            AlgorithmIdentifier,
-     subjectPublicKey     BIT STRING  }
-
-Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension
-
-Extension  ::=  SEQUENCE  {
-     extnID      OBJECT IDENTIFIER,
-     critical    BOOLEAN DEFAULT FALSE,
-     extnValue   OCTET STRING  }
-
--- CRL structures
-
-CertificateList  ::=  SEQUENCE  {
-     tbsCertList          TBSCertList,
-     signatureAlgorithm   AlgorithmIdentifier,
-     signature            BIT STRING  }
-
-TBSCertList  ::=  SEQUENCE  {
-     version                 Version OPTIONAL,
-                                  -- if present, MUST be v2
-     signature               AlgorithmIdentifier,
-     issuer                  Name,
-     thisUpdate              Time,
-     nextUpdate              Time OPTIONAL,
-     revokedCertificates     SEQUENCE OF SEQUENCE  {
-          userCertificate         CertificateSerialNumber,
-          revocationDate          Time,
-          crlEntryExtensions      Extensions OPTIONAL
-                                         -- if present, MUST be v2
-                               }  OPTIONAL,
-     crlExtensions           [0] Extensions OPTIONAL }
-                                         -- if present, MUST be v2
-
--- Version, Time, CertificateSerialNumber, and Extensions were
--- defined earlier for use in the certificate structure
-
-AlgorithmIdentifier  ::=  SEQUENCE  {
-     algorithm               OBJECT IDENTIFIER,
-     parameters              ANY DEFINED BY algorithm OPTIONAL  }
-                                -- contains a value of the type
-                                -- registered for use with the
-                                -- algorithm object identifier value
-
--- X.400 address syntax starts here
-
-ORAddress ::= SEQUENCE {
-   built-in-standard-attributes BuiltInStandardAttributes,
-   built-in-domain-defined-attributes
-                   BuiltInDomainDefinedAttributes OPTIONAL,
-   -- see also teletex-domain-defined-attributes
-   extension-attributes ExtensionAttributes OPTIONAL }
-
--- Built-in Standard Attributes
-
-BuiltInStandardAttributes ::= SEQUENCE {
-   country-name                  CountryName OPTIONAL,
-   administration-domain-name    AdministrationDomainName OPTIONAL,
-   network-address           [0] IMPLICIT NetworkAddress OPTIONAL,
-     -- see also extended-network-address
-   terminal-identifier       [1] IMPLICIT TerminalIdentifier OPTIONAL,
-   private-domain-name       [2] PrivateDomainName OPTIONAL,
-   organization-name         [3] IMPLICIT OrganizationName OPTIONAL,
-     -- see also teletex-organization-name
-   numeric-user-identifier   [4] IMPLICIT NumericUserIdentifier
-                                 OPTIONAL,
-   personal-name             [5] IMPLICIT PersonalName OPTIONAL,
-     -- see also teletex-personal-name
-   organizational-unit-names [6] IMPLICIT OrganizationalUnitNames
-                                 OPTIONAL }
-     -- see also teletex-organizational-unit-names
-
-CountryName ::= [APPLICATION 1] CHOICE {
-   x121-dcc-code         NumericString
-                           (SIZE (ub-country-name-numeric-length)),
-   iso-3166-alpha2-code  PrintableString
-                           (SIZE (ub-country-name-alpha-length)) }
-
-AdministrationDomainName ::= [APPLICATION 2] CHOICE {
-   numeric   NumericString   (SIZE (0..ub-domain-name-length)),
-   printable PrintableString (SIZE (0..ub-domain-name-length)) }
-
-NetworkAddress ::= X121Address  -- see also extended-network-address
-
-X121Address ::= NumericString (SIZE (1..ub-x121-address-length))
-
-TerminalIdentifier ::= PrintableString (SIZE
-(1..ub-terminal-id-length))
-
-PrivateDomainName ::= CHOICE {
-   numeric   NumericString   (SIZE (1..ub-domain-name-length)),
-   printable PrintableString (SIZE (1..ub-domain-name-length)) }
-
-OrganizationName ::= PrintableString
-                            (SIZE (1..ub-organization-name-length))
-  -- see also teletex-organization-name
-
-NumericUserIdentifier ::= NumericString
-                            (SIZE (1..ub-numeric-user-id-length))
-
-PersonalName ::= SET {
-   surname     [0] IMPLICIT PrintableString
-                    (SIZE (1..ub-surname-length)),
-   given-name  [1] IMPLICIT PrintableString
-                    (SIZE (1..ub-given-name-length)) OPTIONAL,
-   initials    [2] IMPLICIT PrintableString
-                    (SIZE (1..ub-initials-length)) OPTIONAL,
-   generation-qualifier [3] IMPLICIT PrintableString
-                    (SIZE (1..ub-generation-qualifier-length))
-                    OPTIONAL }
-  -- see also teletex-personal-name
-
-OrganizationalUnitNames ::= SEQUENCE SIZE (1..ub-organizational-units)
-                             OF OrganizationalUnitName
-  -- see also teletex-organizational-unit-names
-
-OrganizationalUnitName ::= PrintableString (SIZE
-                    (1..ub-organizational-unit-name-length))
-
--- Built-in Domain-defined Attributes
-
-BuiltInDomainDefinedAttributes ::= SEQUENCE SIZE
-                    (1..ub-domain-defined-attributes) OF
-                    BuiltInDomainDefinedAttribute
-
-BuiltInDomainDefinedAttribute ::= SEQUENCE {
-   type PrintableString (SIZE
-                   (1..ub-domain-defined-attribute-type-length)),
-   value PrintableString (SIZE
-                   (1..ub-domain-defined-attribute-value-length)) }
-
--- Extension Attributes
-
-ExtensionAttributes ::= SET SIZE (1..ub-extension-attributes) OF
-               ExtensionAttribute
-
-ExtensionAttribute ::=  SEQUENCE {
-   extension-attribute-type [0] IMPLICIT INTEGER
-                   (0..ub-extension-attributes),
-   extension-attribute-value [1]
-                   ANY DEFINED BY extension-attribute-type }
-
--- Extension types and attribute values
-
-common-name INTEGER ::= 1
-
-CommonName ::= PrintableString (SIZE (1..ub-common-name-length))
-
-teletex-common-name INTEGER ::= 2
-
-TeletexCommonName ::= TeletexString (SIZE (1..ub-common-name-length))
-
-teletex-organization-name INTEGER ::= 3
-
-TeletexOrganizationName ::=
-                TeletexString (SIZE (1..ub-organization-name-length))
-
-teletex-personal-name INTEGER ::= 4
-
-TeletexPersonalName ::= SET {
-   surname     [0] IMPLICIT TeletexString
-                    (SIZE (1..ub-surname-length)),
-   given-name  [1] IMPLICIT TeletexString
-                    (SIZE (1..ub-given-name-length)) OPTIONAL,
-   initials    [2] IMPLICIT TeletexString
-                    (SIZE (1..ub-initials-length)) OPTIONAL,
-   generation-qualifier [3] IMPLICIT TeletexString
-                    (SIZE (1..ub-generation-qualifier-length))
-                    OPTIONAL }
-
-teletex-organizational-unit-names INTEGER ::= 5
-
-TeletexOrganizationalUnitNames ::= SEQUENCE SIZE
-      (1..ub-organizational-units) OF TeletexOrganizationalUnitName
-
-TeletexOrganizationalUnitName ::= TeletexString
-                  (SIZE (1..ub-organizational-unit-name-length))
-
-pds-name INTEGER ::= 7
-
-PDSName ::= PrintableString (SIZE (1..ub-pds-name-length))
-
-physical-delivery-country-name INTEGER ::= 8
-
-PhysicalDeliveryCountryName ::= CHOICE {
-   x121-dcc-code NumericString (SIZE
-(ub-country-name-numeric-length)),
-   iso-3166-alpha2-code PrintableString
-                  (SIZE (ub-country-name-alpha-length)) }
-
-postal-code INTEGER ::= 9
-
-PostalCode ::= CHOICE {
-   numeric-code NumericString (SIZE (1..ub-postal-code-length)),
-   printable-code PrintableString (SIZE (1..ub-postal-code-length)) }
-
-physical-delivery-office-name INTEGER ::= 10
-
-PhysicalDeliveryOfficeName ::= PDSParameter
-
-physical-delivery-office-number INTEGER ::= 11
-
-PhysicalDeliveryOfficeNumber ::= PDSParameter
-
-extension-OR-address-components INTEGER ::= 12
-
-ExtensionORAddressComponents ::= PDSParameter
-
-physical-delivery-personal-name INTEGER ::= 13
-
-PhysicalDeliveryPersonalName ::= PDSParameter
-
-physical-delivery-organization-name INTEGER ::= 14
-
-PhysicalDeliveryOrganizationName ::= PDSParameter
-
-extension-physical-delivery-address-components INTEGER ::= 15
-
-ExtensionPhysicalDeliveryAddressComponents ::= PDSParameter
-
-unformatted-postal-address INTEGER ::= 16
-
-UnformattedPostalAddress ::= SET {
-   printable-address SEQUENCE SIZE (1..ub-pds-physical-address-lines)
-         OF PrintableString (SIZE (1..ub-pds-parameter-length))
-         OPTIONAL,
-   teletex-string TeletexString
-         (SIZE (1..ub-unformatted-address-length)) OPTIONAL }
-
-street-address INTEGER ::= 17
-
-StreetAddress ::= PDSParameter
-
-post-office-box-address INTEGER ::= 18
-
-PostOfficeBoxAddress ::= PDSParameter
-
-poste-restante-address INTEGER ::= 19
-
-PosteRestanteAddress ::= PDSParameter
-
-unique-postal-name INTEGER ::= 20
-
-UniquePostalName ::= PDSParameter
-
-local-postal-attributes INTEGER ::= 21
-
-LocalPostalAttributes ::= PDSParameter
-
-PDSParameter ::= SET {
-   printable-string PrintableString
-                (SIZE(1..ub-pds-parameter-length)) OPTIONAL,
-   teletex-string TeletexString
-                (SIZE(1..ub-pds-parameter-length)) OPTIONAL }
-
-extended-network-address INTEGER ::= 22
-
-ExtendedNetworkAddress ::= CHOICE {
-   e163-4-address SEQUENCE {
-      number      [0] IMPLICIT NumericString
-                       (SIZE (1..ub-e163-4-number-length)),
-      sub-address [1] IMPLICIT NumericString
-                       (SIZE (1..ub-e163-4-sub-address-length))
-                       OPTIONAL },
-   psap-address [0] IMPLICIT PresentationAddress }
-
-PresentationAddress ::= SEQUENCE {
-    pSelector     [0] EXPLICIT OCTET STRING OPTIONAL,
-    sSelector     [1] EXPLICIT OCTET STRING OPTIONAL,
-    tSelector     [2] EXPLICIT OCTET STRING OPTIONAL,
-    nAddresses    [3] EXPLICIT SET SIZE (1..MAX) OF OCTET STRING }
-
-terminal-type  INTEGER ::= 23
-
-TerminalType ::= INTEGER {
-   telex (3),
-   teletex (4),
-   g3-facsimile (5),
-   g4-facsimile (6),
-   ia5-terminal (7),
-   videotex (8) } (0..ub-integer-options)
-
--- Extension Domain-defined Attributes
-
-teletex-domain-defined-attributes INTEGER ::= 6
-
-TeletexDomainDefinedAttributes ::= SEQUENCE SIZE
-   (1..ub-domain-defined-attributes) OF TeletexDomainDefinedAttribute
-
-TeletexDomainDefinedAttribute ::= SEQUENCE {
-        type TeletexString
-               (SIZE (1..ub-domain-defined-attribute-type-length)),
-        value TeletexString
-               (SIZE (1..ub-domain-defined-attribute-value-length)) }
-
---  specifications of Upper Bounds MUST be regarded as mandatory
---  from Annex B of ITU-T X.411 Reference Definition of MTS Parameter
---  Upper Bounds
-
--- Upper Bounds
-ub-name INTEGER ::= 32768
-ub-common-name INTEGER ::= 64
-ub-locality-name INTEGER ::= 128
-ub-state-name INTEGER ::= 128
-ub-organization-name INTEGER ::= 64
-ub-organizational-unit-name INTEGER ::= 64
-ub-title INTEGER ::= 64
-ub-serial-number INTEGER ::= 64
-ub-match INTEGER ::= 128
-ub-emailaddress-length INTEGER ::= 128
-ub-common-name-length INTEGER ::= 64
-ub-country-name-alpha-length INTEGER ::= 2
-ub-country-name-numeric-length INTEGER ::= 3
-ub-domain-defined-attributes INTEGER ::= 4
-ub-domain-defined-attribute-type-length INTEGER ::= 8
-ub-domain-defined-attribute-value-length INTEGER ::= 128
-ub-domain-name-length INTEGER ::= 16
-ub-extension-attributes INTEGER ::= 256
-ub-e163-4-number-length INTEGER ::= 15
-ub-e163-4-sub-address-length INTEGER ::= 40
-ub-generation-qualifier-length INTEGER ::= 3
-ub-given-name-length INTEGER ::= 16
-ub-initials-length INTEGER ::= 5
-ub-integer-options INTEGER ::= 256
-ub-numeric-user-id-length INTEGER ::= 32
-ub-organization-name-length INTEGER ::= 64
-ub-organizational-unit-name-length INTEGER ::= 32
-ub-organizational-units INTEGER ::= 4
-ub-pds-name-length INTEGER ::= 16
-ub-pds-parameter-length INTEGER ::= 30
-ub-pds-physical-address-lines INTEGER ::= 6
-ub-postal-code-length INTEGER ::= 16
-ub-pseudonym INTEGER ::= 128
-ub-surname-length INTEGER ::= 40
-ub-terminal-id-length INTEGER ::= 24
-ub-unformatted-address-length INTEGER ::= 180
-ub-x121-address-length INTEGER ::= 16
-
--- Note - upper bounds on string types, such as TeletexString, are
--- measured in characters.  Excepting PrintableString or IA5String, a
--- significantly greater number of octets will be required to hold
--- such a value.  As a minimum, 16 octets, or twice the specified
--- upper bound, whichever is the larger, should be allowed for
--- TeletexString.  For UTF8String or UniversalString at least four
--- times the upper bound should be allowed.
-
-END
diff --git a/lib/ssl/pkix/PKIX1Explicit88.hrl b/lib/ssl/pkix/PKIX1Explicit88.hrl
deleted file mode 100644
index 5940c1e245..0000000000
--- a/lib/ssl/pkix/PKIX1Explicit88.hrl
+++ /dev/null
@@ -1,163 +0,0 @@
-%% Generated by the Erlang ASN.1 compiler version:1.4.4.8
-%% Purpose: Erlang record definitions for each named and unnamed
-%% SEQUENCE and SET, and macro definitions for each value
-%% definition,in module PKIX1Explicit88
-
-
-
--record('Attribute',{
-type, values}).
-
--record('AttributeTypeAndValue',{
-type, value}).
-
--record('Certificate',{
-tbsCertificate, signatureAlgorithm, signature}).
-
--record('TBSCertificate',{
-version = asn1_DEFAULT, serialNumber, signature, issuer, validity, subject, subjectPublicKeyInfo, issuerUniqueID = asn1_NOVALUE, subjectUniqueID = asn1_NOVALUE, extensions = asn1_NOVALUE}).
-
--record('Validity',{
-notBefore, notAfter}).
-
--record('SubjectPublicKeyInfo',{
-algorithm, subjectPublicKey}).
-
--record('Extension',{
-extnID, critical = asn1_DEFAULT, extnValue}).
-
--record('CertificateList',{
-tbsCertList, signatureAlgorithm, signature}).
-
--record('TBSCertList',{
-version = asn1_NOVALUE, signature, issuer, thisUpdate, nextUpdate = asn1_NOVALUE, revokedCertificates = asn1_NOVALUE, crlExtensions = asn1_NOVALUE}).
-
--record('TBSCertList_revokedCertificates_SEQOF',{
-userCertificate, revocationDate, crlEntryExtensions = asn1_NOVALUE}).
-
--record('AlgorithmIdentifier',{
-algorithm, parameters = asn1_NOVALUE}).
-
--record('ORAddress',{
-'built-in-standard-attributes', 'built-in-domain-defined-attributes' = asn1_NOVALUE, 'extension-attributes' = asn1_NOVALUE}).
-
--record('BuiltInStandardAttributes',{
-'country-name' = asn1_NOVALUE, 'administration-domain-name' = asn1_NOVALUE, 'network-address' = asn1_NOVALUE, 'terminal-identifier' = asn1_NOVALUE, 'private-domain-name' = asn1_NOVALUE, 'organization-name' = asn1_NOVALUE, 'numeric-user-identifier' = asn1_NOVALUE, 'personal-name' = asn1_NOVALUE, 'organizational-unit-names' = asn1_NOVALUE}).
-
--record('PersonalName',{
-surname, 'given-name' = asn1_NOVALUE, initials = asn1_NOVALUE, 'generation-qualifier' = asn1_NOVALUE}).
-
--record('BuiltInDomainDefinedAttribute',{
-type, value}).
-
--record('ExtensionAttribute',{
-'extension-attribute-type', 'extension-attribute-value'}).
-
--record('TeletexPersonalName',{
-surname, 'given-name' = asn1_NOVALUE, initials = asn1_NOVALUE, 'generation-qualifier' = asn1_NOVALUE}).
-
--record('UnformattedPostalAddress',{
-'printable-address' = asn1_NOVALUE, 'teletex-string' = asn1_NOVALUE}).
-
--record('PDSParameter',{
-'printable-string' = asn1_NOVALUE, 'teletex-string' = asn1_NOVALUE}).
-
--record('ExtendedNetworkAddress_e163-4-address',{
-number, 'sub-address' = asn1_NOVALUE}).
-
--record('PresentationAddress',{
-pSelector = asn1_NOVALUE, sSelector = asn1_NOVALUE, tSelector = asn1_NOVALUE, nAddresses}).
-
--record('TeletexDomainDefinedAttribute',{
-type, value}).
-
--define('id-pkix', {1,3,6,1,5,5,7}).
--define('id-pe', {1,3,6,1,5,5,7,1}).
--define('id-qt', {1,3,6,1,5,5,7,2}).
--define('id-kp', {1,3,6,1,5,5,7,3}).
--define('id-ad', {1,3,6,1,5,5,7,48}).
--define('id-qt-cps', {1,3,6,1,5,5,7,2,1}).
--define('id-qt-unotice', {1,3,6,1,5,5,7,2,2}).
--define('id-ad-ocsp', {1,3,6,1,5,5,7,48,1}).
--define('id-ad-caIssuers', {1,3,6,1,5,5,7,48,2}).
--define('id-ad-timeStamping', {1,3,6,1,5,5,7,48,3}).
--define('id-ad-caRepository', {1,3,6,1,5,5,7,48,5}).
--define('id-at', {2,5,4}).
--define('id-at-name', {2,5,4,41}).
--define('id-at-surname', {2,5,4,4}).
--define('id-at-givenName', {2,5,4,42}).
--define('id-at-initials', {2,5,4,43}).
--define('id-at-generationQualifier', {2,5,4,44}).
--define('id-at-commonName', {2,5,4,3}).
--define('id-at-localityName', {2,5,4,7}).
--define('id-at-stateOrProvinceName', {2,5,4,8}).
--define('id-at-organizationName', {2,5,4,10}).
--define('id-at-organizationalUnitName', {2,5,4,11}).
--define('id-at-title', {2,5,4,12}).
--define('id-at-dnQualifier', {2,5,4,46}).
--define('id-at-countryName', {2,5,4,6}).
--define('id-at-serialNumber', {2,5,4,5}).
--define('id-at-pseudonym', {2,5,4,65}).
--define('id-domainComponent', {0,9,2342,19200300,100,1,25}).
--define('pkcs-9', {1,2,840,113549,1,9}).
--define('id-emailAddress', {1,2,840,113549,1,9,1}).
--define('common-name', 1).
--define('teletex-common-name', 2).
--define('teletex-organization-name', 3).
--define('teletex-personal-name', 4).
--define('teletex-organizational-unit-names', 5).
--define('pds-name', 7).
--define('physical-delivery-country-name', 8).
--define('postal-code', 9).
--define('physical-delivery-office-name', 10).
--define('physical-delivery-office-number', 11).
--define('extension-OR-address-components', 12).
--define('physical-delivery-personal-name', 13).
--define('physical-delivery-organization-name', 14).
--define('extension-physical-delivery-address-components', 15).
--define('unformatted-postal-address', 16).
--define('street-address', 17).
--define('post-office-box-address', 18).
--define('poste-restante-address', 19).
--define('unique-postal-name', 20).
--define('local-postal-attributes', 21).
--define('extended-network-address', 22).
--define('terminal-type', 23).
--define('teletex-domain-defined-attributes', 6).
--define('ub-name', 32768).
--define('ub-common-name', 64).
--define('ub-locality-name', 128).
--define('ub-state-name', 128).
--define('ub-organization-name', 64).
--define('ub-organizational-unit-name', 64).
--define('ub-title', 64).
--define('ub-serial-number', 64).
--define('ub-match', 128).
--define('ub-emailaddress-length', 128).
--define('ub-common-name-length', 64).
--define('ub-country-name-alpha-length', 2).
--define('ub-country-name-numeric-length', 3).
--define('ub-domain-defined-attributes', 4).
--define('ub-domain-defined-attribute-type-length', 8).
--define('ub-domain-defined-attribute-value-length', 128).
--define('ub-domain-name-length', 16).
--define('ub-extension-attributes', 256).
--define('ub-e163-4-number-length', 15).
--define('ub-e163-4-sub-address-length', 40).
--define('ub-generation-qualifier-length', 3).
--define('ub-given-name-length', 16).
--define('ub-initials-length', 5).
--define('ub-integer-options', 256).
--define('ub-numeric-user-id-length', 32).
--define('ub-organization-name-length', 64).
--define('ub-organizational-unit-name-length', 32).
--define('ub-organizational-units', 4).
--define('ub-pds-name-length', 16).
--define('ub-pds-parameter-length', 30).
--define('ub-pds-physical-address-lines', 6).
--define('ub-postal-code-length', 16).
--define('ub-pseudonym', 128).
--define('ub-surname-length', 40).
--define('ub-terminal-id-length', 24).
--define('ub-unformatted-address-length', 180).
--define('ub-x121-address-length', 16).
diff --git a/lib/ssl/pkix/PKIX1Implicit88.asn1 b/lib/ssl/pkix/PKIX1Implicit88.asn1
deleted file mode 100644
index ced270baf6..0000000000
--- a/lib/ssl/pkix/PKIX1Implicit88.asn1
+++ /dev/null
@@ -1,349 +0,0 @@
-PKIX1Implicit88 { iso(1) identified-organization(3) dod(6) internet(1)
-  security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-implicit(19) }
-
-DEFINITIONS IMPLICIT TAGS ::=
-
-BEGIN
-
--- EXPORTS ALL --
-
-IMPORTS
-      id-pe, id-kp, id-qt-unotice, id-qt-cps,
-      -- delete following line if "new" types are supported --
-      -- BMPString, 
-      -- UTF8String,  end "new" types --
-      ORAddress, Name, RelativeDistinguishedName,
-      CertificateSerialNumber, Attribute, DirectoryString
-      FROM PKIX1Explicit88 { iso(1) identified-organization(3)
-            dod(6) internet(1) security(5) mechanisms(5) pkix(7)
-            id-mod(0) id-pkix1-explicit(18) };
-
-
--- ISO arc for standard certificate and CRL extensions
-
-id-ce OBJECT IDENTIFIER  ::=  {joint-iso-ccitt(2) ds(5) 29}
-
--- authority key identifier OID and syntax
-
-id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::=  { id-ce 35 }
-
-AuthorityKeyIdentifier ::= SEQUENCE {
-    keyIdentifier             [0] KeyIdentifier            OPTIONAL,
-    authorityCertIssuer       [1] GeneralNames             OPTIONAL,
-    authorityCertSerialNumber [2] CertificateSerialNumber  OPTIONAL }
-    -- authorityCertIssuer and authorityCertSerialNumber MUST both
-    -- be present or both be absent
-
-KeyIdentifier ::= OCTET STRING
-
--- subject key identifier OID and syntax
-
-id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::=  { id-ce 14 }
-
-SubjectKeyIdentifier ::= KeyIdentifier
-
--- key usage extension OID and syntax
-
-id-ce-keyUsage OBJECT IDENTIFIER ::=  { id-ce 15 }
-
-KeyUsage ::= BIT STRING {
-     digitalSignature        (0),
-     nonRepudiation          (1),
-     keyEncipherment         (2),
-     dataEncipherment        (3),
-     keyAgreement            (4),
-     keyCertSign             (5),
-     cRLSign                 (6),
-     encipherOnly            (7),
-     decipherOnly            (8) }
-
--- private key usage period extension OID and syntax
-
-id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::=  { id-ce 16 }
-
-PrivateKeyUsagePeriod ::= SEQUENCE {
-     notBefore       [0]     GeneralizedTime OPTIONAL,
-     notAfter        [1]     GeneralizedTime OPTIONAL }
-     -- either notBefore or notAfter MUST be present
-
--- certificate policies extension OID and syntax
-
-id-ce-certificatePolicies OBJECT IDENTIFIER ::=  { id-ce 32 }
-
-anyPolicy OBJECT IDENTIFIER ::= { id-ce-certificatePolicies 0 }
-
-CertificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
-
-PolicyInformation ::= SEQUENCE {
-     policyIdentifier   CertPolicyId,
-     policyQualifiers   SEQUENCE SIZE (1..MAX) OF
-             PolicyQualifierInfo OPTIONAL }
-
-CertPolicyId ::= OBJECT IDENTIFIER
-
-PolicyQualifierInfo ::= SEQUENCE {
-       policyQualifierId  PolicyQualifierId,
-       qualifier        ANY DEFINED BY policyQualifierId }
-
--- Implementations that recognize additional policy qualifiers MUST
--- augment the following definition for PolicyQualifierId
-
-PolicyQualifierId ::=
-    OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice )
-
--- CPS pointer qualifier
-
-CPSuri ::= IA5String
-
--- user notice qualifier
-
-UserNotice ::= SEQUENCE {
-     noticeRef        NoticeReference OPTIONAL,
-     explicitText     DisplayText OPTIONAL}
-
-NoticeReference ::= SEQUENCE {
-     organization     DisplayText,
-     noticeNumbers    SEQUENCE OF INTEGER }
-
-DisplayText ::= CHOICE {
-     ia5String        IA5String      (SIZE (1..200)),
-     visibleString    VisibleString  (SIZE (1..200)),
-     bmpString        BMPString      (SIZE (1..200)),
-     utf8String       UTF8String     (SIZE (1..200)) }
-
--- policy mapping extension OID and syntax
-
-id-ce-policyMappings OBJECT IDENTIFIER ::=  { id-ce 33 }
-
-PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
-     issuerDomainPolicy      CertPolicyId,
-     subjectDomainPolicy     CertPolicyId }
-
--- subject alternative name extension OID and syntax
-
-id-ce-subjectAltName OBJECT IDENTIFIER ::=  { id-ce 17 }
-
-SubjectAltName ::= GeneralNames
-
-GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
-
-GeneralName ::= CHOICE {
-     otherName                       [0]     AnotherName,
-     rfc822Name                      [1]     IA5String,
-     dNSName                         [2]     IA5String,
-     x400Address                     [3]     ORAddress,
-     directoryName                   [4]     Name,
-     ediPartyName                    [5]     EDIPartyName,
-     uniformResourceIdentifier       [6]     IA5String,
-     iPAddress                       [7]     OCTET STRING,
-     registeredID                    [8]     OBJECT IDENTIFIER }
-
--- AnotherName replaces OTHER-NAME ::= TYPE-IDENTIFIER, as
--- TYPE-IDENTIFIER is not supported in the '88 ASN.1 syntax
-
-AnotherName ::= SEQUENCE {
-     type-id    OBJECT IDENTIFIER,
-     value      [0] EXPLICIT ANY DEFINED BY type-id }
-
-EDIPartyName ::= SEQUENCE {
-     nameAssigner            [0]     DirectoryString OPTIONAL,
-     partyName               [1]     DirectoryString }
-
--- issuer alternative name extension OID and syntax
-
-id-ce-issuerAltName OBJECT IDENTIFIER ::=  { id-ce 18 }
-
-IssuerAltName ::= GeneralNames
-
-id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::=  { id-ce 9 }
-
-SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF Attribute
-
--- basic constraints extension OID and syntax
-
-id-ce-basicConstraints OBJECT IDENTIFIER ::=  { id-ce 19 }
-
-BasicConstraints ::= SEQUENCE {
-     cA                      BOOLEAN DEFAULT FALSE,
-     pathLenConstraint       INTEGER (0..MAX) OPTIONAL }
-
--- name constraints extension OID and syntax
-
-id-ce-nameConstraints OBJECT IDENTIFIER ::=  { id-ce 30 }
-
-NameConstraints ::= SEQUENCE {
-     permittedSubtrees       [0]     GeneralSubtrees OPTIONAL,
-     excludedSubtrees        [1]     GeneralSubtrees OPTIONAL }
-
-GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
-
-GeneralSubtree ::= SEQUENCE {
-     base                    GeneralName,
-     minimum         [0]     BaseDistance DEFAULT 0,
-     maximum         [1]     BaseDistance OPTIONAL }
-
-BaseDistance ::= INTEGER (0..MAX)
-
--- policy constraints extension OID and syntax
-
-id-ce-policyConstraints OBJECT IDENTIFIER ::=  { id-ce 36 }
-
-PolicyConstraints ::= SEQUENCE {
-     requireExplicitPolicy           [0] SkipCerts OPTIONAL,
-     inhibitPolicyMapping            [1] SkipCerts OPTIONAL }
-
-SkipCerts ::= INTEGER (0..MAX)
-
--- CRL distribution points extension OID and syntax
-
-id-ce-cRLDistributionPoints     OBJECT IDENTIFIER  ::=  {id-ce 31}
-
-CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
-
-DistributionPoint ::= SEQUENCE {
-     distributionPoint       [0]     DistributionPointName OPTIONAL,
-     reasons                 [1]     ReasonFlags OPTIONAL,
-     cRLIssuer               [2]     GeneralNames OPTIONAL }
-
-DistributionPointName ::= CHOICE {
-     fullName                [0]     GeneralNames,
-     nameRelativeToCRLIssuer [1]     RelativeDistinguishedName }
-
-ReasonFlags ::= BIT STRING {
-     unused                  (0),
-     keyCompromise           (1),
-     cACompromise            (2),
-     affiliationChanged      (3),
-     superseded              (4),
-     cessationOfOperation    (5),
-     certificateHold         (6),
-     privilegeWithdrawn      (7),
-     aACompromise            (8) }
-
--- extended key usage extension OID and syntax
-
-id-ce-extKeyUsage OBJECT IDENTIFIER ::= {id-ce 37}
-
-ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
-
-
-KeyPurposeId ::= OBJECT IDENTIFIER
-
--- permit unspecified key uses
-
-anyExtendedKeyUsage OBJECT IDENTIFIER ::= { id-ce-extKeyUsage 0 }
-
--- extended key purpose OIDs
-
-id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
-id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
-id-kp-codeSigning            OBJECT IDENTIFIER ::= { id-kp 3 }
-id-kp-emailProtection        OBJECT IDENTIFIER ::= { id-kp 4 }
-id-kp-timeStamping           OBJECT IDENTIFIER ::= { id-kp 8 }
-id-kp-OCSPSigning            OBJECT IDENTIFIER ::= { id-kp 9 }
-
--- inhibit any policy OID and syntax
-
-id-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::=  { id-ce 54 }
-
-InhibitAnyPolicy ::= SkipCerts
-
--- freshest (delta)CRL extension OID and syntax
-
-id-ce-freshestCRL OBJECT IDENTIFIER ::=  { id-ce 46 }
-
-FreshestCRL ::= CRLDistributionPoints
-
--- authority info access
-
-id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
-
-AuthorityInfoAccessSyntax  ::=
-        SEQUENCE SIZE (1..MAX) OF AccessDescription
-
-AccessDescription  ::=  SEQUENCE {
-        accessMethod          OBJECT IDENTIFIER,
-        accessLocation        GeneralName  }
-
--- subject info access
-
-id-pe-subjectInfoAccess OBJECT IDENTIFIER ::= { id-pe 11 }
-
-SubjectInfoAccessSyntax  ::=
-        SEQUENCE SIZE (1..MAX) OF AccessDescription
-
--- CRL number extension OID and syntax
-
-id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
-
-CRLNumber ::= INTEGER (0..MAX)
-
--- issuing distribution point extension OID and syntax
-
-id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-ce 28 }
-
-IssuingDistributionPoint ::= SEQUENCE {
-     distributionPoint          [0] DistributionPointName OPTIONAL,
-     onlyContainsUserCerts      [1] BOOLEAN DEFAULT FALSE,
-     onlyContainsCACerts        [2] BOOLEAN DEFAULT FALSE,
-     onlySomeReasons            [3] ReasonFlags OPTIONAL,
-     indirectCRL                [4] BOOLEAN DEFAULT FALSE,
-     onlyContainsAttributeCerts [5] BOOLEAN DEFAULT FALSE }
-
-id-ce-deltaCRLIndicator OBJECT IDENTIFIER ::= { id-ce 27 }
-
-BaseCRLNumber ::= CRLNumber
-
--- CRL reasons extension OID and syntax
-
-id-ce-cRLReasons OBJECT IDENTIFIER ::= { id-ce 21 }
-
-CRLReason ::= ENUMERATED {
-     unspecified             (0),
-     keyCompromise           (1),
-     cACompromise            (2),
-     affiliationChanged      (3),
-     superseded              (4),
-     cessationOfOperation    (5),
-     certificateHold         (6),
-     removeFromCRL           (8),
-     privilegeWithdrawn      (9),
-     aACompromise           (10) }
-
--- certificate issuer CRL entry extension OID and syntax
-
-id-ce-certificateIssuer OBJECT IDENTIFIER ::= { id-ce 29 }
-
-CertificateIssuer ::= GeneralNames
-
--- hold instruction extension OID and syntax
-
-id-ce-holdInstructionCode OBJECT IDENTIFIER ::= { id-ce 23 }
-
-HoldInstructionCode ::= OBJECT IDENTIFIER
-
--- ANSI x9 holdinstructions
-
--- ANSI x9 arc holdinstruction arc
-
-holdInstruction OBJECT IDENTIFIER ::=
-          {joint-iso-itu-t(2) member-body(2) us(840) x9cm(10040) 2}
-
--- ANSI X9 holdinstructions referenced by this standard
-
-id-holdinstruction-none OBJECT IDENTIFIER  ::=
-                {holdInstruction 1} -- deprecated
-
-id-holdinstruction-callissuer OBJECT IDENTIFIER ::=
-                {holdInstruction 2}
-
-id-holdinstruction-reject OBJECT IDENTIFIER ::=
-                {holdInstruction 3}
-
--- invalidity date CRL entry extension OID and syntax
-
-id-ce-invalidityDate OBJECT IDENTIFIER ::= { id-ce 24 }
-
-InvalidityDate ::=  GeneralizedTime
-
-END
diff --git a/lib/ssl/pkix/PKIX1Implicit88.hrl b/lib/ssl/pkix/PKIX1Implicit88.hrl
deleted file mode 100644
index 8fa1836284..0000000000
--- a/lib/ssl/pkix/PKIX1Implicit88.hrl
+++ /dev/null
@@ -1,93 +0,0 @@
-%% Generated by the Erlang ASN.1 compiler version:1.4.4.8
-%% Purpose: Erlang record definitions for each named and unnamed
-%% SEQUENCE and SET, and macro definitions for each value
-%% definition,in module PKIX1Implicit88
-
-
-
--record('AuthorityKeyIdentifier',{
-keyIdentifier = asn1_NOVALUE, authorityCertIssuer = asn1_NOVALUE, authorityCertSerialNumber = asn1_NOVALUE}).
-
--record('PrivateKeyUsagePeriod',{
-notBefore = asn1_NOVALUE, notAfter = asn1_NOVALUE}).
-
--record('PolicyInformation',{
-policyIdentifier, policyQualifiers = asn1_NOVALUE}).
-
--record('PolicyQualifierInfo',{
-policyQualifierId, qualifier}).
-
--record('UserNotice',{
-noticeRef = asn1_NOVALUE, explicitText = asn1_NOVALUE}).
-
--record('NoticeReference',{
-organization, noticeNumbers}).
-
--record('PolicyMappings_SEQOF',{
-issuerDomainPolicy, subjectDomainPolicy}).
-
--record('AnotherName',{
-'type-id', value}).
-
--record('EDIPartyName',{
-nameAssigner = asn1_NOVALUE, partyName}).
-
--record('BasicConstraints',{
-cA = asn1_DEFAULT, pathLenConstraint = asn1_NOVALUE}).
-
--record('NameConstraints',{
-permittedSubtrees = asn1_NOVALUE, excludedSubtrees = asn1_NOVALUE}).
-
--record('GeneralSubtree',{
-base, minimum = asn1_DEFAULT, maximum = asn1_NOVALUE}).
-
--record('PolicyConstraints',{
-requireExplicitPolicy = asn1_NOVALUE, inhibitPolicyMapping = asn1_NOVALUE}).
-
--record('DistributionPoint',{
-distributionPoint = asn1_NOVALUE, reasons = asn1_NOVALUE, cRLIssuer = asn1_NOVALUE}).
-
--record('AccessDescription',{
-accessMethod, accessLocation}).
-
--record('IssuingDistributionPoint',{
-distributionPoint = asn1_NOVALUE, onlyContainsUserCerts = asn1_DEFAULT, onlyContainsCACerts = asn1_DEFAULT, onlySomeReasons = asn1_NOVALUE, indirectCRL = asn1_DEFAULT, onlyContainsAttributeCerts = asn1_DEFAULT}).
-
--define('id-ce', {2,5,29}).
--define('id-ce-authorityKeyIdentifier', {2,5,29,35}).
--define('id-ce-subjectKeyIdentifier', {2,5,29,14}).
--define('id-ce-keyUsage', {2,5,29,15}).
--define('id-ce-privateKeyUsagePeriod', {2,5,29,16}).
--define('id-ce-certificatePolicies', {2,5,29,32}).
--define('anyPolicy', {2,5,29,32,0}).
--define('id-ce-policyMappings', {2,5,29,33}).
--define('id-ce-subjectAltName', {2,5,29,17}).
--define('id-ce-issuerAltName', {2,5,29,18}).
--define('id-ce-subjectDirectoryAttributes', {2,5,29,9}).
--define('id-ce-basicConstraints', {2,5,29,19}).
--define('id-ce-nameConstraints', {2,5,29,30}).
--define('id-ce-policyConstraints', {2,5,29,36}).
--define('id-ce-cRLDistributionPoints', {2,5,29,31}).
--define('id-ce-extKeyUsage', {2,5,29,37}).
--define('anyExtendedKeyUsage', {2,5,29,37,0}).
--define('id-kp-serverAuth', {1,3,6,1,5,5,7,3,1}).
--define('id-kp-clientAuth', {1,3,6,1,5,5,7,3,2}).
--define('id-kp-codeSigning', {1,3,6,1,5,5,7,3,3}).
--define('id-kp-emailProtection', {1,3,6,1,5,5,7,3,4}).
--define('id-kp-timeStamping', {1,3,6,1,5,5,7,3,8}).
--define('id-kp-OCSPSigning', {1,3,6,1,5,5,7,3,9}).
--define('id-ce-inhibitAnyPolicy', {2,5,29,54}).
--define('id-ce-freshestCRL', {2,5,29,46}).
--define('id-pe-authorityInfoAccess', {1,3,6,1,5,5,7,1,1}).
--define('id-pe-subjectInfoAccess', {1,3,6,1,5,5,7,1,11}).
--define('id-ce-cRLNumber', {2,5,29,20}).
--define('id-ce-issuingDistributionPoint', {2,5,29,28}).
--define('id-ce-deltaCRLIndicator', {2,5,29,27}).
--define('id-ce-cRLReasons', {2,5,29,21}).
--define('id-ce-certificateIssuer', {2,5,29,29}).
--define('id-ce-holdInstructionCode', {2,5,29,23}).
--define('holdInstruction', {2,2,840,10040,2}).
--define('id-holdinstruction-none', {2,2,840,10040,2,1}).
--define('id-holdinstruction-callissuer', {2,2,840,10040,2,2}).
--define('id-holdinstruction-reject', {2,2,840,10040,2,3}).
--define('id-ce-invalidityDate', {2,5,29,24}).
diff --git a/lib/ssl/pkix/PKIXAttributeCertificate.asn1 b/lib/ssl/pkix/PKIXAttributeCertificate.asn1
deleted file mode 100644
index 7d93e6b37e..0000000000
--- a/lib/ssl/pkix/PKIXAttributeCertificate.asn1
+++ /dev/null
@@ -1,189 +0,0 @@
-   PKIXAttributeCertificate {iso(1) identified-organization(3) dod(6)
-                internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
-                id-mod-attribute-cert(12)}
-
-      DEFINITIONS IMPLICIT TAGS ::=
-
-      BEGIN
-
-      -- EXPORTS ALL --
-
-      IMPORTS
-
-            -- IMPORTed module OIDs MAY change if [PKIXPROF] changes
-            -- PKIX Certificate Extensions
-               Attribute, AlgorithmIdentifier, CertificateSerialNumber,
-               Extensions, UniqueIdentifier,
-               id-pkix, id-pe, id-kp, id-ad, id-at
-               FROM PKIX1Explicit88 {iso(1) identified-organization(3)
-                        dod(6) internet(1) security(5) mechanisms(5)
-                        pkix(7) id-mod(0) id-pkix1-explicit-88(1)}
-
-               GeneralName, GeneralNames, id-ce
-               FROM PKIX1Implicit88 {iso(1) identified-organization(3)
-                        dod(6) internet(1) security(5) mechanisms(5)
-                        pkix(7) id-mod(0) id-pkix1-implicit-88(2)} ;
-
-      id-pe-ac-auditIdentity       OBJECT IDENTIFIER ::= { id-pe 4 }
-      id-pe-aaControls             OBJECT IDENTIFIER ::= { id-pe 6 }
-      id-pe-ac-proxying            OBJECT IDENTIFIER ::= { id-pe 10 }
-      id-ce-targetInformation      OBJECT IDENTIFIER ::= { id-ce 55 }
-
-      id-aca                       OBJECT IDENTIFIER ::= { id-pkix 10 }
-      id-aca-authenticationInfo    OBJECT IDENTIFIER ::= { id-aca 1 }
-      id-aca-accessIdentity        OBJECT IDENTIFIER ::= { id-aca 2 }
-      id-aca-chargingIdentity      OBJECT IDENTIFIER ::= { id-aca 3 }
-      id-aca-group                 OBJECT IDENTIFIER ::= { id-aca 4 }
-      -- { id-aca 5 } is reserved
-      id-aca-encAttrs              OBJECT IDENTIFIER ::= { id-aca 6 }
-
-      id-at-role                   OBJECT IDENTIFIER ::= { id-at 72}
-      id-at-clearance              OBJECT IDENTIFIER ::=
-                  { joint-iso-ccitt(2) ds(5) module(1)
-                    selected-attribute-types(5) clearance (55) }
-
-             -- Uncomment this if using a 1988 level ASN.1 compiler
-             -- UTF8String ::= [UNIVERSAL 12] IMPLICIT OCTET STRING
-
-             AttributeCertificate ::= SEQUENCE {
-                   acinfo               AttributeCertificateInfo,
-                   signatureAlgorithm   AlgorithmIdentifier,
-                   signatureValue       BIT STRING
-             }
-
-             AttributeCertificateInfo ::= SEQUENCE {
-                version        AttCertVersion,  -- version is v2
-                holder         Holder,
-                issuer         AttCertIssuer,
-                signature      AlgorithmIdentifier,
-                serialNumber   CertificateSerialNumber,
-                attrCertValidityPeriod   AttCertValidityPeriod,
-                attributes     SEQUENCE OF Attribute,
-                issuerUniqueID UniqueIdentifier OPTIONAL,
-                extensions     Extensions     OPTIONAL
-             }
-
-             AttCertVersion ::= INTEGER { v2(1) }
-
-             Holder ::= SEQUENCE {
-                   baseCertificateID   [0] IssuerSerial OPTIONAL,
-                             -- the issuer and serial number of
-                             -- the holder's Public Key Certificate
-                   entityName          [1] GeneralNames OPTIONAL,
-                             -- the name of the claimant or role
-                   objectDigestInfo    [2] ObjectDigestInfo OPTIONAL
-                             -- used to directly authenticate the
-                             -- holder, for example, an executable
-             }
-
-             ObjectDigestInfo    ::= SEQUENCE {
-                   digestedObjectType  ENUMERATED {
-                        publicKey            (0),
-                        publicKeyCert        (1),
-                        otherObjectTypes     (2) },
-                                -- otherObjectTypes MUST NOT
-                                -- MUST NOT be used in this profile
-                   otherObjectTypeID   OBJECT IDENTIFIER  OPTIONAL,
-                   digestAlgorithm     AlgorithmIdentifier,
-                   objectDigest        BIT STRING
-             }
-
-             AttCertIssuer ::= CHOICE {
-                   v1Form   GeneralNames,  -- MUST NOT be used in this
-                                           -- profile
-                   v2Form   [0] V2Form     -- v2 only
-             }
-
-             V2Form ::= SEQUENCE {
-                   issuerName            GeneralNames  OPTIONAL,
-                   baseCertificateID     [0] IssuerSerial  OPTIONAL,
-                   objectDigestInfo      [1] ObjectDigestInfo  OPTIONAL
-                      -- issuerName MUST be present in this profile
-                      -- baseCertificateID and objectDigestInfo MUST
-                      -- NOT be present in this profile
-             }
-
-             IssuerSerial  ::=  SEQUENCE {
-                   issuer         GeneralNames,
-                   serial         CertificateSerialNumber,
-                   issuerUID      UniqueIdentifier OPTIONAL
-             }
-
-             AttCertValidityPeriod  ::= SEQUENCE {
-                   notBeforeTime  GeneralizedTime,
-                   notAfterTime   GeneralizedTime
-             }
-
-             Targets ::= SEQUENCE OF Target
-
-             Target  ::= CHOICE {
-                   targetName     [0] GeneralName,
-                   targetGroup    [1] GeneralName,
-                   targetCert     [2] TargetCert
-             }
-
-             TargetCert  ::= SEQUENCE {
-                   targetCertificate  IssuerSerial,
-                   targetName         GeneralName OPTIONAL,
-                   certDigestInfo     ObjectDigestInfo OPTIONAL
-             }
-
-             IetfAttrSyntax ::= SEQUENCE {
-                  policyAuthority[0] GeneralNames    OPTIONAL,
-                  values         SEQUENCE OF CHOICE {
-                                 octets    OCTET STRING,
-                                 oid       OBJECT IDENTIFIER,
-                                 string    UTF8String
-                 }
-             }
-
-             SvceAuthInfo ::=    SEQUENCE {
-                   service       GeneralName,
-                   ident         GeneralName,
-                   authInfo      OCTET STRING OPTIONAL
-             }
-
-             RoleSyntax ::= SEQUENCE {
-                   roleAuthority  [0] GeneralNames OPTIONAL,
-                   roleName       [1] GeneralName
-             }
-
-             Clearance  ::=  SEQUENCE {
-                   policyId       [0] OBJECT IDENTIFIER,
-                   classList      [1] ClassList DEFAULT {unclassified},
-                   securityCategories
-                                  [2] SET OF SecurityCategory  OPTIONAL
-             }
-
-             ClassList  ::=  BIT STRING {
-                   unmarked       (0),
-                   unclassified   (1),
-                   restricted     (2),
-                   confidential   (3),
-                   secret         (4),
-                   topSecret      (5)
-             }
-
-             SecurityCategory ::= SEQUENCE {
-                   type      [0]  IMPLICIT OBJECT IDENTIFIER,
-                   value     [1]  ANY DEFINED BY type
-             }
-
-             AAControls ::= SEQUENCE {
-                   pathLenConstraint INTEGER (0..MAX) OPTIONAL,
-                   permittedAttrs    [0] AttrSpec OPTIONAL,
-                   excludedAttrs     [1] AttrSpec OPTIONAL,
-                   permitUnSpecified BOOLEAN DEFAULT TRUE
-             }
-
-             AttrSpec::= SEQUENCE OF OBJECT IDENTIFIER
-
-             ACClearAttrs ::= SEQUENCE {
-                   acIssuer          GeneralName,
-                   acSerial          INTEGER,
-                   attrs             SEQUENCE OF Attribute
-             }
-
-             ProxyInfo ::= SEQUENCE OF Targets
-
-      END
diff --git a/lib/ssl/pkix/PKIXAttributeCertificate.hrl b/lib/ssl/pkix/PKIXAttributeCertificate.hrl
deleted file mode 100644
index 99389c4852..0000000000
--- a/lib/ssl/pkix/PKIXAttributeCertificate.hrl
+++ /dev/null
@@ -1,64 +0,0 @@
-%% Generated by the Erlang ASN.1 compiler version:1.4.4.8
-%% Purpose: Erlang record definitions for each named and unnamed
-%% SEQUENCE and SET, and macro definitions for each value
-%% definition,in module PKIXAttributeCertificate
-
-
-
--record('AttributeCertificate',{
-acinfo, signatureAlgorithm, signatureValue}).
-
--record('AttributeCertificateInfo',{
-version, holder, issuer, signature, serialNumber, attrCertValidityPeriod, attributes, issuerUniqueID = asn1_NOVALUE, extensions = asn1_NOVALUE}).
-
--record('Holder',{
-baseCertificateID = asn1_NOVALUE, entityName = asn1_NOVALUE, objectDigestInfo = asn1_NOVALUE}).
-
--record('ObjectDigestInfo',{
-digestedObjectType, otherObjectTypeID = asn1_NOVALUE, digestAlgorithm, objectDigest}).
-
--record('V2Form',{
-issuerName = asn1_NOVALUE, baseCertificateID = asn1_NOVALUE, objectDigestInfo = asn1_NOVALUE}).
-
--record('IssuerSerial',{
-issuer, serial, issuerUID = asn1_NOVALUE}).
-
--record('AttCertValidityPeriod',{
-notBeforeTime, notAfterTime}).
-
--record('TargetCert',{
-targetCertificate, targetName = asn1_NOVALUE, certDigestInfo = asn1_NOVALUE}).
-
--record('IetfAttrSyntax',{
-policyAuthority = asn1_NOVALUE, values}).
-
--record('SvceAuthInfo',{
-service, ident, authInfo = asn1_NOVALUE}).
-
--record('RoleSyntax',{
-roleAuthority = asn1_NOVALUE, roleName}).
-
--record('Clearance',{
-policyId, classList = asn1_DEFAULT, securityCategories = asn1_NOVALUE}).
-
--record('SecurityCategory',{
-type, value}).
-
--record('AAControls',{
-pathLenConstraint = asn1_NOVALUE, permittedAttrs = asn1_NOVALUE, excludedAttrs = asn1_NOVALUE, permitUnSpecified = asn1_DEFAULT}).
-
--record('ACClearAttrs',{
-acIssuer, acSerial, attrs}).
-
--define('id-pe-ac-auditIdentity', {1,3,6,1,5,5,7,1,4}).
--define('id-pe-aaControls', {1,3,6,1,5,5,7,1,6}).
--define('id-pe-ac-proxying', {1,3,6,1,5,5,7,1,10}).
--define('id-ce-targetInformation', {2,5,29,55}).
--define('id-aca', {1,3,6,1,5,5,7,10}).
--define('id-aca-authenticationInfo', {1,3,6,1,5,5,7,10,1}).
--define('id-aca-accessIdentity', {1,3,6,1,5,5,7,10,2}).
--define('id-aca-chargingIdentity', {1,3,6,1,5,5,7,10,3}).
--define('id-aca-group', {1,3,6,1,5,5,7,10,4}).
--define('id-aca-encAttrs', {1,3,6,1,5,5,7,10,6}).
--define('id-at-role', {2,5,4,72}).
--define('id-at-clearance', {2,5,1,5,55}).
diff --git a/lib/ssl/pkix/README b/lib/ssl/pkix/README
deleted file mode 100644
index 8be2c15de5..0000000000
--- a/lib/ssl/pkix/README
+++ /dev/null
@@ -1,49 +0,0 @@
-The files
-
-	PKIX1Algorithms88.asn1
-	PKIX1Explicit88.asn1
-	PKIX1Implicit88.asn1
-	PKIXAttributeCertificate.asn1
-
-are from RFCs 3279, 3280 and 3281.
-
-We have edited PKIX1Explicit88.asn1, PKIX1Implicit88.asn1, and 
-PKIXAttributeCertificate.asn1 as follows:
-
-
-1. Removal of definition of UniversalString and BMPString:
-
-diff -r1.1 PKIX1Explicit88.asn1
-15c15
-< UniversalString ::= [UNIVERSAL 28] IMPLICIT OCTET STRING
----
-> -- UniversalString ::= [UNIVERSAL 28] IMPLICIT OCTET STRING
-18c18
-< BMPString ::= [UNIVERSAL 30] IMPLICIT OCTET STRING
----
-> -- BMPString ::= [UNIVERSAL 30] IMPLICIT OCTET STRING
-
-
-2. Removal of definition of BMPString:
-
-diff -r1.1 PKIX1Implicit88.asn1
-13c13,14
-<       BMPString, UTF8String,  -- end "new" types --
----
->       -- BMPString, 
->       UTF8String,  -- end "new" types --
-
-
-3. Addition of definition of UTF8String, and correction of a typo.
-
-diff -r1.1 PKIXAttributeCertificate.asn1
-46c46
-<              -- UTF8String ::= [UNIVERSAL 12] IMPLICIT OCTET STRING
----
->              UTF8String ::= [UNIVERSAL 12] IMPLICIT OCTET STRING
-55c55
-<                 version        AttCertVersion  -- version is v2,
----
->                 version        AttCertVersion,  -- version is v2
-
-PKIX1Algorithms88.asn1 is unchanged.
diff --git a/lib/ssl/pkix/SSL-PKIX.asn1 b/lib/ssl/pkix/SSL-PKIX.asn1
deleted file mode 100644
index ea6333f953..0000000000
--- a/lib/ssl/pkix/SSL-PKIX.asn1
+++ /dev/null
@@ -1,704 +0,0 @@
-SSL-PKIX {iso(1) identified-organization(3) dod(6) internet(1)
-	private(4) enterprices(1) ericsson(193) otp(19) ssl(10)
-	pkix1(1)}
-
-DEFINITIONS EXPLICIT TAGS ::=
-
-BEGIN
-
--- EXPORTS ALL
-
-IMPORTS
-	-- Certificate (parts of)
-	Version, 
-	CertificateSerialNumber,
-	--AlgorithmIdentifier,
-	Validity,
-	UniqueIdentifier,
-
-	-- AttribyteTypeAndValue
-	Name, 
-	AttributeType, 	
-	id-at-name,
-	id-at-surname,
-	id-at-givenName,
-	id-at-initials,
-	id-at-generationQualifier, X520name,
- 	id-at-commonName, X520CommonName,
-	id-at-localityName, X520LocalityName,
-	id-at-stateOrProvinceName, X520StateOrProvinceName,
-	id-at-organizationName, X520OrganizationName,
-	id-at-organizationalUnitName, X520OrganizationalUnitName,
-	id-at-title, X520Title,
-	id-at-dnQualifier, X520dnQualifier,
-	id-at-countryName, X520countryName,
-	id-at-serialNumber, X520SerialNumber,
-	id-at-pseudonym, X520Pseudonym,
-	id-domainComponent, DomainComponent,
-	id-emailAddress, EmailAddress,
-
-	-- Extension Attributes
-       common-name, CommonName,
-       teletex-common-name, TeletexCommonName,
-       teletex-personal-name, TeletexPersonalName,
-       pds-name, PDSName,
-       physical-delivery-country-name, PhysicalDeliveryCountryName,
-       postal-code, PostalCode,
-       physical-delivery-office-name, PhysicalDeliveryOfficeName,
-       physical-delivery-office-number, PhysicalDeliveryOfficeNumber,
-       extension-OR-address-components, ExtensionORAddressComponents,
-       physical-delivery-personal-name, PhysicalDeliveryPersonalName,
-       physical-delivery-organization-name, PhysicalDeliveryOrganizationName,
-       extension-physical-delivery-address-components, 
-              ExtensionPhysicalDeliveryAddressComponents,
-       unformatted-postal-address, UnformattedPostalAddress,
-       street-address, StreetAddress,
-       post-office-box-address, PostOfficeBoxAddress,
-       poste-restante-address,  PosteRestanteAddress,
-       unique-postal-name, UniquePostalName,
-       local-postal-attributes, LocalPostalAttributes,
-       extended-network-address, ExtendedNetworkAddress,
-       terminal-type, TerminalType,
-       teletex-domain-defined-attributes, TeletexDomainDefinedAttributes
-
-	FROM PKIX1Explicit88 { iso(1) identified-organization(3) dod(6) 
-	     internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) 
-	     id-pkix1-explicit(18) }
-
-       -- Extensions
-       id-ce-authorityKeyIdentifier, AuthorityKeyIdentifier,
-       id-ce-subjectKeyIdentifier, SubjectKeyIdentifier,
-       id-ce-keyUsage, KeyUsage,
-       id-ce-privateKeyUsagePeriod, PrivateKeyUsagePeriod,
-       id-ce-certificatePolicies, CertificatePolicies,
-       id-ce-policyMappings, PolicyMappings,
-       id-ce-subjectAltName, SubjectAltName,
-       id-ce-issuerAltName, IssuerAltName,
-       id-ce-subjectDirectoryAttributes, SubjectDirectoryAttributes,
-       id-ce-basicConstraints, BasicConstraints,
-       id-ce-nameConstraints, NameConstraints,
-       id-ce-policyConstraints, PolicyConstraints,
-       id-ce-cRLDistributionPoints, CRLDistributionPoints,
-       id-ce-extKeyUsage, ExtKeyUsageSyntax,
-       id-ce-inhibitAnyPolicy, InhibitAnyPolicy,
-       id-ce-freshestCRL, FreshestCRL,
-       id-pe-authorityInfoAccess, AuthorityInfoAccessSyntax,
-       id-pe-subjectInfoAccess, SubjectInfoAccessSyntax,
-       id-ce-cRLNumber, CRLNumber,
-       id-ce-issuingDistributionPoint, IssuingDistributionPoint,
-       id-ce-deltaCRLIndicator, BaseCRLNumber,
-       id-ce-cRLReasons, CRLReason,
-       id-ce-certificateIssuer, CertificateIssuer,
-       id-ce-holdInstructionCode, HoldInstructionCode,
-       id-ce-invalidityDate, InvalidityDate
-
-       FROM PKIX1Implicit88 { iso(1) identified-organization(3) dod(6) 
-       internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) 
-       id-pkix1-implicit(19) }
-
-	--Keys and Signatures
-	id-dsa, Dss-Parms, DSAPublicKey, 
-	id-dsa-with-sha1,
-	md2WithRSAEncryption,
-	md5WithRSAEncryption,
-	sha1WithRSAEncryption,
-	rsaEncryption, RSAPublicKey,
-	dhpublicnumber, DomainParameters, DHPublicKey,
-	id-keyExchangeAlgorithm, KEA-Parms-Id, --KEA-PublicKey,
-	ecdsa-with-SHA1, 
-	prime-field, Prime-p, 
-	characteristic-two-field, --Characteristic-two, 
-	gnBasis, 
-	tpBasis, Trinomial,
-	ppBasis, Pentanomial,
-	id-ecPublicKey, EcpkParameters, ECPoint
-	FROM PKIX1Algorithms88 { iso(1) identified-organization(3) dod(6)
-	     internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
-	     id-mod-pkix1-algorithms(17) };
-
---
--- Certificate
---
-
-SSLCertificate  ::=  SEQUENCE  {
-     tbsCertificate       TBSCertificate,
-     signatureAlgorithm   SignatureAlgorithm,
-     signature            BIT STRING  }
-
-SSLTBSCertificate  ::=  SEQUENCE  {
-     version         [0]  Version DEFAULT v1,
-     serialNumber         CertificateSerialNumber,
-     signature            SignatureAlgorithm,
-     issuer               Name,
-     validity             Validity,
-     subject              Name,
-     subjectPublicKeyInfo SubjectPublicKeyInfo,
-     issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
-                          -- If present, version MUST be v2 or v3
-     subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
-                          -- If present, version MUST be v2 or v3
-     extensions      [3]  Extensions OPTIONAL
-                          -- If present, version MUST be v3 --  }
-
-
--- Attribute type and values
---
-
-ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= CLASS {
-	&id AttributeType UNIQUE,
-	&Type }
-   WITH SYNTAX {
-	ID &id
-	TYPE &Type }
-	
-SSLAttributeTypeAndValue ::=  SEQUENCE {
-        type    ATTRIBUTE-TYPE-AND-VALUE-CLASS.&id
-		({SupportedAttributeTypeAndValues}),
-        value   ATTRIBUTE-TYPE-AND-VALUE-CLASS.&Type
-		({SupportedAttributeTypeAndValues}{@type}) }
-
-SupportedAttributeTypeAndValues ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= 
-	{ name | surname | givenName | initials | generationQualifier |
-	  commonName | localityName | stateOrProvinceName | organizationName |
-	  organizationalUnitName | title | dnQualifier | countryName |
-	  serialNumber | pseudonym | domainComponent | emailAddress }
-
-name ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-at-name
-	TYPE X520name }
-
-surname ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-at-surname
-	TYPE X520name }
-
-givenName ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-at-givenName
-	TYPE X520name }
-
-initials ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-at-initials
-	TYPE X520name }
-
-generationQualifier ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-at-generationQualifier
-	TYPE X520name }
-
-commonName ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-at-commonName
-	TYPE X520CommonName }
-
-localityName ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-at-localityName
-	TYPE X520LocalityName }
-
-stateOrProvinceName ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-at-stateOrProvinceName
-	TYPE X520StateOrProvinceName }
-
-organizationName ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-at-organizationName
-	TYPE X520OrganizationName }
-
-organizationalUnitName ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-at-organizationalUnitName
-	TYPE X520OrganizationalUnitName }
-
-title ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-at-title
-	TYPE X520Title }
-
-dnQualifier ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-at-dnQualifier
-	TYPE X520dnQualifier }
-
-countryName ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-at-countryName
-	TYPE X520countryName }
-
-serialNumber ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-at-serialNumber
-	TYPE X520SerialNumber }
-
-pseudonym ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-at-pseudonym
-	TYPE X520Pseudonym }
-
-domainComponent ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-domainComponent
-	TYPE DomainComponent }
-
-emailAddress ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-	ID id-emailAddress
-	TYPE EmailAddress }
-
---
--- Signature and Public Key Algorithms
---
-
-SSLSubjectPublicKeyInfo ::=  SEQUENCE  {
-     algorithm SEQUENCE {
-               algo     PUBLIC-KEY-ALGORITHM-CLASS.&id
-			     ({SupportedPublicKeyAlgorithms}), 
-	       parameters    PUBLIC-KEY-ALGORITHM-CLASS.&Type
-			     ({SupportedPublicKeyAlgorithms}{@.algo}) 
-			     OPTIONAL
-               }, 
-     subjectPublicKey  PUBLIC-KEY-ALGORITHM-CLASS.&PublicKeyType
-		       ({SupportedPublicKeyAlgorithms}{@algorithm.algo}) }
-
--- The following is needed for conversion of SubjectPublicKeyInfo.
-
-SSLSubjectPublicKeyInfo-Any  ::=  SEQUENCE  {
-     algorithm            PublicKeyAlgorithm,
-     subjectPublicKey     ANY }
-
-
-SIGNATURE-ALGORITHM-CLASS ::= CLASS {
-	&id OBJECT IDENTIFIER UNIQUE,
-	&Type OPTIONAL }
-   WITH SYNTAX {
-	ID &id
-	[TYPE &Type] }
-
-PUBLIC-KEY-ALGORITHM-CLASS ::= CLASS {
-	&id OBJECT IDENTIFIER UNIQUE,
-	&Type OPTIONAL,
-	&PublicKeyType OPTIONAL }
-   WITH SYNTAX {
-	ID &id
-	[TYPE &Type] 
-	[PUBLIC-KEY-TYPE &PublicKeyType] }
-	
-SignatureAlgorithm ::=  SEQUENCE  {
-     algorithm     SIGNATURE-ALGORITHM-CLASS.&id
-				({SupportedSignatureAlgorithms}), 
-     parameters    SIGNATURE-ALGORITHM-CLASS.&Type
-				({SupportedSignatureAlgorithms}{@algorithm}) 
-		   OPTIONAL } 
-
-SignatureAlgorithm-Any ::=  SEQUENCE  {
-     algorithm     OBJECT IDENTIFIER, 
-     parameters    ANY OPTIONAL } 
-
-PublicKeyAlgorithm ::=  SEQUENCE  {
-     algorithm     PUBLIC-KEY-ALGORITHM-CLASS.&id
-			({SupportedPublicKeyAlgorithms}), 
-     parameters    PUBLIC-KEY-ALGORITHM-CLASS.&Type
-			({SupportedPublicKeyAlgorithms}{@algorithm}) 
-		   OPTIONAL } 
-
-SupportedSignatureAlgorithms SIGNATURE-ALGORITHM-CLASS ::= { 
-		    dsa-with-sha1 | md2-with-rsa-encryption |
-		    md5-with-rsa-encryption | sha1-with-rsa-encryption |
-		    ecdsa-with-sha1 } 
-
-SupportedPublicKeyAlgorithms PUBLIC-KEY-ALGORITHM-CLASS ::= { 
-		    dsa | rsa-encryption | dh | kea | ec-public-key }
-
-   --   DSA Keys and Signatures
-
-   -- SubjectPublicKeyInfo:
-
-   dsa PUBLIC-KEY-ALGORITHM-CLASS ::= {
-       ID id-dsa
-       TYPE Dss-Parms -- XXX Must be OPTIONAL
-       PUBLIC-KEY-TYPE DSAPublicKey }
-
-   -- Certificate.signatureAlgorithm
-
-   dsa-with-sha1 SIGNATURE-ALGORITHM-CLASS ::= {
-		 ID id-dsa-with-sha1 
-		 TYPE NULL } -- XXX Must be empty and not NULL
-
-				  --
-   --   RSA Keys and Signatures
-   --
-
-   -- Certificate.signatureAlgorithm
-
-   md2-with-rsa-encryption SIGNATURE-ALGORITHM-CLASS ::= {
-			   ID md2WithRSAEncryption 
-			   TYPE NULL }
-
-   md5-with-rsa-encryption SIGNATURE-ALGORITHM-CLASS ::= {
-			   ID md5WithRSAEncryption 
-			   TYPE NULL }
-
-   sha1-with-rsa-encryption SIGNATURE-ALGORITHM-CLASS ::= {
-			    ID sha1WithRSAEncryption 
-			    TYPE NULL }
-
-   -- Certificate.signature
-   -- See PKCS #1 (RFC 2313). XXX
-
-   -- SubjectPublicKeyInfo:
-
-   rsa-encryption PUBLIC-KEY-ALGORITHM-CLASS ::= {
-		  ID rsaEncryption
-		  TYPE NULL
-		  PUBLIC-KEY-TYPE RSAPublicKey }
-
-   --
-   --   Diffie-Hellman Keys
-   --
-
-   -- SubjectPublicKeyInfo:
-
-   dh PUBLIC-KEY-ALGORITHM-CLASS ::= {
-      ID dhpublicnumber
-      TYPE DomainParameters
-      PUBLIC-KEY-TYPE DHPublicKey }
-
-   -- There are no Diffie-Hellman signature algorithms
-
-   --
-   --   KEA Keys
-   --
-
-   -- SubjectPublicKeyInfo:
-
-   KEA-PublicKey ::= INTEGER
-
-   kea PUBLIC-KEY-ALGORITHM-CLASS ::= {
-       ID id-keyExchangeAlgorithm
-       TYPE KEA-Parms-Id
-       PUBLIC-KEY-TYPE KEA-PublicKey }
-
-   -- There are no KEA signature algorithms
-
-   --
-   --   Elliptic Curve Keys, Signatures, and Curves
-   --
-
-   -- Certificate.signatureAlgorithm
-
-   ecdsa-with-sha1 SIGNATURE-ALGORITHM-CLASS ::= {
-       ID ecdsa-with-SHA1
-       TYPE NULL }  -- XXX Must be empty and not NULL
-
-   FIELD-ID-CLASS ::= CLASS {
-	&id OBJECT IDENTIFIER UNIQUE,
-	&Type }
-   WITH SYNTAX {
-	ID &id
-	TYPE &Type }
-
-   SSLFieldID ::= SEQUENCE {                    -- Finite field
-      fieldType   FIELD-ID-CLASS.&id({SupportedFieldIds}),
-      parameters  FIELD-ID-CLASS.&Type({SupportedFieldIds}{@fieldType}) }
-
-   SupportedFieldIds FIELD-ID-CLASS ::= {
-		     field-prime-field | field-characteristic-two }
-
-   field-prime-field FIELD-ID-CLASS ::= {
-		     ID prime-field
-		     TYPE Prime-p }
-
-   CHARACTERISTIC-TWO-CLASS ::= CLASS {
-	&id OBJECT IDENTIFIER UNIQUE,
-	&Type }
-   WITH SYNTAX {
-	ID &id
-	TYPE &Type }
-
-   SSLCharacteristic-two ::= SEQUENCE {                    -- Finite field
-      m           INTEGER,                   -- Field size 2^m
-      basis       CHARACTERISTIC-TWO-CLASS.&id({SupportedCharacteristicTwos}),
-      parameters  CHARACTERISTIC-TWO-CLASS.&Type
-		  ({SupportedCharacteristicTwos}{@basis}) }
-
-   SupportedCharacteristicTwos CHARACTERISTIC-TWO-CLASS ::= {
-			       gn-basis | tp-basis | pp-basis }
-
-   field-characteristic-two FIELD-ID-CLASS ::= {
-		     ID characteristic-two-field
-		     TYPE Characteristic-two }
-
-   gn-basis CHARACTERISTIC-TWO-CLASS ::= {
-	    ID gnBasis
-	    TYPE NULL }
-
-   tp-basis CHARACTERISTIC-TWO-CLASS ::= {
-	    ID tpBasis
-	    TYPE Trinomial }
-
-   pp-basis CHARACTERISTIC-TWO-CLASS ::= {
-	    ID ppBasis
-	    TYPE Pentanomial }
-
-   -- SubjectPublicKeyInfo.algorithm
-
-   ec-public-key PUBLIC-KEY-ALGORITHM-CLASS ::= {
-      ID id-ecPublicKey
-      TYPE EcpkParameters
-      PUBLIC-KEY-TYPE ECPoint }
-
---
--- Extension Attributes
---
-
-EXTENSION-ATTRIBUTE-CLASS ::= CLASS {
-	&id INTEGER UNIQUE, 
-	&Type }
-   WITH SYNTAX {
-	ID &id
-	TYPE &Type }
-	
-SSLExtensionAttributes ::= SET SIZE (1..MAX) OF ExtensionAttribute
-
--- XXX Below we should have extension-attribute-type and extension-
--- attribute-value but Erlang ASN1 does not like it. 
-SSLExtensionAttribute ::=  SEQUENCE {
-   extensionAttributeType [0] IMPLICIT EXTENSION-ATTRIBUTE-CLASS.&id
-		({SupportedExtensionAttributes}),
-   extensionAttributeValue [1] EXTENSION-ATTRIBUTE-CLASS.&Type
-		({SupportedExtensionAttributes}{@extensionAttributeType}) } 
-
-SupportedExtensionAttributes EXTENSION-ATTRIBUTE-CLASS ::= {
-	     x400-common-name |
-	     x400-teletex-common-name |
-	     x400-teletex-personal-name |
-	     x400-pds-name |
-	     x400-physical-delivery-country-name |
-	     x400-postal-code |
-	     x400-physical-delivery-office-name |
-	     x400-physical-delivery-office-number |
-	     x400-extension-OR-address-components |
-	     x400-physical-delivery-personal-name |
-	     x400-physical-delivery-organization-name |
-	     x400-extension-physical-delivery-address-components |
-	     x400-unformatted-postal-address |
-	     x400-street-address |
-	     x400-post-office-box-address |
-	     x400-poste-restante-address |
-	     x400-unique-postal-name |
-	     x400-local-postal-attributes |
-	     x400-extended-network-address |
-	     x400-terminal-type |
-	     x400-teletex-domain-defined-attributes }
-
--- Extension types and attribute values
-
-x400-common-name  EXTENSION-ATTRIBUTE-CLASS ::= {
-       ID common-name
-       TYPE CommonName }
-
-x400-teletex-common-name  EXTENSION-ATTRIBUTE-CLASS ::= {
-			  ID teletex-common-name
-			  TYPE TeletexCommonName }
-
-x400-teletex-personal-name  EXTENSION-ATTRIBUTE-CLASS ::= {
-			    ID teletex-personal-name
-			    TYPE TeletexPersonalName }
-
-x400-pds-name  EXTENSION-ATTRIBUTE-CLASS ::= {
-	       ID pds-name
-	       TYPE PDSName }
-
-x400-physical-delivery-country-name EXTENSION-ATTRIBUTE-CLASS ::= {
-				    ID physical-delivery-country-name
-				    TYPE PhysicalDeliveryCountryName }
-
-x400-postal-code  EXTENSION-ATTRIBUTE-CLASS ::= {
-		  ID postal-code
-		  TYPE PostalCode }
-
-x400-physical-delivery-office-name EXTENSION-ATTRIBUTE-CLASS ::= { 
-				   ID physical-delivery-office-name 
-				   TYPE PhysicalDeliveryOfficeName }
-
-x400-physical-delivery-office-number EXTENSION-ATTRIBUTE-CLASS ::= {
-				     ID physical-delivery-office-number
-				     TYPE PhysicalDeliveryOfficeNumber }
-
-x400-extension-OR-address-components EXTENSION-ATTRIBUTE-CLASS ::= {
-				     ID extension-OR-address-components
-				     TYPE ExtensionORAddressComponents }
-
-x400-physical-delivery-personal-name EXTENSION-ATTRIBUTE-CLASS ::= {
-				     ID physical-delivery-personal-name
-				     TYPE PhysicalDeliveryPersonalName }
-
-x400-physical-delivery-organization-name  EXTENSION-ATTRIBUTE-CLASS ::= {
-       ID physical-delivery-organization-name
-       TYPE PhysicalDeliveryOrganizationName }
-
-x400-extension-physical-delivery-address-components 
-    EXTENSION-ATTRIBUTE-CLASS ::= {
-       ID extension-physical-delivery-address-components
-       TYPE ExtensionPhysicalDeliveryAddressComponents }
-
-x400-unformatted-postal-address  EXTENSION-ATTRIBUTE-CLASS ::= {
-				 ID unformatted-postal-address
-				 TYPE UnformattedPostalAddress }
-
-x400-street-address  EXTENSION-ATTRIBUTE-CLASS ::= {
-		     ID street-address
-		     TYPE StreetAddress }
-
-x400-post-office-box-address  EXTENSION-ATTRIBUTE-CLASS ::= {
-			      ID post-office-box-address
-			      TYPE PostOfficeBoxAddress }
-
-x400-poste-restante-address EXTENSION-ATTRIBUTE-CLASS ::= {
-			    ID poste-restante-address
-			    TYPE PosteRestanteAddress }
-
-x400-unique-postal-name EXTENSION-ATTRIBUTE-CLASS ::= {
-			ID unique-postal-name
-			TYPE UniquePostalName }
-
-x400-local-postal-attributes EXTENSION-ATTRIBUTE-CLASS ::= {
-			      ID local-postal-attributes
-			      TYPE LocalPostalAttributes }
-
-x400-extended-network-address EXTENSION-ATTRIBUTE-CLASS ::= {
-       ID extended-network-address
-       TYPE ExtendedNetworkAddress }
-
-x400-terminal-type  EXTENSION-ATTRIBUTE-CLASS ::= {
-		    ID terminal-type
-		    TYPE TerminalType }
-
-x400-teletex-domain-defined-attributes  EXTENSION-ATTRIBUTE-CLASS ::= {
-       ID teletex-domain-defined-attributes
-       TYPE TeletexDomainDefinedAttributes }
-
--- Extensions
-
-SSLExtensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension
-
-EXTENSION-CLASS ::= CLASS {
-	&id OBJECT IDENTIFIER UNIQUE,
-	&Type OPTIONAL}
-   WITH SYNTAX {
-	ID &id
-	[TYPE &Type] }
-
-SSLExtension ::=  SEQUENCE {
-        extnID	  EXTENSION-CLASS.&id({SupportedExtensions}),
-	critical  BOOLEAN DEFAULT FALSE,
-        extnValue EXTENSION-CLASS.&Type({SupportedExtensions}{@extnID}) }
-
--- The following is needed for conversion between Extension and Extension-Cd
-
-ObjId ::= OBJECT IDENTIFIER
-Boolean ::= BOOLEAN
-Any ::= ANY
-
-Extension-Any  ::=  SEQUENCE  {
-     extnID      OBJECT IDENTIFIER,
-     critical    BOOLEAN DEFAULT FALSE,
-     extnValue   ANY }
-
-SupportedExtensions EXTENSION-CLASS ::= { authorityKeyIdentifier |
-	subjectKeyIdentifier | keyUsage | privateKeyUsagePeriod |
-	certificatePolicies | policyMappings | subjectAltName | 
-	issuerAltName | subjectDirectoryAttributes | basicConstraints |
-	nameConstraints | policyConstraints | cRLDistributionPoints | 
-	extKeyUsage | inhibitAnyPolicy | freshestCRL | authorityInfoAccess |
-	subjectInfoAccess | cRLNumber | issuingDistributionPoint |
-	deltaCRLIndicator | cRLReasons | certificateIssuer |
-	holdInstructionCode | invalidityDate }
-
-authorityKeyIdentifier EXTENSION-CLASS ::= {
-		ID id-ce-authorityKeyIdentifier
-		TYPE AuthorityKeyIdentifier }
-
-subjectKeyIdentifier EXTENSION-CLASS ::= {
-	ID id-ce-subjectKeyIdentifier
-	TYPE SubjectKeyIdentifier }
-
-keyUsage EXTENSION-CLASS ::= {
-	ID id-ce-keyUsage 
-	TYPE KeyUsage }
-
-privateKeyUsagePeriod EXTENSION-CLASS ::= {
-	ID id-ce-privateKeyUsagePeriod
-	TYPE PrivateKeyUsagePeriod }
-
-certificatePolicies EXTENSION-CLASS ::= {
-	ID id-ce-certificatePolicies
-	TYPE CertificatePolicies }
-
-policyMappings EXTENSION-CLASS ::= {
-	ID id-ce-policyMappings
-	TYPE PolicyMappings }
-
-subjectAltName EXTENSION-CLASS ::= {
-	ID id-ce-subjectAltName 
-	TYPE SubjectAltName }
-
-issuerAltName EXTENSION-CLASS ::= {
-	ID id-ce-issuerAltName
-	TYPE IssuerAltName }
-
-subjectDirectoryAttributes EXTENSION-CLASS ::= {
-	ID id-ce-subjectDirectoryAttributes
-	TYPE SubjectDirectoryAttributes }
-
-basicConstraints EXTENSION-CLASS ::= {
-	ID id-ce-basicConstraints
-	TYPE BasicConstraints }
-
-nameConstraints EXTENSION-CLASS ::= {
-	ID id-ce-nameConstraints
-	TYPE NameConstraints }
-
-policyConstraints EXTENSION-CLASS ::= {
-	ID id-ce-policyConstraints 
-	TYPE PolicyConstraints  }
-
-cRLDistributionPoints EXTENSION-CLASS ::= {
-	ID id-ce-cRLDistributionPoints
-	TYPE CRLDistributionPoints }
-
-extKeyUsage EXTENSION-CLASS ::= {
-	ID id-ce-extKeyUsage
-	TYPE ExtKeyUsageSyntax }
-
-inhibitAnyPolicy EXTENSION-CLASS ::= {
-	ID id-ce-inhibitAnyPolicy 
-	TYPE InhibitAnyPolicy }
-
-freshestCRL EXTENSION-CLASS ::= {
-	ID id-ce-freshestCRL
-	TYPE FreshestCRL }
-
-authorityInfoAccess EXTENSION-CLASS ::= {
-	ID id-pe-authorityInfoAccess
-	TYPE AuthorityInfoAccessSyntax }
-
-subjectInfoAccess EXTENSION-CLASS ::= {
-	ID id-pe-subjectInfoAccess 
-	TYPE SubjectInfoAccessSyntax }
-
-cRLNumber EXTENSION-CLASS ::= {
-	ID id-ce-cRLNumber 
-	TYPE CRLNumber }
-
-issuingDistributionPoint EXTENSION-CLASS ::= {
-	ID id-ce-issuingDistributionPoint
-	TYPE IssuingDistributionPoint }
-
-deltaCRLIndicator EXTENSION-CLASS ::= {
-	ID id-ce-deltaCRLIndicator
-	TYPE BaseCRLNumber }
-
-cRLReasons EXTENSION-CLASS ::= {
-	ID id-ce-cRLReasons
-	TYPE CRLReason }
-
-certificateIssuer EXTENSION-CLASS ::= {
-	ID id-ce-certificateIssuer
-	TYPE CertificateIssuer }
-
-holdInstructionCode EXTENSION-CLASS ::= {
-	ID id-ce-holdInstructionCode
-	TYPE HoldInstructionCode }
-
-invalidityDate EXTENSION-CLASS ::= {
-	ID id-ce-invalidityDate 
-	TYPE InvalidityDate }
-
-END
diff --git a/lib/ssl/pkix/mk_ssl_pkix_oid.erl b/lib/ssl/pkix/mk_ssl_pkix_oid.erl
deleted file mode 100644
index 06edc5113a..0000000000
--- a/lib/ssl/pkix/mk_ssl_pkix_oid.erl
+++ /dev/null
@@ -1,94 +0,0 @@
--module(mk_ssl_pkix_oid).
-
--export([make/0]).
-
--define(PKIX_MODULES, ['OTP-PKIX']).
-
-make() ->
-    {ok, Fd} = file:open("ssl_pkix_oid.erl", [write]),
-    io:fwrite(Fd, "%%% File: ssl_pkix_oid.erl\n"
-	      "%%% NB This file has been automatically generated by "
-	      "mk_ssl_pkix_oid.\n"
-	      "%%% Do not edit it.\n\n", []),
-    io:fwrite(Fd, "-module(ssl_pkix_oid).\n", []),
-    io:fwrite(Fd, "-export([id2atom/1, atom2id/1, all_atoms/0, "
-	      "all_ids/0]).\n\n", []),
-
-
-    AIds0 = get_atom_ids(?PKIX_MODULES),
-
-    AIds1 = modify_atoms(AIds0),
-    gen_id2atom(Fd, AIds1),
-    gen_atom2id(Fd, AIds1),
-    gen_all(Fd, AIds1),
-    file:close(Fd).
-
-get_atom_ids(Ms) ->
-    get_atom_ids(Ms, []).
-
-get_atom_ids([], AIdss) ->
-    lists:flatten(AIdss);
-get_atom_ids([M| Ms], AIdss) ->
-    {value, {exports, Exports}} = 
-	lists:keysearch(exports, 1, M:module_info()),
-    As = lists:zf(
-	   fun ({info, 0}) -> false;
-	       ({module_info, 0}) -> false;
-	       ({encoding_rule, 0}) -> false;
-	       ({F, 0}) -> 
-		   case atom_to_list(F) of
-		   %% Remove upper-bound (ub-) functions
-		       "ub-" ++ _Rest ->
-			   false;
-		       _ ->
-			   {true, F}
-		   end;
-	       (_) -> false 
-	   end, Exports),
-    AIds = lists:map(fun(F) -> {F, M:F()} end, As),
-    get_atom_ids(Ms, [AIds| AIdss]).
-
-modify_atoms(AIds) ->
-    F = fun({A, I}) ->
-		NAS = case atom_to_list(A) of
-			  "id-" ++ Rest ->
-			      Rest;
-			  Any ->
-			      Any
-		      end,
-		{list_to_atom(NAS), I} end,
-    lists:map(F, AIds). 
-
-gen_id2atom(Fd, AIds0) ->
-    AIds1 = lists:keysort(2, AIds0),
-    Txt = join(";\n", 
-	       lists:map(
-		 fun({Atom, Id}) ->
-			 io_lib:fwrite("id2atom(~p) ->\n    ~p", [Id, Atom]) 
-		 end, AIds1)),
-    io:fwrite(Fd, "~s;\nid2atom(Any)->\n    Any.\n\n", [Txt]).
-
-gen_atom2id(Fd, AIds0) ->
-    AIds1 = lists:keysort(1, AIds0),
-    Txt = join(";\n", 
-	       lists:map(
-		 fun({Atom, Id}) ->
-			 io_lib:fwrite("atom2id(~p) ->\n    ~p", [Atom, Id]) 
-		 end, AIds1)),
-    io:fwrite(Fd, "~s;\natom2id(Any)->\n    Any.\n\n", [Txt]).
-
-gen_all(Fd, AIds) ->
-    Atoms = lists:sort([A || {A, _} <- AIds]),
-    Ids = lists:sort([I || {_, I} <- AIds]),
-    F = fun(X) -> io_lib:fwrite("    ~w", [X]) end,
-    ATxt = "all_atoms() ->\n" ++ join(",\n", lists:map(F, Atoms)),
-    io:fwrite(Fd, "~s.\n\n", [ATxt]),
-    ITxt = "all_ids() ->\n" ++ 	join(",\n", lists:map(F, Ids)),
-    io:fwrite(Fd, "~s.\n\n", [ITxt]).
-
-join(Sep, [H1, H2| T]) ->
-    [H1, Sep| join(Sep, [H2| T])]; 
-join(_Sep, [H1]) ->
-    H1;
-join(_, []) ->
-    [].
diff --git a/lib/ssl/pkix/prebuild.skip b/lib/ssl/pkix/prebuild.skip
deleted file mode 100644
index ffe82be68b..0000000000
--- a/lib/ssl/pkix/prebuild.skip
+++ /dev/null
@@ -1,5 +0,0 @@
-PKIX1Algorithms88.asn1db
-PKIXAttributeCertificate.asn1db
-PKIX1Explicit88.asn1db
-SSL-PKIX.asn1db
-PKIX1Implicit88.asn1db
diff --git a/lib/ssl/src/Makefile b/lib/ssl/src/Makefile
index fabf8a4e0d..7514ad2aa2 100644
--- a/lib/ssl/src/Makefile
+++ b/lib/ssl/src/Makefile
@@ -1,19 +1,19 @@
 #
 # %CopyrightBegin%
-# 
-# Copyright Ericsson AB 1999-2009. All Rights Reserved.
-# 
+#
+# Copyright Ericsson AB 1999-2010. All Rights Reserved.
+#
 # The contents of this file are subject to the Erlang Public License,
 # Version 1.1, (the "License"); you may not use this file except in
 # compliance with the License. You should have received a copy of the
 # Erlang Public License along with this software. If not, it can be
 # retrieved online at http://www.erlang.org/.
-# 
+#
 # Software distributed under the License is distributed on an "AS IS"
 # basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 # the License for the specific language governing rights and limitations
 # under the License.
-# 
+#
 # %CopyrightEnd%
 #
 
@@ -46,9 +46,6 @@ MODULES= \
 	ssl_server \
 	ssl_sup \
 	ssl_prim \
-	ssl_pkix \
-	ssl_pem	\
-	ssl_base64 \
 	inet_ssl_dist \
 	ssl_certificate\
 	ssl_certificate_db\
@@ -71,8 +68,6 @@ INTERNAL_HRL_FILES = \
 	 ssl_alert.hrl ssl_cipher.hrl ssl_handshake.hrl ssl_internal.hrl \
 	 ssl_record.hrl
 
-PUBLIC_HRL_FILES = ssl_pkix.hrl 
-
 ERL_FILES= $(MODULES:%=%.erl)
 
 TARGET_FILES= $(MODULES:%=$(EBIN)/%.$(EMULATOR))
@@ -85,15 +80,12 @@ APP_TARGET= $(EBIN)/$(APP_FILE)
 APPUP_SRC= $(APPUP_FILE).src
 APPUP_TARGET= $(EBIN)/$(APPUP_FILE)
 
-INCLUDE = ../include
-
 # ----------------------------------------------------
 # FLAGS
 # ----------------------------------------------------
 EXTRA_ERLC_FLAGS = +warn_unused_vars
 ERL_COMPILE_FLAGS += -I$(ERL_TOP)/lib/kernel/src \
 	-pz $(ERL_TOP)/lib/public_key/ebin \
-	-I$(INCLUDE) \
 	$(EXTRA_ERLC_FLAGS) -DVSN=\"$(VSN)\"
 
 
@@ -101,7 +93,7 @@ ERL_COMPILE_FLAGS += -I$(ERL_TOP)/lib/kernel/src \
 # Targets
 # ----------------------------------------------------
 
-debug opt: $(TARGET_FILES) $(APP_TARGET) $(APPUP_TARGET) $(PUBLIC_HRL_FILES)
+debug opt: $(TARGET_FILES) $(APP_TARGET) $(APPUP_TARGET) 
 
 clean:
 	rm -f $(TARGET_FILES) $(APP_TARGET) $(APPUP_TARGET) 
@@ -113,9 +105,6 @@ $(APP_TARGET):	$(APP_SRC) ../vsn.mk
 $(APPUP_TARGET):	$(APPUP_SRC) ../vsn.mk
 	sed -e 's;%VSN%;$(VSN);' $< > $@
 
-$(PUBLIC_HRL_FILES):
-	cp -f $(PUBLIC_HRL_FILES) $(INCLUDE)
-
 docs:
 
 # ----------------------------------------------------
@@ -126,8 +115,6 @@ include $(ERL_TOP)/make/otp_release_targets.mk
 release_spec: opt
 	$(INSTALL_DIR) $(RELSYSDIR)/src
 	$(INSTALL_DATA) $(ERL_FILES) $(INTERNAL_HRL_FILES) $(RELSYSDIR)/src
-	$(INSTALL_DIR) $(RELSYSDIR)/include
-	$(INSTALL_DATA) $(PUBLIC_HRL_FILES) $(RELSYSDIR)/include
 	$(INSTALL_DIR) $(RELSYSDIR)/ebin
 	$(INSTALL_DATA) $(TARGET_FILES) $(APP_TARGET) \
 	$(APPUP_TARGET) $(RELSYSDIR)/ebin
diff --git a/lib/ssl/src/ssl.app.src b/lib/ssl/src/ssl.app.src
index 2a7d451341..b9716786e6 100644
--- a/lib/ssl/src/ssl.app.src
+++ b/lib/ssl/src/ssl.app.src
@@ -7,10 +7,6 @@
 	       ssl_server,
 	       ssl_broker,
 	       ssl_broker_sup,
-	       ssl_base64,
-	       ssl_pem,
-	       ssl_pkix,
-	       ssl_pkix_oid,
 	       ssl_prim,
 	       inet_ssl_dist,
 	       ssl_tls1,
@@ -28,11 +24,10 @@
 	       ssl_cipher,
 	       ssl_certificate_db,
 	       ssl_certificate,
-	       ssl_alert,
-	       'OTP-PKIX'
+	       ssl_alert
 	       ]},
     {registered, [ssl_sup, ssl_server, ssl_broker_sup]},
-    {applications, [kernel, stdlib]},
+    {applications, [crypto, public_key, kernel, stdlib]},
     {env, []},
     {mod, {ssl_app, []}}]}.
 
diff --git a/lib/ssl/src/ssl.appup.src b/lib/ssl/src/ssl.appup.src
index 52a41617bb..65f23e2f74 100644
--- a/lib/ssl/src/ssl.appup.src
+++ b/lib/ssl/src/ssl.appup.src
@@ -1,6 +1,7 @@
 %% -*- erlang -*-
 {"%VSN%",
  [
+  {"3.11.1", [{restart_application, ssl}]},
   {"3.11", [{restart_application, ssl}]},			
   {"3.10", [{restart_application, ssl}]},			
   {"3.10.1", [{restart_application, ssl}]},
@@ -14,6 +15,7 @@
   {"3.10.9", [{restart_application, ssl}]}
  ], 
  [
+  {"3.11.1", [{restart_application, ssl}]},
   {"3.11", [{restart_application, ssl}]},			
   {"3.10", [{restart_application, ssl}]},	
   {"3.10.1", [{restart_application, ssl}]},		
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 185a1f755a..000ceb241e 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -39,6 +39,8 @@
 -include("ssl_internal.hrl").
 -include("ssl_record.hrl").
 
+-include_lib("public_key/include/public_key.hrl"). 
+
 -record(config, {ssl,               %% SSL parameters
 		 inet_user,         %% User set inet options
 		 emulated,          %% #socket_option{} emulated
@@ -50,15 +52,18 @@
 %% Function: start([, Type]) -> ok
 %%
 %%  Type =  permanent | transient | temporary
-%%  Vsns = [Vsn] 
-%%  Vsn = ssl3 | tlsv1 | 'tlsv1.1'
 %%
 %% Description: Starts the ssl application. Default type
 %% is temporary. see application(3)
 %%--------------------------------------------------------------------
 start() ->
+    application:start(crypto),
+    application:start(public_key),
     application:start(ssl).
+
 start(Type) ->
+    application:start(crypto, Type),
+    application:start(public_key, Type),
     application:start(ssl, Type).
 
 %%--------------------------------------------------------------------
@@ -123,7 +128,7 @@ connect(Address, Port, Options0, Timeout) ->
 listen(_Port, []) ->
     {error, enooptions};
 listen(Port, Options0) ->
-    case proplists:get_value(ssl_imp, Options0, old) of
+    case proplists:get_value(ssl_imp, Options0, new) of
 	new ->
 	    new_listen(Port, Options0);
 	old ->
@@ -293,14 +298,7 @@ peercert(#sslsocket{pid = Pid, fd = new_ssl}, Opts) ->
 	{ok, undefined} ->
 	    {error, no_peercert};
         {ok, BinCert} ->
-	    PKOpts = [case Opt of ssl -> otp; pkix -> plain end || 
-			 Opt <- Opts, Opt =:= ssl orelse Opt =:= pkix],
-	    case PKOpts of
-		[Opt] ->
-		    public_key:pkix_decode_cert(BinCert, Opt);
-		[] ->
-		    {ok, BinCert}
-	    end;
+	    decode_peercert(BinCert, Opts);
         {error, Reason}  ->
             {error, Reason}
     end;
@@ -309,11 +307,40 @@ peercert(#sslsocket{} = Socket, Opts) ->
     ensure_old_ssl_started(),
     case ssl_broker:peercert(Socket) of
         {ok, Bin} ->
-            ssl_pkix:decode_cert(Bin, Opts);
+	    decode_peercert(Bin, Opts);
         {error, Reason}  ->
             {error, Reason}
     end.
 
+
+decode_peercert(BinCert, Opts) ->
+    PKOpts = [case Opt of ssl -> otp; pkix -> plain end || 
+		 Opt <- Opts, Opt =:= ssl orelse Opt =:= pkix],
+    case PKOpts of
+	[Opt] ->
+	    select_part(Opt, public_key:pkix_decode_cert(BinCert, Opt), Opts);
+	[] ->
+	    {ok, BinCert}
+    end.
+
+select_part(otp, {ok, Cert}, Opts) ->
+    case lists:member(subject, Opts) of 
+	true ->
+	    TBS = Cert#'OTPCertificate'.tbsCertificate,
+	    {ok, TBS#'OTPTBSCertificate'.subject};
+	false ->
+	    {ok, Cert}
+    end;
+
+select_part(plain, {ok, Cert}, Opts) ->
+    case lists:member(subject, Opts) of 
+	true ->
+	    TBS = Cert#'Certificate'.tbsCertificate,
+	    {ok,  TBS#'TBSCertificate'.subject};
+	false ->
+	    {ok, Cert}
+    end.
+
 %%--------------------------------------------------------------------
 %% Function: peername(Socket) -> {ok, {Address, Port}} | {error, Reason}
 %%
diff --git a/lib/ssl/src/ssl_base64.erl b/lib/ssl/src/ssl_base64.erl
deleted file mode 100644
index cfc42407e8..0000000000
--- a/lib/ssl/src/ssl_base64.erl
+++ /dev/null
@@ -1,129 +0,0 @@
-%%
-%% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 2003-2009. All Rights Reserved.
-%% 
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
-%% 
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
-%% 
-%% %CopyrightEnd%
-%%
-
-%%
-
-%%% Purpose : Base 64 encoding and decoding.
-
--module(ssl_base64).
-
--export([encode/1, encode_split/1, decode/1, join_decode/1]).
-
--define(st(X,A), ((X-A+256) div 256)).
--define(CHARS, 64).
-
-%% A PEM encoding consists of characters A-Z, a-z, 0-9, +, / and
-%% =. Each character encodes a 6 bits value from 0 to 63 (A = 0, / =
-%% 63); = is a padding character.
-%%
-
-%%
-%% encode(Bytes|Binary) -> Chars
-%%
-%% Take 3 bytes a time (3 x 8 = 24 bits), and make 4 characters out of
-%% them (4 x 6 = 24 bits).
-%%
-encode(Bs) when is_list(Bs) ->
-    encode(list_to_binary(Bs));
-encode(<<B:3/binary, Bs/binary>>) ->
-    <<C1:6, C2:6, C3:6, C4:6>> = B,
-    [enc(C1), enc(C2), enc(C3), enc(C4)| encode(Bs)];
-encode(<<B:2/binary>>) ->
-    <<C1:6, C2:6, C3:6, _:6>> = <<B/binary, 0>>,
-    [enc(C1), enc(C2), enc(C3), $=];
-encode(<<B:1/binary>>) ->
-    <<C1:6, C2:6, _:12>> = <<B/binary, 0, 0>>,
-    [enc(C1), enc(C2), $=, $=];
-encode(<<>>) ->
-    [].
-
-%% 
-%% encode_split(Bytes|Binary) -> Lines
-%%
-%% The encoding is divided into lines separated by <NL>, and each line
-%% is precisely 64 characters long (excluding the <NL> characters,
-%% except the last line which 64 characters long or shorter. <NL> may
-%% follow the last line.
-%% 
-encode_split(Bs) ->
-    split(encode(Bs)).
-
-%%
-%% decode(Chars) -> Binary
-%%
-decode(Cs) ->
-    list_to_binary(decode1(Cs)).
-
-decode1([C1, C2, $=, $=]) ->
-    <<B1, _:16>> = <<(dec(C1)):6, (dec(C2)):6, 0:12>>, 
-    [B1];
-decode1([C1, C2, C3, $=]) ->
-    <<B1, B2, _:8>> = <<(dec(C1)):6, (dec(C2)):6, (dec(C3)):6, (dec(0)):6>>, 
-    [B1, B2];
-decode1([C1, C2, C3, C4| Cs]) ->
-    Bin = <<(dec(C1)):6, (dec(C2)):6, (dec(C3)):6, (dec(C4)):6>>, 
-    [Bin| decode1(Cs)];
-decode1([]) ->
-    [].
-
-%% 
-%% join_decode(Lines) -> Binary
-%%
-%% Remove <NL> before decoding.
-%%
-join_decode(Cs) ->    
-    decode(join(Cs)).
-
-%% 
-%% Locals
-%%    
-
-%% enc/1 and dec/1
-%%
-%% Mapping: 0-25 -> A-Z, 26-51 -> a-z, 52-61 -> 0-9, 62 -> +, 63 -> /
-%%
-enc(C) ->
-    65 + C + 6*?st(C,26) - 75*?st(C,52) -15*?st(C,62) + 3*?st(C,63).
-
-dec(C) ->
-    62*?st(C,43) + ?st(C,47) + (C-59)*?st(C,48) - 69*?st(C,65) - 6*?st(C,97).
-
-%% split encoding into lines
-%%
-split(Cs) ->
-    split(Cs, ?CHARS).
-
-split([], _N) ->
-    [$\n];
-split(Cs, 0) ->
-    [$\n| split(Cs, ?CHARS)];
-split([C| Cs], N) ->
-    [C| split(Cs, N-1)].
-
-%% join lines of encodings
-%%
-join([$\r, $\n| Cs]) ->
-    join(Cs);
-join([$\n| Cs]) ->
-    join(Cs);
-join([C| Cs]) ->
-    [C| join(Cs)];
-join([]) ->
-    [].
-
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index abd1b59011..07fa101ed4 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -125,8 +125,12 @@ recv(Pid, Length, Timeout) ->
 %% Description: Connect to a ssl server.
 %%--------------------------------------------------------------------
 connect(Host, Port, Socket, Options, User, CbInfo, Timeout) ->
-    start_fsm(client, Host, Port, Socket, Options, User, CbInfo,
-	      Timeout).
+    try start_fsm(client, Host, Port, Socket, Options, User, CbInfo,
+		  Timeout)
+    catch
+	exit:{noproc, _} ->
+	    {error, ssl_not_started}
+    end.
 %%--------------------------------------------------------------------
 %% Function: accept(Port, Socket, Opts, User, 
 %%                  CbInfo, Timeout) -> {ok, Socket} | {error, Reason}
@@ -135,8 +139,12 @@ connect(Host, Port, Socket, Options, User, CbInfo, Timeout) ->
 %%              ssl handshake. 
 %%--------------------------------------------------------------------
 ssl_accept(Port, Socket, Opts, User, CbInfo, Timeout) ->
-    start_fsm(server, "localhost", Port, Socket, Opts, User, 
-	      CbInfo, Timeout).
+    try start_fsm(server, "localhost", Port, Socket, Opts, User, 
+		  CbInfo, Timeout)
+    catch
+	exit:{noproc, _} ->
+	    {error, ssl_not_started}
+    end.	
 
 %%--------------------------------------------------------------------
 %% Function: handshake(SslSocket, Timeout) -> ok | {error, Reason}
@@ -1492,15 +1500,15 @@ handle_server_key(
     SecParams = ConnectionState#connection_state.security_parameters,
     #security_parameters{client_random = ClientRandom,
 			 server_random = ServerRandom} = SecParams, 
-    Plain = ssl_handshake:server_key_exchange_plain(KeyAlgo,
-						    <<ClientRandom/binary, 
+    Hash = ssl_handshake:server_key_exchange_hash(KeyAlgo,
+						  <<ClientRandom/binary, 
 						   ServerRandom/binary, 
-						     ?UINT16(PLen), P/binary, 
-						     ?UINT16(GLen), G/binary,
-						     ?UINT16(YLen),
+						   ?UINT16(PLen), P/binary, 
+						   ?UINT16(GLen), G/binary,
+						   ?UINT16(YLen),
 						   ServerPublicDhKey/binary>>),
-   
-    case verify_dh_params(Signed, Plain, PubKeyInfo) of
+    
+    case verify_dh_params(Signed, Hash, PubKeyInfo) of
 	true ->
 	    PMpint = mpint_binary(P),
 	    GMpint = mpint_binary(G),	
@@ -1533,8 +1541,8 @@ verify_dh_params(Signed, Hashes, {?rsaEncryption, PubKey, _PubKeyParams}) ->
 	_ ->
 	    false
     end;
-verify_dh_params(Signed, Plain, {?'id-dsa', PublicKey, PublicKeyParams}) ->
-    public_key:verify_signature(Plain, sha, Signed, PublicKey, PublicKeyParams). 
+verify_dh_params(Signed, Hash, {?'id-dsa', PublicKey, PublicKeyParams}) ->
+    public_key:verify_signature(Hash, none, Signed, PublicKey, PublicKeyParams). 
 
 
 encode_alert(#alert{} = Alert, Version, ConnectionStates) ->
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index c8245e2fb4..f7e3e392ec 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -35,7 +35,7 @@
 	 hello_request/0, certify/7, certificate/3, 
 	 client_certificate_verify/6, 
 	 certificate_verify/6, certificate_request/2,
-	 key_exchange/2, server_key_exchange_plain/2,  finished/4,
+	 key_exchange/2, server_key_exchange_hash/2,  finished/4,
 	 verify_connection/5, 
 	 get_tls_handshake/4,
 	 server_hello_done/0, sig_alg/1,
@@ -371,13 +371,13 @@ key_exchange(server, {dh, {<<?UINT32(Len), PublicKey:Len/binary>>, _},
     YLen = byte_size(PublicKey),
     ServerDHParams = #server_dh_params{dh_p = PBin, 
 				       dh_g = GBin, dh_y = PublicKey},    
-    Plain = 
-	server_key_exchange_plain(KeyAlgo, <<ClientRandom/binary, 
+    Hash = 
+	server_key_exchange_hash(KeyAlgo, <<ClientRandom/binary, 
 					    ServerRandom/binary, 
 					    ?UINT16(PLen), PBin/binary, 
 					    ?UINT16(GLen), GBin/binary,
 					    ?UINT16(YLen), PublicKey/binary>>),
-    Signed = digitally_signed(Plain, PrivateKey),
+    Signed = digitally_signed(Hash, PrivateKey),
     #server_key_exchange{params = ServerDHParams,
 			 signed_params = Signed}.
 
@@ -1087,12 +1087,12 @@ certificate_authorities_from_db(CertDbRef, PrevKey, Acc) ->
 	    certificate_authorities_from_db(CertDbRef, Key, Acc)
     end.
 
-digitally_signed(Hashes, #'RSAPrivateKey'{} = Key) ->
-    public_key:encrypt_private(Hashes, Key,
+digitally_signed(Hash, #'RSAPrivateKey'{} = Key) ->
+    public_key:encrypt_private(Hash, Key,
 			       [{rsa_pad, rsa_pkcs1_padding}]);
-digitally_signed(Plain, #'DSAPrivateKey'{} = Key) ->
-    public_key:sign(Plain, Key).
-
+digitally_signed(Hash, #'DSAPrivateKey'{} = Key) ->
+    public_key:sign(none, Hash, Key).
+    
 calc_master_secret({3,0}, PremasterSecret, ClientRandom, ServerRandom) ->
     ssl_ssl3:master_secret(PremasterSecret, ClientRandom, ServerRandom);
 
@@ -1122,15 +1122,14 @@ calc_certificate_verify({3, N}, _, Algorithm, Hashes)
   when  N == 1; N == 2 ->
     ssl_tls1:certificate_verify(Algorithm, Hashes).
 
-server_key_exchange_plain(Algorithm, Value) when Algorithm == rsa;
+server_key_exchange_hash(Algorithm, Value) when Algorithm == rsa;
  						Algorithm == dhe_rsa ->
     MD5 = crypto:md5(Value),     
     SHA =  crypto:sha(Value), 
     <<MD5/binary, SHA/binary>>;
 
-server_key_exchange_plain(dhe_dss, Value) ->
-    %% Hash will be done by crypto.
-    Value.
+server_key_exchange_hash(dhe_dss, Value) ->
+    crypto:sha(Value).
 
 sig_alg(dh_anon) ->
     ?SIGNATURE_ANONYMOUS;
diff --git a/lib/ssl/src/ssl_pem.erl b/lib/ssl/src/ssl_pem.erl
deleted file mode 100644
index 0a1bf0f32a..0000000000
--- a/lib/ssl/src/ssl_pem.erl
+++ /dev/null
@@ -1,147 +0,0 @@
-%%
-%% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 2003-2009. All Rights Reserved.
-%% 
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
-%% 
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
-%% 
-%% %CopyrightEnd%
-%%
-
-%%
-
--module(ssl_pem).
-
-%%% Purpose: Reading and writing of PEM type encoded files for SSL.
-
-%% NB write_file/2 is only preliminary.
-
-%% PEM encoded files have the following structure:
-%%
-%%	<text>
-%%	-----BEGIN SOMETHING-----<CR><LF>
-%%	<Base64 encoding line><CR><LF>
-%%	<Base64 encoding line><CR><LF>
-%%	...
-%%	-----END SOMETHING-----<CR><LF>
-%%	<text>
-%%
-%% A file can contain several BEGIN/END blocks. Text lines between
-%% blocks are ignored.
-
--export([read_file/1, read_file/2, write_file/2]).
-
-%% Read a PEM file and return each decoding as a binary. 
-
-read_file(File) ->
-    read_file(File, no_passwd).
-
-read_file(File, Passwd) ->
-    {ok, Fd} = file:open(File, [read]),
-    Result = decode_file(Fd, Passwd),
-    file:close(Fd),
-    Result.
-
-decode_file(Fd, Passwd) ->
-    decode_file(Fd, [], [], notag, [Passwd]).
-
-decode_file(Fd, _RLs, Ens, notag, Info) ->
-    case io:get_line(Fd, "") of
-	"-----BEGIN CERTIFICATE REQUEST-----" ++ _ ->
-	    decode_file(Fd, [], Ens, cert_req, Info);
-	"-----BEGIN CERTIFICATE-----" ++ _ ->
-	    decode_file(Fd, [], Ens, cert, Info);
-	"-----BEGIN RSA PRIVATE KEY-----" ++ _ ->
-	    decode_file(Fd, [], Ens, rsa_private_key, Info);
-	eof ->
-	    {ok, lists:reverse(Ens)};
-	_ ->
-	    decode_file(Fd, [], Ens, notag, Info)
-    end;
-decode_file(Fd, RLs, Ens, Tag, Info0) ->
-    case io:get_line(Fd, "") of
-	"Proc-Type: 4,ENCRYPTED"++_ ->
-	    Info = dek_info(Fd, Info0),
-	    decode_file(Fd, RLs, Ens, Tag, Info);
-	"-----END" ++ _ ->			% XXX sloppy
-	    Cs = lists:flatten(lists:reverse(RLs)),
-	    Bin = ssl_base64:join_decode(Cs),
-	    case Info0 of
-		[Password, Cipher, SaltHex | Info1] ->
-		    Decoded = decode_key(Bin, Password, Cipher, unhex(SaltHex)),
-		    decode_file(Fd, [], [{Tag, Decoded}| Ens], notag, Info1);
-		_ ->
-		    decode_file(Fd, [], [{Tag, Bin}| Ens], notag, Info0)
-	    end;
-	eof ->
-	    {ok, lists:reverse(Ens)};
-	L ->
-	    decode_file(Fd, [L|RLs], Ens, Tag, Info0)
-    end.
-
-dek_info(Fd, Info) ->
-    Line = io:get_line(Fd, ""),
-    [_, DekInfo0] = string:tokens(Line, ": "),
-    DekInfo1 = string:tokens(DekInfo0, ",\n"), 
-    Info ++ DekInfo1.
-
-unhex(S) ->
-    unhex(S, []).
-
-unhex("", Acc) ->
-    lists:reverse(Acc);
-unhex([D1, D2 | Rest], Acc) ->
-    unhex(Rest, [erlang:list_to_integer([D1, D2], 16) | Acc]).
-
-decode_key(Data, Password, "DES-CBC", Salt) ->
-    Key = password_to_key(Password, Salt, 8),
-    IV = Salt,
-    crypto:des_cbc_decrypt(Key, IV, Data);
-decode_key(Data,  Password, "DES-EDE3-CBC", Salt) ->
-    Key = password_to_key(Password, Salt, 24),
-    IV = Salt,
-    <<Key1:8/binary, Key2:8/binary, Key3:8/binary>> = Key,
-    crypto:des_ede3_cbc_decrypt(Key1, Key2, Key3, IV, Data).
-
-write_file(File, Ds) ->
-    file:write_file(File, encode_file(Ds)).
-
-encode_file(Ds) ->
-    [encode_file_1(D) || D <- Ds].
-
-encode_file_1({cert, Bin}) -> 
-    %% PKIX (X.509)
-    ["-----BEGIN CERTIFICATE-----\n",
-     ssl_base64:encode_split(Bin),
-     "-----END CERTIFICATE-----\n\n"];
-encode_file_1({cert_req, Bin}) -> 
-    %% PKCS#10
-    ["-----BEGIN CERTIFICATE REQUEST-----\n",
-     ssl_base64:encode_split(Bin),
-     "-----END CERTIFICATE REQUEST-----\n\n"];
-encode_file_1({rsa_private_key, Bin}) -> 
-    %% PKCS#?
-    ["XXX Following key assumed not encrypted\n",
-     "-----BEGIN RSA PRIVATE KEY-----\n",
-     ssl_base64:encode_split(Bin),
-     "-----END RSA PRIVATE KEY-----\n\n"].
-
-password_to_key(Data, Salt, KeyLen) ->
-    <<Key:KeyLen/binary, _/binary>> = 
-	password_to_key(<<>>, Data, Salt, KeyLen, <<>>),
-    Key.
-
-password_to_key(_, _, _, Len, Acc) when Len =< 0 ->
-    Acc;
-password_to_key(Prev, Data, Salt, Len, Acc) ->
-    M = crypto:md5([Prev, Data, Salt]),
-    password_to_key(M, Data, Salt, Len - byte_size(M), <<Acc/binary, M/binary>>).
diff --git a/lib/ssl/src/ssl_pkix.erl b/lib/ssl/src/ssl_pkix.erl
deleted file mode 100644
index 8f540f74ad..0000000000
--- a/lib/ssl/src/ssl_pkix.erl
+++ /dev/null
@@ -1,307 +0,0 @@
-%%
-%% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 2003-2009. All Rights Reserved.
-%% 
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
-%% 
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
-%% 
-%% %CopyrightEnd%
-%%
-
-%%% Purpose : API module for decoding of certificates.
-
--module(ssl_pkix).
-
--include("ssl_pkix.hrl").
-
--export([decode_cert_file/1, decode_cert_file/2, 
-	 decode_cert/1, decode_cert/2, encode_cert/1, encoded_tbs_cert/1,
-	 signature_digest/1, decode_rsa_keyfile/2]).
-
-%% The public API is dprecated by public_key and
-%% the internal application API is no longer used ssl.
-%% So this file can be compleatly removed in  R14. 
--deprecated({decode_cert_file, 1, next_major_release}).
--deprecated({decode_cert_file, 2, next_major_release}).
--deprecated({decode_cert, 1, next_major_release}).
--deprecated({decode_cert, 2, next_major_release}).
-
-%%====================================================================
-%% API
-%%====================================================================
-
-%%--------------------------------------------------------------------
-%% Function: decode_cert_file(File, <Opts>) -> {ok, Cert} | {ok, [Cert]}
-%%           
-%%  File = string() 
-%%  Opts = [Opt]    
-%%  Opt = pem | ssl | pkix - ssl and pkix are mutual exclusive
-%%  Cert = term()
-%%
-%% Description: Decodes certificats found in file <File>.
-%% If the options list is empty the certificate is
-%% returned as a DER encoded binary, i.e. {ok, Bin} is returned, where
-%% Bin> is the provided input. The options pkix and ssl imply that the
-%% certificate is returned as a parsed ASN.1 structure in the form of
-%% an Erlang term.  The ssl option gives a more elaborate return
-%% structure, with more explicit information. In particular object
-%% identifiers are replaced by atoms. The option subject implies that
-%% only the subject's distinguished name part of the certificate is
-%% returned. It can only be used together with the option pkix or the
-%% option ssl.
-%%--------------------------------------------------------------------
-decode_cert_file(File) ->
-    decode_cert_file(File, []).
-
-decode_cert_file(File, Opts) ->
-    case lists:member(pem, Opts) of
-	true -> 
-	    {ok, List} = ssl_pem:read_file(File),
-	    Certs = [Bin || {cert, Bin} <- List],
-	    NewOpts =  lists:delete(pem, Opts),
-	    Fun = fun(Cert) ->
-			  {ok, Decoded} = decode_cert(Cert, NewOpts),
-			  Decoded
-		  end,
-	    case lists:map(Fun, Certs) of
-		[DecodedCert] ->
-		    {ok, DecodedCert};
-		DecodedCerts ->
-		    {ok, DecodedCerts}
-	    end;
-	false  ->
-	    {ok, Bin} = file:read_file(File),
-	    decode_cert(Bin, Opts)
-    end.
-%%--------------------------------------------------------------------
-%% Function: decode_cert(Bin, <Opts>) -> {ok, Cert}
-%% Bin - binary()           
-%% Opts = [Opt]    
-%% Opt = ssl | pkix | subject - ssl and pkix are mutual exclusive      
-%% Cert = term()
-%% 
-%% Description: If the options list is empty the certificate is
-%% returned as a DER encoded binary, i.e. {ok, Bin} is returned, where
-%% Bin> is the provided input. The options pkix and ssl imply that the
-%% certificate is returned as a parsed ASN.1 structure in the form of
-%% an Erlang term.  The ssl option gives a more elaborate return
-%% structure, with more explicit information. In particular object
-%% identifiers are replaced by atoms. The option subject implies that
-%% only the subject's distinguished name part of the certificate is
-%% returned. It can only be used together with the option pkix or the
-%% option ssl.
-%%--------------------------------------------------------------------
-decode_cert(Bin) ->
-    decode_cert(Bin, []).
-
-decode_cert(Bin, []) when is_binary(Bin) ->
-    {ok, Bin};
-decode_cert(Bin, Opts) when is_binary(Bin) ->
-
-    {ok, Cert} = 'OTP-PKIX':decode('Certificate', Bin), 
-
-    case {lists:member(ssl, Opts), lists:member(pkix, Opts)} of
-	{true, false} ->
-	    cert_return(transform(Cert, ssl), Opts);
-	{false, true} ->
-	    cert_return(transform(Cert, pkix), Opts);
-	_ ->
-	    {error, eoptions} 
-    end.
-
-encode_cert(#'Certificate'{} = Cert) ->
-    {ok, List} = 'OTP-PKIX':encode('Certificate', Cert),
-    list_to_binary(List).
-
-decode_rsa_keyfile(KeyFile, Password) ->
-    {ok, List} = ssl_pem:read_file(KeyFile, Password),
-    [PrivatKey] = [Bin || {rsa_private_key, Bin} <- List],
-    'OTP-PKIX':decode('RSAPrivateKey', PrivatKey).
-
-%%====================================================================
-%%  Application internal API
-%%====================================================================
-
-%%--------------------------------------------------------------------
-%% Function: encoded_tbs_cert(Cert) -> PKXCert 
-%%           
-%% Cert = binary() - Der encoded
-%% PKXCert = binary() - Der encoded
-%%      
-%% Description: Extracts the binary TBSCert from the binary Certificate.
-%%--------------------------------------------------------------------
-encoded_tbs_cert(Cert) ->
-    {ok, PKIXCert} = 
-	'OTP-PKIX':decode_TBSCert_exclusive(Cert),
-    {'Certificate',
-     {'Certificate_tbsCertificate', EncodedTBSCert}, _, _} = PKIXCert,
-    EncodedTBSCert.
-
-%%--------------------------------------------------------------------
-%%% Internal functions
-%%--------------------------------------------------------------------
-
-cert_return(Cert, Opts) ->
-    case lists:member(subject, Opts) of
-	true ->
-	    {ok, get_subj(Cert)};
-	false  ->
-	    {ok, Cert}
-    end.  
-
-
-%% Transfrom from PKIX1-Explicit88 to SSL-PKIX. 
-
-transform(#'Certificate'{signature = Signature,
-			 signatureAlgorithm = SignatureAlgorithm,
-			 tbsCertificate = TbsCertificate} = Cert, Type) ->
-    Cert#'Certificate'{tbsCertificate = transform(TbsCertificate, Type),
-		       signatureAlgorithm = transform(SignatureAlgorithm, Type),
-		       signature = transform(Signature, Type)};
-
-%% -record('TBSCertificate',{
-%% version = asn1_DEFAULT, serialNumber, signature, issuer, validity, subject,
-%% subjectPublicKeyInfo, issuerUniqueID = asn1_NOVALUE, 
-%% subjectUniqueID = asn1_NOVALUE, extensions = asn1_NOVALUE}).
-
-transform(#'TBSCertificate'{signature = Signature, issuer = Issuer,
-			    subject = Subject, extensions = Extensions,
-			    subjectPublicKeyInfo = SPKInfo} = TBSCert, Type) ->
-    TBSCert#'TBSCertificate'{signature = transform(Signature, Type),
-			     issuer = transform(Issuer, Type),
-			     subject = transform(Subject, Type),
-			     subjectPublicKeyInfo = transform(SPKInfo, Type),
-			     extensions = transform_extensions(Extensions, Type)
-			    };
-
-transform(#'AlgorithmIdentifier'{algorithm = Algorithm, 
-				 parameters = Params}, ssl) ->
-    SignAlgAny = 
-	#'SignatureAlgorithm-Any'{algorithm = Algorithm, parameters = Params},
-    {ok, AnyEnc} = 'OTP-PKIX':encode('SignatureAlgorithm-Any', SignAlgAny),
-    {ok, SignAlgCd} =  'OTP-PKIX':decode('SignatureAlgorithm', 
-					list_to_binary(AnyEnc)),
-    NAlgo = ssl_pkix_oid:id2atom(SignAlgCd#'SignatureAlgorithm'.algorithm),
-    SignAlgCd#'SignatureAlgorithm'{algorithm = NAlgo};
-
-transform({rdnSequence, Lss}, Type) when is_list(Lss) ->
-    {rdnSequence, [[transform(L, Type) || L <- Ls] || Ls <- Lss]};
-transform({rdnSequence, Lss}, _) ->
-    {rdnSequence, Lss}; 
-
-transform(#'AttributeTypeAndValue'{} = ATAV, ssl) ->
-    {ok, ATAVEnc} = 
-	'OTP-PKIX':encode('AttributeTypeAndValue', ATAV),
-    {ok, ATAVDec} = 'OTP-PKIX':decode('SSLAttributeTypeAndValue', 
-				      list_to_binary(ATAVEnc)),
-    AttrType = ATAVDec#'SSLAttributeTypeAndValue'.type,
-    #'AttributeTypeAndValue'{type = ssl_pkix_oid:id2atom(AttrType),
-			     value =  
-			     ATAVDec#'SSLAttributeTypeAndValue'.value};
-
-transform(#'AttributeTypeAndValue'{} = Att, pkix) ->
-    Att;
-
-%% -record('SubjectPublicKeyInfo',{
-%% algorithm, subjectPublicKey}).
-%%
-%% -record('SubjectPublicKeyInfo_algorithm',{
-%% algo, parameters = asn1_NOVALUE}).
-%%
-%% -record('SubjectPublicKeyInfo-Any',{
-%% algorithm, subjectPublicKey}).
-%%
-%% -record('PublicKeyAlgorithm',{
-%% algorithm, parameters = asn1_NOVALUE}).
-
-transform(#'SubjectPublicKeyInfo'{subjectPublicKey = SubjectPublicKey,
-				  algorithm = Algorithm}, ssl)  ->
-    %% Transform from SubjectPublicKeyInfo (PKIX1Explicit88) 
-    %% to SubjectPublicKeyInfo-Any (SSL-PKIX). 
-    Algo = Algorithm#'AlgorithmIdentifier'.algorithm,
-    Parameters = Algorithm#'AlgorithmIdentifier'.parameters,
-    AlgorithmAny = #'PublicKeyAlgorithm'{algorithm = Algo, 
-					 parameters = Parameters},
-    {0, Bin} = SubjectPublicKey,
-    SInfoAny = #'SSLSubjectPublicKeyInfo-Any'{algorithm = AlgorithmAny,
-					    subjectPublicKey = Bin},
-
-    %% Encode according to SubjectPublicKeyInfo-Any, and decode according
-    %% to SubjectPublicKeyInfo. 
-    {ok, AnyEnc} = 
-	'OTP-PKIX':encode('SSLSubjectPublicKeyInfo-Any', SInfoAny),
-    {ok, SInfoCd} = 'OTP-PKIX':decode('SSLSubjectPublicKeyInfo', 
-				      list_to_binary(AnyEnc)),
-    %% Replace object identifier by atom
-    AlgorithmCd = SInfoCd#'SSLSubjectPublicKeyInfo'.algorithm,
-    AlgoCd = AlgorithmCd#'SSLSubjectPublicKeyInfo_algorithm'.algo, 
-    Params = AlgorithmCd#'SSLSubjectPublicKeyInfo_algorithm'.parameters,
-    Key = SInfoCd#'SSLSubjectPublicKeyInfo'.subjectPublicKey,
-    NAlgoCd = ssl_pkix_oid:id2atom(AlgoCd),
-    NAlgorithmCd = 
-	#'SubjectPublicKeyInfo_algorithm'{algorithm = NAlgoCd, 
-					  parameters = Params},
-    #'SubjectPublicKeyInfo'{algorithm = NAlgorithmCd,
-			    subjectPublicKey = Key
-			   };
-transform(#'SubjectPublicKeyInfo'{} = SInfo, pkix) ->
-    SInfo;
-
-transform(#'Extension'{extnID = ExtnID} = Ext, ssl) ->
-    NewExtID = ssl_pkix_oid:id2atom(ExtnID),
-    ExtAny = setelement(1, Ext, 'Extension-Any'),
-    {ok, AnyEnc} = 'OTP-PKIX':encode('Extension-Any', ExtAny),
-    {ok, ExtCd} =  'OTP-PKIX':decode('SSLExtension', list_to_binary(AnyEnc)),
-    
-    ExtValue = transform_extension_value(NewExtID, 
-					 ExtCd#'SSLExtension'.extnValue,
-					 ssl),
-    #'Extension'{extnID = NewExtID,
-		 critical = ExtCd#'SSLExtension'.critical,
-		 extnValue = ExtValue};
-
-transform(#'Extension'{extnID = ExtnID, extnValue = ExtnValue} = Ext, pkix) -> 
-    NewExtID = ssl_pkix_oid:id2atom(ExtnID),
-    ExtValue = transform_extension_value(NewExtID, ExtnValue, pkix),
-    Ext#'Extension'{extnValue = ExtValue};
-
-transform(#'AuthorityKeyIdentifier'{authorityCertIssuer = CertIssuer} = Ext,
-	  Type) ->
-    Ext#'AuthorityKeyIdentifier'{authorityCertIssuer = 
-				 transform(CertIssuer, Type)};
-
-transform([{directoryName, Value}], Type) ->
-     [{directoryName, transform(Value, Type)}];
-
-transform(X, _) ->
-    X.
-
-transform_extension_value('ce-authorityKeyIdentifier', Value, Type) ->
-    transform(Value, Type);
-transform_extension_value(_, Value, _) ->
-    Value.
-
-transform_extensions(Exts, Type) when is_list(Exts) ->
-    [transform(Ext, Type) || Ext <- Exts];
-transform_extensions(Exts, _) ->
-    Exts.
-
-get_subj(Cert) ->
-    (Cert#'Certificate'.tbsCertificate)#'TBSCertificate'.subject.
-
-signature_digest(BinSignature) ->
-    case (catch 'OTP-PKIX':decode('DigestInfo', BinSignature)) of
-	{ok, DigestInfo} ->
-	    list_to_binary(DigestInfo#'DigestInfo'.digest);
-	_ ->
-	    {error, decode_error}
-    end.
diff --git a/lib/ssl/src/ssl_pkix.hrl b/lib/ssl/src/ssl_pkix.hrl
deleted file mode 100644
index a8463369f6..0000000000
--- a/lib/ssl/src/ssl_pkix.hrl
+++ /dev/null
@@ -1,81 +0,0 @@
-%%
-%% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 2003-2009. All Rights Reserved.
-%% 
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
-%% 
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
-%% 
-%% %CopyrightEnd%
-%%
-
-%%
-
--ifndef(ssl_pkix).
--define(ssl_pkix, true).
-
--include("OTP-PKIX.hrl").
-
-%% The following commented out records are currently defined in OTP-PKIX.hrl
-%% and are considered a public interface through ssl_pkix.hrl.
-%% NOTE do not include OTP-PKIX.hrl it is an generated file
-%% and may change but the following records will still be
-%% availanble from this file.  
-
-% -record('Certificate', {
-% 	  tbsCertificate, 
-% 	  signatureAlgorithm, 
-% 	  signature}).
-
-% -record('TBSCertificate', {
-% 	  version = asn1_DEFAULT, 
-% 	  serialNumber, 
-% 	  signature, 
-% 	  issuer, 
-% 	  validity, 
-% 	  subject, 
-% 	  subjectPublicKeyInfo, 
-% 	  issuerUniqueID = asn1_NOVALUE, 
-% 	  subjectUniqueID = asn1_NOVALUE, 
-% 	  extensions = asn1_NOVALUE}).
-
-% -record('AttributeTypeAndValue', {
-% 	  type, 
-% 	  value}).
-
-% -record('SubjectPublicKeyInfo', {
-% 	  algorithm, 
-% 	  subjectPublicKey}).
-
--record('SubjectPublicKeyInfo_algorithm', {
- 	  algorithm, 
- 	  parameters = asn1_NOVALUE}).
-
-% -record('FieldID', {
-% 	  fieldType,
-% 	  parameters}).
-
-% -record('Characteristic-two', {
-% 	  m, 
-% 	  basis, 
-% 	  parameters}).
-
-% -record('ExtensionAttribute', {
-% 	  extensionAttributeType, 
-% 	  extensionAttributeValue}).
-
-% -record('Extension', {
-% 	  extnID, 
-% 	  critical = asn1_DEFAULT, 
-% 	  extnValue}).
-
--endif. % -ifdef(ssl_pkix).
-
diff --git a/lib/ssl/src/ssl_ssl3.erl b/lib/ssl/src/ssl_ssl3.erl
index 400298a322..88b801d46b 100644
--- a/lib/ssl/src/ssl_ssl3.erl
+++ b/lib/ssl/src/ssl_ssl3.erl
@@ -147,7 +147,7 @@ suites() ->
       ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
       ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
       ?TLS_RSA_WITH_AES_128_CBC_SHA,
-      ?TLS_RSA_WITH_IDEA_CBC_SHA, 
+      %%?TLS_RSA_WITH_IDEA_CBC_SHA, 
       ?TLS_RSA_WITH_RC4_128_SHA,
       ?TLS_RSA_WITH_RC4_128_MD5,
       ?TLS_RSA_WITH_DES_CBC_SHA
diff --git a/lib/ssl/test/Makefile b/lib/ssl/test/Makefile
index d35cafc47b..9e4aecac45 100644
--- a/lib/ssl/test/Makefile
+++ b/lib/ssl/test/Makefile
@@ -59,12 +59,10 @@ ERL_FILES = $(MODULES:%=%.erl)
 HRL_FILES = ssl_test_MACHINE.hrl 
 
 HRL_FILES_SRC = \
-	ssl_pkix.hrl \
 	ssl_alert.hrl \
 	ssl_handshake.hrl
 
-HRL_FILES_INC = \
-	OTP-PKIX.hrl
+HRL_FILES_INC = 
 
 HRL_FILES_NEEDED_IN_TEST = \
 	$(HRL_FILES_SRC:%=../src/%) \
diff --git a/lib/ssl/test/old_ssl_active_SUITE.erl b/lib/ssl/test/old_ssl_active_SUITE.erl
index 010596f351..d1cec26827 100644
--- a/lib/ssl/test/old_ssl_active_SUITE.erl
+++ b/lib/ssl/test/old_ssl_active_SUITE.erl
@@ -87,6 +87,8 @@ config(Config) ->
     %% operating system, version of OTP, Erts, kernel and stdlib. 
 
     %% Check if SSL exists. If this case fails, all other cases are skipped
+    crypto:start(),
+    application:start(public_key),
     case ssl:start() of
 	ok -> ssl:stop();
 	{error, {already_started, _}} -> ssl:stop();
diff --git a/lib/ssl/test/old_ssl_active_once_SUITE.erl b/lib/ssl/test/old_ssl_active_once_SUITE.erl
index 6224b17aa7..63eaa730e9 100644
--- a/lib/ssl/test/old_ssl_active_once_SUITE.erl
+++ b/lib/ssl/test/old_ssl_active_once_SUITE.erl
@@ -1,19 +1,19 @@
 %%
 %% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 2002-2009. All Rights Reserved.
-%% 
+%%
+%% Copyright Ericsson AB 2002-2010. All Rights Reserved.
+%%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
 %% compliance with the License. You should have received a copy of the
 %% Erlang Public License along with this software. If not, it can be
 %% retrieved online at http://www.erlang.org/.
-%% 
+%%
 %% Software distributed under the License is distributed on an "AS IS"
 %% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 %% the License for the specific language governing rights and limitations
 %% under the License.
-%% 
+%%
 %% %CopyrightEnd%
 %%
 
@@ -79,6 +79,8 @@ config(Config) ->
     io:format("Config: ~p~n", [Config]),
 
     %% Check if SSL exists. If this case fails, all other cases are skipped
+    crypto:start(),
+    application:start(public_key),
     case ssl:start() of
 	ok -> ssl:stop();
 	{error, {already_started, _}} -> ssl:stop();
diff --git a/lib/ssl/test/old_ssl_dist_SUITE.erl b/lib/ssl/test/old_ssl_dist_SUITE.erl
index 56209c3530..97090c1409 100644
--- a/lib/ssl/test/old_ssl_dist_SUITE.erl
+++ b/lib/ssl/test/old_ssl_dist_SUITE.erl
@@ -1,19 +1,19 @@
 %%
 %% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 2007-2009. All Rights Reserved.
-%% 
+%%
+%% Copyright Ericsson AB 2007-2010. All Rights Reserved.
+%%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
 %% compliance with the License. You should have received a copy of the
 %% Erlang Public License along with this software. If not, it can be
 %% retrieved online at http://www.erlang.org/.
-%% 
+%%
 %% Software distributed under the License is distributed on an "AS IS"
 %% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 %% the License for the specific language governing rights and limitations
 %% under the License.
-%% 
+%%
 %% %CopyrightEnd%
 %%
 
@@ -254,7 +254,8 @@ mk_node_cmdline(ListenPort, Name, Args) ->
     Prog ++ " "
 	++ Static ++ " "
 	++ NameSw ++ " " ++ Name ++ " "
-	++ "-pa " ++ Pa ++ " "
+	++ "-pa " ++ Pa ++ " " 
+ 	++ "-run application start crypto -run application start public_key "
 	++ "-run " ++ atom_to_list(?MODULE) ++ " cnct2tstsrvr "
 	++ host_name() ++ " "
 	++ integer_to_list(ListenPort) ++ " "
@@ -524,23 +525,10 @@ add_ssl_opts_config(Config) ->
 	KrnlDir = filename:join([LibDir, "kernel-" ++ KRNL_VSN]),
 	{ok, _} = file:read_file_info(StdlDir),
 	{ok, _} = file:read_file_info(KrnlDir),
-	SSL_VSN = case lists:keysearch(ssl, 1, Apps) of
-		      {value, {ssl, _, VSN}} ->
-			  VSN;
-		      _ ->
-			  application:start(ssl),
-			  try
-			      {value,
-			       {ssl,
-				_,
-				VSN}} = lists:keysearch(ssl,
-							1,
-							application:which_applications()),
-			      VSN
-			  after
-			      application:stop(ssl)
-			  end
-		  end,
+	SSL_VSN = vsn(ssl),
+	VSN_CRYPTO = vsn(crypto),
+	VSN_PKEY = vsn(public_key),
+	
 	SslDir = filename:join([LibDir, "ssl-" ++ SSL_VSN]),
 	{ok, _} = file:read_file_info(SslDir),
 	%% We are using an installed otp system, create the boot script.
@@ -552,6 +540,8 @@ add_ssl_opts_config(Config) ->
 		  " {erts, \"~s\"},~n"
 		  " [{kernel, \"~s\"},~n"
 		  "  {stdlib, \"~s\"},~n"
+		  "  {crypto, \"~s\"},~n"
+		  "  {public_key, \"~s\"},~n"
 		  "  {ssl, \"~s\"}]}.~n",
 		  [case catch erlang:system_info(otp_release) of
 		       {'EXIT', _} -> "R11B";
@@ -560,6 +550,8 @@ add_ssl_opts_config(Config) ->
 		   erlang:system_info(version),
 		   KRNL_VSN,
 		   STDL_VSN,
+		   VSN_CRYPTO,
+		   VSN_PKEY,
 		   SSL_VSN]),
 	ok = file:close(RelFile),
 	ok = systools:make_script(Script, []),
@@ -593,3 +585,17 @@ success(Config) ->
 	{value, {comment, _} = Res} -> Res;
 	_ -> ok
     end.
+
+vsn(App) ->
+    application:start(App),
+    try
+	{value,
+	 {ssl,
+	  _,
+	  VSN}} = lists:keysearch(App,
+				  1,
+				  application:which_applications()),
+	VSN
+     after
+	 application:stop(ssl)
+     end.
diff --git a/lib/ssl/test/old_ssl_misc_SUITE.erl b/lib/ssl/test/old_ssl_misc_SUITE.erl
index 55d1b71025..2767123a12 100644
--- a/lib/ssl/test/old_ssl_misc_SUITE.erl
+++ b/lib/ssl/test/old_ssl_misc_SUITE.erl
@@ -1,19 +1,19 @@
 %%
 %% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 2003-2009. All Rights Reserved.
-%% 
+%%
+%% Copyright Ericsson AB 2003-2010. All Rights Reserved.
+%%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
 %% compliance with the License. You should have received a copy of the
 %% Erlang Public License along with this software. If not, it can be
 %% retrieved online at http://www.erlang.org/.
-%% 
+%%
 %% Software distributed under the License is distributed on an "AS IS"
 %% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 %% the License for the specific language governing rights and limitations
 %% under the License.
-%% 
+%%
 %% %CopyrightEnd%
 %%
 
@@ -61,6 +61,8 @@ config(Config) ->
     io:format("Config: ~p~n", [Config]),
 
     %% Check if SSL exists. If this case fails, all other cases are skipped
+    crypto:start(),
+    application:start(public_key),
     case ssl:start() of
 	ok -> ssl:stop();
 	{error, {already_started, _}} -> ssl:stop();
diff --git a/lib/ssl/test/old_ssl_passive_SUITE.erl b/lib/ssl/test/old_ssl_passive_SUITE.erl
index 4cb8c1f0cd..96a7938583 100644
--- a/lib/ssl/test/old_ssl_passive_SUITE.erl
+++ b/lib/ssl/test/old_ssl_passive_SUITE.erl
@@ -1,19 +1,19 @@
 %%
 %% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 1999-2009. All Rights Reserved.
-%% 
+%%
+%% Copyright Ericsson AB 1999-2010. All Rights Reserved.
+%%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
 %% compliance with the License. You should have received a copy of the
 %% Erlang Public License along with this software. If not, it can be
 %% retrieved online at http://www.erlang.org/.
-%% 
+%%
 %% Software distributed under the License is distributed on an "AS IS"
 %% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 %% the License for the specific language governing rights and limitations
 %% under the License.
-%% 
+%%
 %% %CopyrightEnd%
 %%
 
@@ -78,6 +78,8 @@ config(Config) ->
     io:format("Config: ~p~n", [Config]),
 
     %% Check if SSL exists. If this case fails, all other cases are skipped
+    crypto:start(),
+    application:start(public_key),
     case ssl:start() of
 	ok -> ssl:stop();
 	{error, {already_started, _}} -> ssl:stop();
diff --git a/lib/ssl/test/old_ssl_peer_cert_SUITE.erl b/lib/ssl/test/old_ssl_peer_cert_SUITE.erl
index f0b8db2607..e5b3975d41 100644
--- a/lib/ssl/test/old_ssl_peer_cert_SUITE.erl
+++ b/lib/ssl/test/old_ssl_peer_cert_SUITE.erl
@@ -1,19 +1,19 @@
 %%
 %% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 2003-2009. All Rights Reserved.
-%% 
+%%
+%% Copyright Ericsson AB 2003-2010. All Rights Reserved.
+%%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
 %% compliance with the License. You should have received a copy of the
 %% Erlang Public License along with this software. If not, it can be
 %% retrieved online at http://www.erlang.org/.
-%% 
+%%
 %% Software distributed under the License is distributed on an "AS IS"
 %% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 %% the License for the specific language governing rights and limitations
 %% under the License.
-%% 
+%%
 %% %CopyrightEnd%
 %%
 
@@ -62,6 +62,8 @@ config(Config) ->
     io:format("Config: ~p~n", [Config]),
 
     %% Check if SSL exists. If this case fails, all other cases are skipped
+    crypto:start(),
+    application:start(public_key),
     case ssl:start() of
 	ok -> ssl:stop();
 	{error, {already_started, _}} -> ssl:stop();
diff --git a/lib/ssl/test/old_ssl_protocol_SUITE.erl b/lib/ssl/test/old_ssl_protocol_SUITE.erl
index 7bde5d6749..efdbf45a3d 100644
--- a/lib/ssl/test/old_ssl_protocol_SUITE.erl
+++ b/lib/ssl/test/old_ssl_protocol_SUITE.erl
@@ -1,19 +1,19 @@
 %%
 %% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 2005-2009. All Rights Reserved.
-%% 
+%%
+%% Copyright Ericsson AB 2005-2010. All Rights Reserved.
+%%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
 %% compliance with the License. You should have received a copy of the
 %% Erlang Public License along with this software. If not, it can be
 %% retrieved online at http://www.erlang.org/.
-%% 
+%%
 %% Software distributed under the License is distributed on an "AS IS"
 %% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 %% the License for the specific language governing rights and limitations
 %% under the License.
-%% 
+%%
 %% %CopyrightEnd%
 %%
 
@@ -55,6 +55,8 @@ config(Config) ->
     io:format("Config: ~p~n", [Config]),
 
     %% Check if SSL exists. If this case fails, all other cases are skipped
+    crypto:start(),
+    application:start(public_key),
     case ssl:start() of
 	ok -> ssl:stop();
 	{error, {already_started, _}} -> ssl:stop();
diff --git a/lib/ssl/test/old_ssl_verify_SUITE.erl b/lib/ssl/test/old_ssl_verify_SUITE.erl
index 5db964526f..7a8cd1578a 100644
--- a/lib/ssl/test/old_ssl_verify_SUITE.erl
+++ b/lib/ssl/test/old_ssl_verify_SUITE.erl
@@ -1,19 +1,19 @@
 %%
 %% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 1999-2009. All Rights Reserved.
-%% 
+%%
+%% Copyright Ericsson AB 1999-2010. All Rights Reserved.
+%%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
 %% compliance with the License. You should have received a copy of the
 %% Erlang Public License along with this software. If not, it can be
 %% retrieved online at http://www.erlang.org/.
-%% 
+%%
 %% Software distributed under the License is distributed on an "AS IS"
 %% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 %% the License for the specific language governing rights and limitations
 %% under the License.
-%% 
+%%
 %% %CopyrightEnd%
 %%
 
@@ -60,6 +60,8 @@ config(Config) ->
     io:format("Config: ~p~n", [Config]),
 
     %% Check if SSL exists. If this case fails, all other cases are skipped
+    crypto:start(),
+    application:start(public_key),
     case ssl:start() of
 	ok -> ssl:stop();
 	{error, {already_started, _}} -> ssl:stop();
diff --git a/lib/ssl/test/old_transport_accept_SUITE.erl b/lib/ssl/test/old_transport_accept_SUITE.erl
index 4bb09cee19..71c1d9e181 100644
--- a/lib/ssl/test/old_transport_accept_SUITE.erl
+++ b/lib/ssl/test/old_transport_accept_SUITE.erl
@@ -1,19 +1,19 @@
 %%
 %% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 2007-2009. All Rights Reserved.
-%% 
+%%
+%% Copyright Ericsson AB 2007-2010. All Rights Reserved.
+%%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
 %% compliance with the License. You should have received a copy of the
 %% Erlang Public License along with this software. If not, it can be
 %% retrieved online at http://www.erlang.org/.
-%% 
+%%
 %% Software distributed under the License is distributed on an "AS IS"
 %% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 %% the License for the specific language governing rights and limitations
 %% under the License.
-%% 
+%%
 %% %CopyrightEnd%
 %%
 
@@ -224,12 +224,9 @@ tolerant_server_loop(Client, LSock, Msg, N) ->
     tolerant_server_loop(Client, LSock, Msg, N-1).
 
 app() ->
-    case application:get_application(ssl) of
-	undefined ->
-	    application:start(ssl);
-	_ ->
-	    ok
-    end.
+    crypto:start(),
+    application:start(public_key),
+    ssl:start().
 
 start_node(Kind, Params) ->
     S = atom_to_list(?MODULE)++"_" ++ atom_to_list(Kind),
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index 0d9a912e30..8a1b90ed98 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -50,18 +50,21 @@
 %% Note: This function is free to add any key/value pairs to the Config
 %% variable, but should NOT alter/remove any existing entries.
 %%--------------------------------------------------------------------
-init_per_suite(Config) ->
+init_per_suite(Config0) ->
+    Dog = ssl_test_lib:timetrap(?TIMEOUT *2),
     crypto:start(),
+    application:start(public_key),
     ssl:start(),
     
     %% make rsa certs using oppenssl
     Result = 
-	(catch make_certs:all(?config(data_dir, Config), 
-			      ?config(priv_dir, Config))),
+	(catch make_certs:all(?config(data_dir, Config0), 
+			      ?config(priv_dir, Config0))),
     test_server:format("Make certs  ~p~n", [Result]),
 
-    NewConfig = ssl_test_lib:make_dsa_cert(Config),
-    ssl_test_lib:cert_options(NewConfig).
+    Config1 = ssl_test_lib:make_dsa_cert(Config0),
+    Config = ssl_test_lib:cert_options(Config1),
+    [{watchdog, Dog} | Config].
 
 %%--------------------------------------------------------------------
 %% Function: end_per_suite(Config) -> _
diff --git a/lib/ssl/test/ssl_packet_SUITE.erl b/lib/ssl/test/ssl_packet_SUITE.erl
index a019e660e9..1b8754afe9 100644
--- a/lib/ssl/test/ssl_packet_SUITE.erl
+++ b/lib/ssl/test/ssl_packet_SUITE.erl
@@ -54,6 +54,7 @@
 %%--------------------------------------------------------------------
 init_per_suite(Config) ->
     crypto:start(),
+    application:start(public_key),
     ssl:start(),
     Result = 
 	(catch make_certs:all(?config(data_dir, Config), 
diff --git a/lib/ssl/test/ssl_payload_SUITE.erl b/lib/ssl/test/ssl_payload_SUITE.erl
index a0aa92bdf2..d80df0bfbd 100644
--- a/lib/ssl/test/ssl_payload_SUITE.erl
+++ b/lib/ssl/test/ssl_payload_SUITE.erl
@@ -1,19 +1,19 @@
 %%
 %% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 2008-2009. All Rights Reserved.
-%% 
+%%
+%% Copyright Ericsson AB 2008-2010. All Rights Reserved.
+%%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
 %% compliance with the License. You should have received a copy of the
 %% Erlang Public License along with this software. If not, it can be
 %% retrieved online at http://www.erlang.org/.
-%% 
+%%
 %% Software distributed under the License is distributed on an "AS IS"
 %% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 %% the License for the specific language governing rights and limitations
 %% under the License.
-%% 
+%%
 %% %CopyrightEnd%
 %%
 
@@ -38,6 +38,7 @@
 %%--------------------------------------------------------------------
 init_per_suite(Config) ->
     crypto:start(),
+    application:start(public_key),
     ssl:start(),
     make_certs:all(?config(data_dir, Config), ?config(priv_dir, Config)),
     ssl_test_lib:cert_options(Config).
diff --git a/lib/ssl/test/ssl_test_MACHINE.erl b/lib/ssl/test/ssl_test_MACHINE.erl
index e75f7079ed..e0ffa15d80 100644
--- a/lib/ssl/test/ssl_test_MACHINE.erl
+++ b/lib/ssl/test/ssl_test_MACHINE.erl
@@ -1,19 +1,19 @@
 %%
 %% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 2003-2009. All Rights Reserved.
-%% 
+%%
+%% Copyright Ericsson AB 2003-2010. All Rights Reserved.
+%%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
 %% compliance with the License. You should have received a copy of the
 %% Erlang Public License along with this software. If not, it can be
 %% retrieved online at http://www.erlang.org/.
-%% 
+%%
 %% Software distributed under the License is distributed on an "AS IS"
 %% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 %% the License for the specific language governing rights and limitations
 %% under the License.
-%% 
+%%
 %% %CopyrightEnd%
 %%
 
@@ -60,10 +60,12 @@ many_conns_1() ->
 %% 
 mk_ssl_cert_opts(_Config) ->
     Dir = filename:join([code:lib_dir(ssl), "examples", "certs", "etc"]),
-    COpts = [{cacertfile, filename:join([Dir, "client", "cacerts.pem"])}, 
+    COpts = [{ssl_imp, old},
+	     {cacertfile, filename:join([Dir, "client", "cacerts.pem"])}, 
 	     {certfile, filename:join([Dir, "client", "cert.pem"])}, 
 	     {keyfile, filename:join([Dir, "client", "key.pem"])}], 
-    SOpts = [{cacertfile, filename:join([Dir, "server", "cacerts.pem"])}, 
+    SOpts = [{ssl_imp, old},
+	     {cacertfile, filename:join([Dir, "server", "cacerts.pem"])}, 
 	     {certfile, filename:join([Dir, "server", "cert.pem"])}, 
 	     {keyfile, filename:join([Dir, "server", "key.pem"])}], 
     {ok, {COpts, SOpts}}.
@@ -225,11 +227,13 @@ start_ssl(Nodes, Config) ->
     ok.
 
 do_start(Env) ->
+    application:start(crypto),
+    application:start(public_key),
     application:load(ssl),
     lists:foreach(
       fun({Par, Val}) -> application:set_env(ssl, Par, Val) end, Env),
-    application:start(ssl),
-    application:start(crypto).
+    application:start(ssl).
+
     
 %%
 %% start_node(Name) -> {ok, Node}
@@ -542,7 +546,7 @@ get_active(St) ->
 listen(St, LPort) ->
     case St#st.protomod of
 	ssl ->
-	    ssl:listen(LPort, St#st.sockopts ++ St#st.sslopts);
+	    ssl:listen(LPort, [{ssl_imp, old} | St#st.sockopts ++ St#st.sslopts]);
 	gen_tcp ->
 	    gen_tcp:listen(LPort, St#st.sockopts)
     end.
@@ -584,7 +588,8 @@ connect(St, Host, Port) ->
     
     case St#st.protomod of
 	ssl ->
-	    case ssl:connect(Host, Port, St#st.sockopts ++ St#st.sslopts, 
+	    case ssl:connect(Host, Port, 
+			     [{ssl_imp, old} | St#st.sockopts ++ St#st.sslopts], 
 			     St#st.timeout) of
 		{ok, Sock} ->
 		    {ok, LPort} = ssl:sockname(Sock),
diff --git a/lib/ssl/test/ssl_to_openssl_SUITE.erl b/lib/ssl/test/ssl_to_openssl_SUITE.erl
index 4981ac0424..d2a4ca8db5 100644
--- a/lib/ssl/test/ssl_to_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_to_openssl_SUITE.erl
@@ -25,8 +25,6 @@
 -compile(export_all).
 
 -include("test_server.hrl").
--include("test_server_line.hrl").
--include("ssl_pkix.hrl").
 
 -define(TIMEOUT, 120000).
 -define(SLEEP, 1000).
@@ -45,19 +43,22 @@
 %% Note: This function is free to add any key/value pairs to the Config
 %% variable, but should NOT alter/remove any existing entries.
 %%--------------------------------------------------------------------
-init_per_suite(Config) ->
+init_per_suite(Config0) ->
+    Dog = ssl_test_lib:timetrap(?TIMEOUT *2),
     case os:find_executable("openssl") of
 	false ->
 	    {skip, "Openssl not found"};
 	_ ->
 	    crypto:start(),
+	    application:start(public_key),
 	    ssl:start(),
 	    Result = 
-		(catch make_certs:all(?config(data_dir, Config), 
-				      ?config(priv_dir, Config))),
+		(catch make_certs:all(?config(data_dir, Config0), 
+				      ?config(priv_dir, Config0))),
 	    test_server:format("Make certs  ~p~n", [Result]),
-	    NewConfig = ssl_test_lib:make_dsa_cert(Config),
-	    ssl_test_lib:cert_options(NewConfig)
+	    Config1 = ssl_test_lib:make_dsa_cert(Config0),
+	    Config = ssl_test_lib:cert_options(Config1),
+	    [{watchdog, Dog} | Config]
     end.
 
 %%--------------------------------------------------------------------
@@ -143,9 +144,10 @@ all(doc) ->
 all(suite) -> 
     [erlang_client_openssl_server, 
      erlang_server_openssl_client,
-     %% Comment out when new crypto sign functions is available
-     %%erlang_client_openssl_server_dsa_cert,
-     %%erlang_server_openssl_client_dsa_cert,
+     tls1_erlang_client_openssl_server_dsa_cert,
+     tls1_erlang_server_openssl_client_dsa_cert,
+     ssl3_erlang_client_openssl_server_dsa_cert,
+     ssl3_erlang_server_openssl_client_dsa_cert,
      erlang_server_openssl_client_reuse_session,
      erlang_client_openssl_server_renegotiate,
      erlang_client_openssl_server_no_wrap_sequence_number,
@@ -252,11 +254,11 @@ erlang_server_openssl_client(Config) when is_list(Config) ->
 
 %%-------------------------------------------------------------------- 
 
-erlang_client_openssl_server_dsa_cert(doc) ->
+tls1_erlang_client_openssl_server_dsa_cert(doc) ->
     ["Test erlang server with openssl client"];
-erlang_client_openssl_server_dsa_cert(suite) ->
+tls1_erlang_client_openssl_server_dsa_cert(suite) ->
     [];
-erlang_client_openssl_server_dsa_cert(Config) when is_list(Config) ->
+tls1_erlang_client_openssl_server_dsa_cert(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ClientOpts = ?config(client_dsa_opts, Config),  
     ServerOpts = ?config(server_dsa_opts, Config),  
@@ -300,11 +302,11 @@ erlang_client_openssl_server_dsa_cert(Config) when is_list(Config) ->
 
 %%-------------------------------------------------------------------- 
 
-erlang_server_openssl_client_dsa_cert(doc) ->
+tls1_erlang_server_openssl_client_dsa_cert(doc) ->
     ["Test erlang server with openssl client"];
-erlang_server_openssl_client_dsa_cert(suite) ->
+tls1_erlang_server_openssl_client_dsa_cert(suite) ->
     [];
-erlang_server_openssl_client_dsa_cert(Config) when is_list(Config) ->
+tls1_erlang_server_openssl_client_dsa_cert(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ClientOpts = ?config(client_dsa_opts, Config),
     ServerOpts = ?config(server_dsa_opts, Config),  
@@ -338,6 +340,97 @@ erlang_server_openssl_client_dsa_cert(Config) when is_list(Config) ->
     close_port(OpenSslPort),
     process_flag(trap_exit, false),
     ok.
+
+%%-------------------------------------------------------------------- 
+
+ssl3_erlang_client_openssl_server_dsa_cert(doc) ->
+    ["Test erlang server with openssl client"];
+ssl3_erlang_client_openssl_server_dsa_cert(suite) ->
+    [];
+ssl3_erlang_client_openssl_server_dsa_cert(Config) when is_list(Config) ->
+    process_flag(trap_exit, true),
+    ClientOpts = ?config(client_dsa_opts, Config),  
+    ServerOpts = ?config(server_dsa_opts, Config),  
+
+    {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
+  
+    Data = "From openssl to erlang",
+
+    Port = ssl_test_lib:inet_port(node()),
+    CaCertFile =  proplists:get_value(cacertfile, ServerOpts),
+    CertFile = proplists:get_value(certfile, ServerOpts),
+    KeyFile = proplists:get_value(keyfile, ServerOpts),
+   
+    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ 
+	" -cert " ++ CertFile ++ " -CAfile " ++ CaCertFile  
+	++ " -key " ++ KeyFile ++ " -Verify 2 -ssl3 -msg", 
+    
+    test_server:format("openssl cmd: ~p~n", [Cmd]),
+
+    OpensslPort =  open_port({spawn, Cmd}, [stderr_to_stdout]), 
+
+    wait_for_openssl_server(),
+
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+					{host, Hostname},
+					{from, self()}, 
+					{mfa, {?MODULE, 
+					       erlang_ssl_receive, [Data]}},
+					{options, ClientOpts}]),
+
+    port_command(OpensslPort, Data),
+    
+    ssl_test_lib:check_result(Client, ok), 
+   
+    %% Clean close down!   Server needs to be closed first !!
+    close_port(OpensslPort),
+
+    ssl_test_lib:close(Client),
+    process_flag(trap_exit, false),
+    ok.
+
+%%-------------------------------------------------------------------- 
+
+ssl3_erlang_server_openssl_client_dsa_cert(doc) ->
+    ["Test erlang server with openssl client"];
+ssl3_erlang_server_openssl_client_dsa_cert(suite) ->
+    [];
+ssl3_erlang_server_openssl_client_dsa_cert(Config) when is_list(Config) ->
+    process_flag(trap_exit, true),
+    ClientOpts = ?config(client_dsa_opts, Config),
+    ServerOpts = ?config(server_dsa_opts, Config),  
+
+    {_, ServerNode, _} = ssl_test_lib:run_where(Config),
+    
+    Data = "From openssl to erlang",
+    CaCertFile =  proplists:get_value(cacertfile, ClientOpts),
+    CertFile = proplists:get_value(certfile, ClientOpts),
+    KeyFile = proplists:get_value(keyfile, ClientOpts),
+    
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
+					{from, self()}, 
+			   {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
+			   {options, ServerOpts}]),
+    Port = ssl_test_lib:inet_port(Server),
+    
+    Cmd = "openssl s_client -port " ++ integer_to_list(Port)  ++ 
+	" -host localhost " ++	" -cert " ++ CertFile ++ " -CAfile " ++ CaCertFile  
+	++ " -key " ++ KeyFile ++ " -ssl3 -msg",
+
+    test_server:format("openssl cmd: ~p~n", [Cmd]),
+    
+    OpenSslPort =  open_port({spawn, Cmd}, [stderr_to_stdout]), 
+    port_command(OpenSslPort, Data),
+    
+    ssl_test_lib:check_result(Server, ok),
+    
+    ssl_test_lib:close(Server),
+
+    close_port(OpenSslPort),
+    process_flag(trap_exit, false),
+    ok.
+
+
 %%-------------------------------------------------------------------- 
 
 erlang_server_openssl_client_reuse_session(doc) ->
@@ -1314,7 +1407,9 @@ wait_for_openssl_server() ->
 	    
 check_sane_openssl_renegotaite(Config) ->
     case os:cmd("openssl version") of
-	"OpenSSL 0.9.8l" ++ _ ->
+	"OpenSSL 0.9.8" ++ _ ->
+	    {skip, "Known renegotiation bug in OppenSSL"};
+	"OpenSSL 0.9.7" ++ _ ->
 	    {skip, "Known renegotiation bug in OppenSSL"};
 	_ ->
 	    Config
diff --git a/lib/ssl/vsn.mk b/lib/ssl/vsn.mk
index 813ce91e32..74b1cf4c78 100644
--- a/lib/ssl/vsn.mk
+++ b/lib/ssl/vsn.mk
@@ -17,13 +17,16 @@
 # %CopyrightEnd%
 #
 
-SSL_VSN = 3.11.1
+SSL_VSN = 4.0
 
-TICKETS = OTP-8679 \
-          OTP-7047 \
-          OTP-7049 \
-	  OTP-8568 \
-	  OTP-8588 
+TICKETS = OTP-8587\
+	  OTP-8695
+
+#TICKETS = OTP-8679 \
+#          OTP-7047 \
+#          OTP-7049 \
+#	  OTP-8568 \
+#	  OTP-8588 
 
 #TICKETS_3.11 = OTP-8517 \
 #	  OTP-7046 \