Merge branch 'ingela/public_key/cert-gen/OTP-14181' into maint

* ingela/public_key/cert-gen/OTP-14181:
  public_key, ssl: Prepare for release
  public_key, ssl: Provide certitifate test data generation function in public_key

11 files changed, 858 insertions, 524 deletions

diff --git a/lib/public_key/doc/src/public_key.xml b/lib/public_key/doc/src/public_key.xml
index 942203bd12..5a4fdf057b 100644
--- a/lib/public_key/doc/src/public_key.xml
+++ b/lib/public_key/doc/src/public_key.xml
@@ -119,6 +119,10 @@
       <tag><c>ec_private_key() =</c></tag>
       <item><p><c>#'ECPrivateKey'{}</c></p></item>
 
+      <tag><c>key_params() =</c></tag>
+      <item><p> #'DHParameter'{} |  {namedCurve, oid()} |  #'ECParameters'{} 
+      | {rsa, Size::integer(), PubExp::integer()} </p></item>      
+
       <tag><c>public_crypt_options() =</c></tag>
       <item><p><c>[{rsa_pad, rsa_padding()}]</c></p></item>
 
@@ -347,8 +351,7 @@
     <name>generate_key(Params) -> {Public::binary(), Private::binary()}  | #'ECPrivateKey'{} | #'RSAPrivateKey'{}</name>
     <fsummary>Generates a new keypair.</fsummary>
     <type>
-      <v>Params = #'DHParameter'{} |  {namedCurve, oid()} |  #'ECParameters'{} 
-      | {rsa, Size::integer(), PubExp::integer} </v>
+      <v>Params = key_params()</v>
     </type>
   <desc>
     <p>Generates a new keypair. Note that except for Diffie-Hellman
@@ -769,6 +772,85 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
     </desc>
   </func>
 
+  <func>
+    <name>pkix_test_data(Options) -> Config </name>
+    <fsummary>Creates certificate test data.</fsummary>
+    <type>
+      <v>Options = #{chain_type() := chain_opts()} </v>
+      <d>Options for ROOT, Intermediate and Peer certs</d>
+      
+      <v>chain_type() = server_chain | client_chain </v>
+
+      <v>chain_opts() = #{chain_end() := [cert_opt()],
+          intermediates => [[cert_opt()]]}</v>
+      <d>A valid chain must have at least a ROOT and a peer cert</d>
+
+      <v>chain_end() = root | peer </v>
+
+      <v>cert_opt() = {Key, Value}</v>
+      <d>For available options see <seealso marker="#cert_opt"> cert_opt()</seealso> below.</d>
+
+      <v>Config = #{server_config := [conf_opt()],
+      client_config := [conf_opt()]}</v>
+
+      <v>conf_opt() = {cert, der_encoded()} | {key, der_encoded()} |{cacerts, [der_encoded()]}</v>
+      <d>This is a subset of the type <seealso marker="ssl#type-ssloption"> ssl:ssl_option()</seealso> </d>
+    </type>
+    
+    <desc>
+      <p>Creates certificate test data to facilitate automated testing
+      of applications using X509-certificates often through
+      SSL/TLS. The test data can be used when you have control
+      over both the client and the server in a test scenario.
+      </p>
+      
+      <p> The <marker id="cert_opt"/> cert_opt() type consists of the following options: </p>
+      <taglist>
+	<tag> {digest, digest_type()}</tag>
+	<item><p>Hash algorithm to be used for
+	signing the certificate together with the key option. Defaults to sha that is sha1.
+	</p></item>
+	<tag> {key, key_params() | private_key()}</tag>
+	<item><p>Parameters to be used to call public_key:generate_key/1, to generate a key, or an existing
+	key. Defaults to generating an ECDSA key. Note this could fail if Erlang/OTP is compiled with a very old
+	cryptolib.</p></item>
+	<tag> {validity, {From::erlang:timestamp(), To::erlang:timestamp()}} </tag>
+	<item><p>The validity period of the certificate.</p></item>
+	<tag> {extensions, [#'Extension'{}]}</tag>
+	<item><p> Extensions to include in the certificate.</p>
+	      
+	  <p>Default extensions included in CA certificates if not
+	  otherwise specified are: </p>
+	  <code>[#'Extension'{extnID = ?'id-ce-keyUsage',
+              extnValue = [keyCertSign, cRLSign],
+              critical = false},
+#'Extension'{extnID = ?'id-ce-basicConstraints',
+             extnValue = #'BasicConstraints'{cA = true},
+             critical = true}]
+	  </code>
+
+	  <p>Default extensions included in the server peer cert if not
+	  otherwise specified are: </p>
+	  <code>[#'Extension'{extnID = ?'id-ce-keyUsage',
+              extnValue = [digitalSignature, keyAgreement],
+              critical = false},
+#'Extension'{extnID = ?'id-ce-subjectAltName',
+             extnValue = [{dNSName, Hostname}],
+             critical = false}]
+	  </code>
+	  <p>Hostname is the result of calling net_adm:localhost() in the Erlang node
+	  where this funcion is called.
+	  </p></item>
+
+	</taglist>
+	  
+	<note><p>
+	Note that the generated certificates and keys does not provide a formally correct PKIX-trust-chain 
+	and they can not be used to achieve real security. This function is provided for testing purposes only.
+</p></note>
+    </desc>
+  </func>
+  
   <func>  
     <name>pkix_verify(Cert, Key) -> boolean()</name>
     <fsummary>Verifies PKIX x.509 certificate signature.</fsummary>
diff --git a/lib/public_key/src/pubkey_cert.erl b/lib/public_key/src/pubkey_cert.erl
index f45f2c2e9a..13833830a7 100644
--- a/lib/public_key/src/pubkey_cert.erl
+++ b/lib/public_key/src/pubkey_cert.erl
@@ -32,12 +32,25 @@
 	 is_issuer/2, issuer_id/2, distribution_points/1, 
 	 is_fixed_dh_cert/1, verify_data/1, verify_fun/4, 
 	 select_extension/2, match_name/3,
-	 extensions_list/1, cert_auth_key_id/1, time_str_2_gregorian_sec/1]).
+	 extensions_list/1, cert_auth_key_id/1, time_str_2_gregorian_sec/1,
+         gen_test_certs/1]).
 
 -define(NULL, 0).
- 
+
+-export_type([chain_opts/0, test_config/0]).
+
+-type cert_opt()  :: {digest, public_key:digest_type()} | 
+                     {key, public_key:key_params() | public_key:private_key()} | 
+                     {validity, {From::erlang:timestamp(), To::erlang:timestamp()}} |
+                     {extensions, [#'Extension'{}]}.
+-type chain_end()   :: root | peer.
+-type chain_opts()  :: #{chain_end() := [cert_opt()],  intermediates =>  [[cert_opt()]]}.
+-type conf_opt()    :: {cert, public_key:der_encoded()} | 
+                       {key,  public_key:der_encoded()} |
+                       {cacerts, [public_key:der_encoded()]}.
+-type test_config() :: #{server_config := [conf_opt()],  client_config :=  [conf_opt()]}.
 %%====================================================================
-%% Internal application API
+%% Internal application APIu
 %%====================================================================
 
 %%--------------------------------------------------------------------
@@ -417,6 +430,31 @@ match_name(Fun, Name, PermittedName, [Head | Tail]) ->
 	false ->
 	    match_name(Fun, Name, Head, Tail)
     end.
+%%%
+-spec gen_test_certs(#{server_chain:= chain_opts(), client_chain:= chain_opts()}) -> test_config().
+ 
+%% Generates server and and client configuration for testing 
+%% purposes. All certificate options have default values
+gen_test_certs(#{client_chain := #{root := ClientRootConf,
+                                   intermediates := ClientCAs,
+                                   peer := ClientPeer}, 
+                 server_chain := 
+                     #{root := ServerRootConf,
+                       intermediates := ServerCAs,
+                       peer := ServerPeer}}) ->
+    SRootKey = gen_key(proplists:get_value(key, ServerRootConf, default_key_gen())),
+    CRootKey = gen_key(proplists:get_value(key, ClientRootConf, default_key_gen())),
+    ServerRoot = root_cert("server", SRootKey, ClientRootConf),
+    ClientRoot = root_cert("client", CRootKey, ServerRootConf),
+    
+    [{ServerDERCert, ServerDERKey} | ServerCAsKeys] = config(server, ServerRoot, 
+                                                       SRootKey, lists:reverse([ServerPeer | lists:reverse(ServerCAs)])),
+    [{ClientDERCert, ClientDERKey} | ClientCAsKeys] = config(client, ClientRoot, 
+                                                       CRootKey, lists:reverse([ClientPeer | lists:reverse(ClientCAs)])),
+    ServerDERCA = ca_config(ClientRoot, ServerCAsKeys),
+    ClientDERCA = ca_config(ServerRoot, ClientCAsKeys),
+    #{server_config => [{cert, ServerDERCert}, {key, ServerDERKey}, {cacerts, ServerDERCA}], 
+      client_config => [{cert, ClientDERCert}, {key, ClientDERKey}, {cacerts, ClientDERCA}]}.
 
 %%--------------------------------------------------------------------
 %%% Internal functions
@@ -1064,3 +1102,212 @@ missing_basic_constraints(OtpCert, SelfSigned, ValidationState, VerifyFun, UserS
 						       Len - 1},
 	     UserState}
     end.
+
+ gen_key(KeyGen) ->
+     case is_key(KeyGen) of
+         true ->
+             KeyGen;
+         false ->
+             public_key:generate_key(KeyGen)
+     end.
+
+is_key(#'DSAPrivateKey'{}) ->
+    true;
+is_key(#'RSAPrivateKey'{}) ->
+    true;
+is_key(#'ECPrivateKey'{}) ->
+    true;
+is_key(_) ->
+    false.
+
+root_cert(Role, PrivKey, Opts) ->
+     TBS = cert_template(),
+     Issuer = issuer("root", Role, " ROOT CA"),
+     OTPTBS = TBS#'OTPTBSCertificate'{
+                signature = sign_algorithm(PrivKey, Opts),
+                issuer = Issuer,
+                validity = validity(Opts),  
+                subject = Issuer,
+                subjectPublicKeyInfo = public_key(PrivKey),
+                extensions = extensions(Role, ca, Opts)
+               },
+     public_key:pkix_sign(OTPTBS, PrivKey).
+
+cert_template() ->
+    #'OTPTBSCertificate'{
+       version = v3,              
+       serialNumber = trunc(rand:uniform()*100000000)*10000 + 1,
+       issuerUniqueID = asn1_NOVALUE,       
+       subjectUniqueID = asn1_NOVALUE
+      }.
+issuer(Contact, Role, Name) ->
+  subject(Contact, Role ++ Name).
+
+subject(Contact, Name) ->
+    Opts = [{email, Contact ++ "@erlang.org"},
+	    {name,  Name},
+	    {city, "Stockholm"},
+	    {country, "SE"},
+	    {org, "erlang"},
+	    {org_unit, "automated testing"}],
+    subject(Opts).
+
+subject(SubjectOpts) when is_list(SubjectOpts) ->
+    Encode = fun(Opt) ->
+		     {Type,Value} = subject_enc(Opt),
+		     [#'AttributeTypeAndValue'{type=Type, value=Value}]
+	     end,
+    {rdnSequence, [Encode(Opt) || Opt <- SubjectOpts]}.
+
+subject_enc({name,  Name}) ->       
+    {?'id-at-commonName', {printableString, Name}};
+subject_enc({email, Email}) ->      
+    {?'id-emailAddress', Email};
+subject_enc({city,  City}) ->       
+    {?'id-at-localityName', {printableString, City}};
+subject_enc({org, Org}) ->          
+    {?'id-at-organizationName', {printableString, Org}};
+subject_enc({org_unit, OrgUnit}) -> 
+    {?'id-at-organizationalUnitName', {printableString, OrgUnit}};
+subject_enc({country, Country}) ->  
+    {?'id-at-countryName', Country}.
+
+validity(Opts) ->
+    DefFrom0 = calendar:gregorian_days_to_date(calendar:date_to_gregorian_days(date())-1),
+    DefTo0   = calendar:gregorian_days_to_date(calendar:date_to_gregorian_days(date())+7),
+    {DefFrom, DefTo} = proplists:get_value(validity, Opts, {DefFrom0, DefTo0}),
+    Format = fun({Y,M,D}) -> 
+                     lists:flatten(io_lib:format("~w~2..0w~2..0w000000Z",[Y,M,D])) 
+             end,
+    #'Validity'{notBefore={generalTime, Format(DefFrom)},
+		notAfter ={generalTime, Format(DefTo)}}.
+
+sign_algorithm(#'RSAPrivateKey'{}, Opts) ->
+    Type = rsa_digest_oid(proplists:get_value(digest, Opts, sha1)),
+    #'SignatureAlgorithm'{algorithm  = Type,
+                          parameters = 'NULL'};
+sign_algorithm(#'DSAPrivateKey'{p=P, q=Q, g=G}, _Opts) ->
+    #'SignatureAlgorithm'{algorithm  = ?'id-dsa-with-sha1',
+                          parameters = {params,#'Dss-Parms'{p=P, q=Q, g=G}}};
+sign_algorithm(#'ECPrivateKey'{parameters = Parms}, Opts) ->
+    Type = ecdsa_digest_oid(proplists:get_value(digest, Opts, sha1)),
+    #'SignatureAlgorithm'{algorithm  = Type,
+                          parameters = Parms}.
+rsa_digest_oid(sha1) ->
+    ?'sha1WithRSAEncryption';
+rsa_digest_oid(sha512) ->
+    ?'sha512WithRSAEncryption';
+rsa_digest_oid(sha384) ->
+    ?'sha384WithRSAEncryption';
+rsa_digest_oid(sha256) ->
+    ?'sha256WithRSAEncryption';
+rsa_digest_oid(md5) ->
+   ?'md5WithRSAEncryption'.
+
+ecdsa_digest_oid(sha1) ->
+    ?'ecdsa-with-SHA1';
+ecdsa_digest_oid(sha512) ->
+    ?'ecdsa-with-SHA512';
+ecdsa_digest_oid(sha384) ->
+    ?'ecdsa-with-SHA384';
+ecdsa_digest_oid(sha256) ->
+    ?'ecdsa-with-SHA256'.
+
+config(Role, Root, Key, Opts) ->
+   cert_chain(Role, Root, Key, Opts).
+
+cert_chain(Role, Root, RootKey, Opts) ->
+    cert_chain(Role, Root, RootKey, Opts, 0, []).
+
+cert_chain(Role, IssuerCert, IssuerKey, [PeerOpts], _, Acc) ->
+    Key = gen_key(proplists:get_value(key, PeerOpts, default_key_gen())),
+    Cert = cert(Role, public_key:pkix_decode_cert(IssuerCert, otp), 
+                IssuerKey, Key, "admin", " Peer cert", PeerOpts, peer),
+    [{Cert, Key}, {IssuerCert, IssuerKey} | Acc];
+cert_chain(Role, IssuerCert, IssuerKey, [CAOpts | Rest], N, Acc) ->
+    Key = gen_key(proplists:get_value(key, CAOpts, default_key_gen())),
+    Cert = cert(Role, public_key:pkix_decode_cert(IssuerCert, otp), IssuerKey, Key, "webadmin", 
+                " Intermidiate CA " ++ integer_to_list(N), CAOpts, ca),
+    cert_chain(Role, Cert, Key, Rest, N+1, [{IssuerCert, IssuerKey} | Acc]).
+
+cert(Role, #'OTPCertificate'{tbsCertificate = #'OTPTBSCertificate'{subject = Issuer}}, 
+     PrivKey, Key, Contact, Name, Opts, Type) ->
+    TBS = cert_template(),
+    OTPTBS = TBS#'OTPTBSCertificate'{
+               signature = sign_algorithm(PrivKey, Opts),
+               issuer =  Issuer,
+               validity = validity(Opts),  
+               subject = subject(Contact, atom_to_list(Role) ++ Name),
+               subjectPublicKeyInfo = public_key(Key),
+               extensions = extensions(Role, Type, Opts)
+               
+              },
+    public_key:pkix_sign(OTPTBS, PrivKey).
+
+ca_config(Root, CAsKeys) ->
+    [Root | [CA || {CA, _}  <- CAsKeys]].
+
+default_key_gen() ->
+    case crypto:ec_curves() of
+        [] ->
+            {rsa, 2048, 17};
+        [Curve |_] ->
+            Oid = pubkey_cert_records:namedCurves(Curve),
+            {namedCurve, Oid}
+    end.
+
+public_key(#'RSAPrivateKey'{modulus=N, publicExponent=E}) ->
+    Public = #'RSAPublicKey'{modulus=N, publicExponent=E},
+    Algo = #'PublicKeyAlgorithm'{algorithm= ?rsaEncryption, parameters='NULL'},
+    #'OTPSubjectPublicKeyInfo'{algorithm = Algo,
+			       subjectPublicKey = Public};
+public_key(#'DSAPrivateKey'{p=P, q=Q, g=G, y=Y}) ->
+    Algo = #'PublicKeyAlgorithm'{algorithm= ?'id-dsa', 
+				 parameters={params, #'Dss-Parms'{p=P, q=Q, g=G}}},
+    #'OTPSubjectPublicKeyInfo'{algorithm = Algo, subjectPublicKey = Y};
+public_key(#'ECPrivateKey'{version = _Version,
+			  privateKey = _PrivKey,
+			  parameters = Params,
+			  publicKey = PubKey}) ->
+    Algo = #'PublicKeyAlgorithm'{algorithm= ?'id-ecPublicKey', parameters=Params},
+    #'OTPSubjectPublicKeyInfo'{algorithm = Algo,
+			       subjectPublicKey = #'ECPoint'{point = PubKey}}.
+
+extensions(Role, Type, Opts) ->
+    Exts  = proplists:get_value(extensions, Opts, []),
+    add_default_extensions(Role, Type, Exts).
+
+add_default_extensions(_, ca, Exts) ->
+    Default = [#'Extension'{extnID = ?'id-ce-keyUsage',
+                            extnValue = [keyCertSign, cRLSign],
+                            critical = false},
+               #'Extension'{extnID = ?'id-ce-basicConstraints',
+                            extnValue = #'BasicConstraints'{cA = true},
+                            critical = true}],
+    add_default_extensions(Default, Exts);
+
+add_default_extensions(server, peer, Exts) ->
+    Hostname = net_adm:localhost(),
+    Default = [#'Extension'{extnID = ?'id-ce-keyUsage',
+                            extnValue = [digitalSignature, keyAgreement],
+                            critical = false},
+               #'Extension'{extnID = ?'id-ce-subjectAltName',
+                            extnValue = [{dNSName, Hostname}],
+                            critical = false}
+              ],
+    add_default_extensions(Default, Exts);
+    
+add_default_extensions(_, peer, Exts) ->
+    Exts.
+
+add_default_extensions(Defaults0, Exts) ->
+    Defaults = lists:filtermap(fun(#'Extension'{extnID = ID} = Ext) ->
+                                       case lists:keymember(ID, 2, Exts) of 
+                                           true -> 
+                                               false; 
+                                           false -> 
+                                               {true, Ext} 
+                                       end 
+                               end, Defaults0),
+    Exts ++ Defaults.
+
diff --git a/lib/public_key/src/public_key.erl b/lib/public_key/src/public_key.erl
index 9a61184f8a..cc01b61433 100644
--- a/lib/public_key/src/public_key.erl
+++ b/lib/public_key/src/public_key.erl
@@ -58,11 +58,13 @@
 	 pkix_match_dist_point/2,
 	 pkix_crl_verify/2,
 	 pkix_crl_issuer/1,
-	 short_name_hash/1
+	 short_name_hash/1,
+         pkix_test_data/1
 	]).
 
 -export_type([public_key/0, private_key/0, pem_entry/0,
-	      pki_asn1_type/0, asn1_type/0, ssh_file/0, der_encoded/0]).
+	      pki_asn1_type/0, asn1_type/0, ssh_file/0, der_encoded/0,
+              key_params/0, digest_type/0]).
 
 -type public_key()           ::  rsa_public_key() | dsa_public_key() | ec_public_key().
 -type private_key()          ::  rsa_private_key() | dsa_private_key() | ec_private_key().
@@ -75,6 +77,8 @@
 -type ecpk_parameters_api() :: ecpk_parameters() | #'ECParameters'{} | {namedCurve, Name::atom()}.
 -type ec_public_key()        :: {#'ECPoint'{}, ecpk_parameters_api()}.
 -type ec_private_key()       :: #'ECPrivateKey'{}.
+-type key_params()           :: #'DHParameter'{} | {namedCurve, oid()} | #'ECParameters'{} | 
+                                {rsa, Size::integer(), PubExp::integer()}. 
 -type der_encoded()          :: binary().
 -type pki_asn1_type()        ::  'Certificate' | 'RSAPrivateKey' | 'RSAPublicKey'
 			       | 'DSAPrivateKey' | 'DSAPublicKey' | 'DHParameter'
@@ -102,6 +106,7 @@
 -type crl_reason()           ::  unspecified | keyCompromise | cACompromise | affiliationChanged | superseded
 			       | cessationOfOperation | certificateHold | privilegeWithdrawn |  aACompromise.
 -type oid()                  :: tuple().
+-type chain_type()           :: server_chain | client_chain.
 
 -define(UINT32(X), X:32/unsigned-big-integer).
 -define(DER_NULL, <<5, 0>>).
@@ -1027,6 +1032,22 @@ short_name_hash({rdnSequence, _Attributes} = Name) ->
     <<HashValue:32/little, _/binary>> = crypto:hash(sha, HashThis),
     string:to_lower(string:right(integer_to_list(HashValue, 16), 8, $0)).
 
+
+%%--------------------------------------------------------------------
+-spec pkix_test_data(#{chain_type() := pubkey_cert:chain_opts()}) ->
+                            pubkey_cert:test_config().
+
+%% Description: Generates OpenSSL-style hash of a name.
+%%--------------------------------------------------------------------
+
+pkix_test_data(#{client_chain := ClientChain0,
+                 server_chain := ServerChain0}) ->
+    Default = #{intermediates => []},
+    ClientChain = maps:merge(Default, ClientChain0),
+    ServerChain = maps:merge(Default, ServerChain0),
+    pubkey_cert:gen_test_certs(#{client_chain => ClientChain,
+                                 server_chain => ServerChain}).
+
 %%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
diff --git a/lib/public_key/test/public_key_SUITE.erl b/lib/public_key/test/public_key_SUITE.erl
index 4b1b771613..374fb20375 100644
--- a/lib/public_key/test/public_key_SUITE.erl
+++ b/lib/public_key/test/public_key_SUITE.erl
@@ -48,6 +48,8 @@ all() ->
      pkix_verify_hostname_cn,
      pkix_verify_hostname_subjAltName,
      pkix_verify_hostname_options,
+     pkix_test_data_all_default,
+     pkix_test_data,
      short_cert_issuer_hash, short_crl_issuer_hash,
      ssh_hostkey_fingerprint_md5_implicit,
      ssh_hostkey_fingerprint_md5,
@@ -93,6 +95,14 @@ init_per_group(_GroupName, Config) ->
 end_per_group(_GroupName, Config) ->
     Config.
 %%-------------------------------------------------------------------
+
+init_per_testcase(pkix_test_data_all_default, Config) ->
+     case crypto:ec_curves() of
+         [] ->
+             {skip, missing_ecc_support};
+         _ ->
+               init_common_per_testcase(Config)
+     end;
 init_per_testcase(TestCase, Config) ->
     case TestCase of
 	ssh_hostkey_fingerprint_md5_implicit -> init_fingerprint_testcase([md5], Config);
@@ -1047,6 +1057,84 @@ general_name(Config) when is_list(Config) ->
 				    authorityCertSerialNumber = 
 					1}).
 %%--------------------------------------------------------------------
+
+pkix_test_data_all_default() ->
+    [{doc, "Test API function pkix_test_data/1"}].
+
+pkix_test_data_all_default(Config) when is_list(Config) ->
+    #{server_config := ServerConf0,
+      client_config := ClientConf0} = public_key:pkix_test_data(#{server_chain => 
+                                                                     #{root => [],
+                                                                       intermediates => [[]],
+                                                                       peer => []},
+                                                                 client_chain => 
+                                                                     #{root => [],
+                                                                       intermediates => [[]],
+                                                                       peer => []}}),
+    check_conf_member(ServerConf0, [key, cert, cacerts]),
+    check_conf_member(ClientConf0, [key, cert, cacerts]),
+    
+    3 = length(proplists:get_value(cacerts, ServerConf0)),
+    3 = length(proplists:get_value(cacerts, ServerConf0)),
+
+    #{server_config := ServerConf1,
+      client_config := ClientConf1} = public_key:pkix_test_data(#{server_chain => 
+                                                                     #{root => [],
+                                                                       peer => []},
+                                                                 client_chain => 
+                                                                     #{root => [],
+                                                                       peer => []}}),
+    2 = length(proplists:get_value(cacerts, ServerConf1)),
+    2 = length(proplists:get_value(cacerts, ServerConf1)),
+    
+    check_conf_member(ServerConf1, [key, cert, cacerts]),
+    check_conf_member(ClientConf1, [key, cert, cacerts]).
+    
+
+pkix_test_data() ->
+    [{doc, "Test API function pkix_test_data/1"}].
+
+pkix_test_data(Config) when is_list(Config) ->
+    {Year, Month, Day} = date(),
+    Keygen = 
+        case crypto:ec_curves() of
+        [] ->
+            {rsa, 2048, 17};
+        [Curve |_] ->
+            Oid = pubkey_cert_records:namedCurves(Curve),
+            {namedCurve, Oid}
+        end,
+    #{server_config := ServerConf0,
+      client_config := ClientConf0} = 
+        public_key:pkix_test_data(#{server_chain => 
+                                        #{root => [],
+                                          intermediates => [],
+                                          peer => [{key, hardcode_rsa_key()}]},
+                                    client_chain => 
+                                        #{root => [{validity, {{Year-2, Month, Day}, 
+                                                               {Year-1, Month, Day}}}],
+                                          intermediates => 
+                                              [[{extensions, [#'Extension'{extnID = ?'id-ce-basicConstraints',
+                                                                           extnValue = #'BasicConstraints'{cA=true, 
+                                                                                             pathLenConstraint = 1},
+                                                                           critical = true}]}]],
+                                               peer => [{key, Keygen}, {digest, sha1}]}}),
+    check_conf_member(ServerConf0, [key, cert, cacerts]),
+    check_conf_member(ClientConf0, [key, cert, cacerts]).
+
+   
+                                 
+check_conf_member(_, []) ->
+    true;
+check_conf_member(Conf, [Member | Rest]) ->
+    case lists:keymember(Member, 1, Conf) of
+        true ->
+            check_conf_member(Conf, Rest);
+        false ->
+            ct:fail({misssing_conf, Member})
+    end.
+                              
+%%--------------------------------------------------------------------
 short_cert_issuer_hash() ->
     [{doc, "Test OpenSSL-style hash for certificate issuer"}].
 
@@ -1168,3 +1256,15 @@ ssh_hostkey(rsa) ->
 	  public_key),
     PKdecoded.
 
+hardcode_rsa_key() ->
+    #'RSAPrivateKey'{
+       version = 'two-prime',
+       modulus = 23995666614853919027835084074500048897452890537492185072956789802729257783422306095699263934587064480357348855732149402060270996295002843755712064937715826848741191927820899197493902093529581182351132392364214171173881547273475904587683433713767834856230531387991145055273426806331200574039205571401702219159773947658558490957010003143162250693492642996408861265758000254664396313741422909188635443907373976005987612936763564996605457102336549804831742940035613780926178523017685712710473543251580072875247250504243621640157403744718833162626193206685233710319205099867303242759099560438381385658382486042995679707669,
+       publicExponent = 17,
+       privateExponent = 11292078406990079542510627799764728892919007311761028269626724613049062486316379339152594792746853873109340637991599718616598115903530750002688030558925094987642913848386305504703012749896273497577003478759630198199473669305165131570674557041773098755873191241407597673069847908861741446606684974777271632545629600685952292605647052193819136445675100211504432575554351515262198132231537860917084269870590492135731720141577986787033006338680118008484613510063003323516659048210893001173583018220214626635609151105287049126443102976056146630518124476470236027123782297108342869049542023328584384300970694412006494684657,
+       prime1 = 169371138592582642967021557955633494538845517070305333860805485424261447791289944610138334410987654265476540480228705481960508520379619587635662291973699651583489223555422528867090299996446070521801757353675026048850480903160224210802452555900007597342687137394192939372218903554801584969667104937092080815197,
+       prime2 = 141675062317286527042995673340952251894209529891636708844197799307963834958115010129693036021381525952081167155681637592199810112261679449166276939178032066869788822014115556349519329537177920752776047051833616197615329017439297361972726138285974555338480581117881706656603857310337984049152655480389797687577,
+       exponent1 = 119556097830058336212015217380447172615655659108450823901745048534772786676204666783627059584226579481512852103690850928442711896738555003036938088452023283470698275450886490965004917644550167427154181661417665446247398284583687678213495921811770068712485038160606780733330990744565824684470897602653233516609,
+       exponent2 = 41669135975672507953822256864985956439473391144599032012999352737636422046504414744027363535700448809435637398729893409470532385959317485048904982111185902020526124121798693043976273393287623750816484427009887116945685005129205106462566511260580751570141347387612266663707016855981760014456663376585234613993,
+       coefficient = 76837684977089699359024365285678488693966186052769523357232308621548155587515525857011429902602352279058920284048929101483304120686557782043616693940283344235057989514310975192908256494992960578961614059245280827077951132083993754797053182279229469590276271658395444955906108899267024101096069475145863928441,
+       otherPrimeInfos = asn1_NOVALUE}.
diff --git a/lib/public_key/vsn.mk b/lib/public_key/vsn.mk
index 83a77d2a28..bb96c2237d 100644
--- a/lib/public_key/vsn.mk
+++ b/lib/public_key/vsn.mk
@@ -1 +1 @@
-PUBLIC_KEY_VSN = 1.4.1
+PUBLIC_KEY_VSN = 1.5
diff --git a/lib/ssl/src/ssl.app.src b/lib/ssl/src/ssl.app.src
index 064dcd6892..51407ef3b9 100644
--- a/lib/ssl/src/ssl.app.src
+++ b/lib/ssl/src/ssl.app.src
@@ -63,7 +63,7 @@
     {applications, [crypto, public_key, kernel, stdlib]},
     {env, []},
     {mod, {ssl_app, []}},
-    {runtime_dependencies, ["stdlib-3.2","public_key-1.2","kernel-3.0",
+    {runtime_dependencies, ["stdlib-3.2","public_key-1.5","kernel-3.0",
 			    "erts-7.0","crypto-3.3", "inets-5.10.7"]}]}.
 
 
diff --git a/lib/ssl/test/ssl_ECC_SUITE.erl b/lib/ssl/test/ssl_ECC_SUITE.erl
index 64e8042b25..f38c0a7416 100644
--- a/lib/ssl/test/ssl_ECC_SUITE.erl
+++ b/lib/ssl/test/ssl_ECC_SUITE.erl
@@ -232,103 +232,150 @@ end_per_testcase(_TestCase, Config) ->
 
 %% ECDH_RSA 
 client_ecdh_rsa_server_ecdh_rsa(Config) when is_list(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([],
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}],
                                                       ecdh_rsa, ecdh_rsa, Config),
     basic_test(COpts, SOpts, [{check_keyex, ecdh_rsa} | proplists:delete(check_keyex, Config)]).
 client_ecdhe_rsa_server_ecdh_rsa(Config)  when is_list(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([], ecdhe_rsa, ecdh_rsa, Config),
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}], 
+                                                      ecdhe_rsa, ecdh_rsa, Config),
     basic_test(COpts, SOpts,  [{check_keyex, ecdh_rsa} | proplists:delete(check_keyex, Config)]).
 client_ecdhe_ecdsa_server_ecdh_rsa(Config)  when is_list(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([],ecdhe_ecdsa, ecdh_rsa, Config),
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}],
+                                                      ecdhe_ecdsa, ecdh_rsa, Config),
     basic_test(COpts, SOpts,  [{check_keyex, ecdh_rsa} | proplists:delete(check_keyex, Config)]).
 
 %% ECDHE_RSA    
 client_ecdh_rsa_server_ecdhe_rsa(Config)  when is_list(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([], ecdh_rsa, ecdhe_rsa, Config),
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}], 
+                                                      ecdh_rsa, ecdhe_rsa, Config),
     basic_test(COpts, SOpts,  [{check_keyex, ecdhe_rsa} | proplists:delete(check_keyex, Config)]).
 client_ecdhe_rsa_server_ecdhe_rsa(Config)  when is_list(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([], ecdhe_rsa, ecdhe_rsa, Config),
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}], 
+                                                      ecdhe_rsa, ecdhe_rsa, Config),
     basic_test(COpts, SOpts,   [{check_keyex, ecdhe_rsa} | proplists:delete(check_keyex, Config)]).
 client_ecdhe_ecdsa_server_ecdhe_rsa(Config)  when is_list(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([],ecdh_ecdsa, ecdhe_rsa, Config),
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}],
+                                                      ecdh_ecdsa, ecdhe_rsa, Config),
     basic_test(COpts, SOpts,   [{check_keyex, ecdhe_rsa} | proplists:delete(check_keyex, Config)]).
-   
+
 %% ECDH_ECDSA
 client_ecdh_ecdsa_server_ecdh_ecdsa(Config)  when is_list(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_peer_opts, 
-                                                        [{extensions, [{key_usage, [keyEncipherment]
-                                                                       }]}]}],
+    Ext = x509_test:extensions([{key_usage, [keyEncipherment]}]),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, 
+                                                        [[], [], [{extensions, Ext}]]},
+                                                       {client_chain,
+                                                         ssl_test_lib:default_cert_chain_conf()}],
                                                       ecdh_ecdsa, ecdh_ecdsa, Config),
     basic_test(COpts, SOpts,
                [{check_keyex, ecdh_ecdsa} | proplists:delete(check_keyex, Config)]).
 client_ecdhe_rsa_server_ecdh_ecdsa(Config)  when is_list(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_peer_opts, 
-                                                        [{extensions, [{key_usage, [keyEncipherment]
-                                                                       }]}]}],
-                                                      ecdhe_rsa, ecdh_ecdsa, Config),
-    basic_test(COpts, SOpts, [{check_keyex, ecdh_ecdsa} | proplists:delete(check_keyex, Config)]).
+     Ext = x509_test:extensions([{key_usage, [keyEncipherment]}]),
+     {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, 
+                                                         [[], [], [{extensions, Ext}]]},
+                                                        {client_chain,
+                                                         ssl_test_lib:default_cert_chain_conf()}],
+                                                       ecdhe_rsa, ecdh_ecdsa, Config),
+     basic_test(COpts, SOpts, [{check_keyex, ecdh_ecdsa} | proplists:delete(check_keyex, Config)]).
 
 client_ecdhe_ecdsa_server_ecdh_ecdsa(Config)  when is_list(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_peer_opts, 
-                                                        [{extensions, [{key_usage, [keyEncipherment]
-                                                                       }]}]}],
-                                                      ecdhe_ecdsa, ecdh_ecdsa, Config),
+    Ext = x509_test:extensions([{key_usage, [keyEncipherment]}]),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, 
+                                                        [[], [], [{extensions, Ext}]]},
+                                                       {client_chain,
+                                                        ssl_test_lib:default_cert_chain_conf()}],
+                                                       ecdhe_ecdsa, ecdh_ecdsa, Config),
     basic_test(COpts, SOpts,
                [{check_keyex, ecdh_ecdsa} | proplists:delete(check_keyex, Config)]).
 
 %% ECDHE_ECDSA
 client_ecdh_rsa_server_ecdhe_ecdsa(Config)  when is_list(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([], ecdh_rsa, ecdhe_ecdsa, Config), 
+     Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}], 
+                                                      ecdh_rsa, ecdhe_ecdsa, Config), 
     basic_test(COpts, SOpts, [{check_keyex, ecdhe_ecdsa} | proplists:delete(check_keyex, Config)]).
 client_ecdh_ecdsa_server_ecdhe_ecdsa(Config)  when is_list(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([], ecdh_ecdsa, ecdhe_ecdsa, Config), 
+     Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}], 
+                                                      ecdh_ecdsa, ecdhe_ecdsa, Config), 
     basic_test(COpts, SOpts, [{check_keyex, ecdhe_ecdsa} | proplists:delete(check_keyex, Config)]).
 client_ecdhe_ecdsa_server_ecdhe_ecdsa(Config)  when is_list(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([], ecdhe_ecdsa, ecdhe_ecdsa, Config),
+    Default = ssl_test_lib:default_cert_chain_conf(),
+     {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                        {client_chain, Default}], 
+                                                       ecdhe_ecdsa, ecdhe_ecdsa, Config),
     basic_test(COpts, SOpts, [{check_keyex, ecdhe_ecdsa} | proplists:delete(check_keyex, Config)]).
 
 client_ecdsa_server_ecdsa_with_raw_key(Config)  when is_list(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([], ecdhe_ecdsa, ecdhe_ecdsa, Config),
+     Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}]
+                                                     , ecdhe_ecdsa, ecdhe_ecdsa, Config),
     ServerKeyFile = proplists:get_value(keyfile, SOpts),
     {ok, PemBin} = file:read_file(ServerKeyFile),
     PemEntries = public_key:pem_decode(PemBin),
-    {'ECPrivateKey', Key, not_encrypted} = proplists:lookup('ECPrivateKey', PemEntries),
+     {'ECPrivateKey', Key, not_encrypted} = proplists:lookup('ECPrivateKey', PemEntries),
     ServerKey = {'ECPrivateKey', Key},
     SType = proplists:get_value(server_type, Config),
     CType = proplists:get_value(client_type, Config),
     {Server, Port} = start_server_with_raw_key(SType,
                                                [{key, ServerKey} | proplists:delete(keyfile, SOpts)],
-                                               Config),
+                                                Config),
     Client = start_client(CType, Port, COpts, Config),
-    check_result(Server, SType, Client, CType),
+     check_result(Server, SType, Client, CType),
     close(Server, Client).
 
 ecc_default_order(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([],ecdhe_ecdsa, ecdhe_ecdsa, Config),   
+    Default = ssl_test_lib:default_cert_chain_conf(),
+     {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                        {client_chain, Default}],
+                                                       ecdhe_ecdsa, ecdhe_ecdsa, Config),   
     ECCOpts = [],
     case supported_eccs([{eccs, [sect571r1]}]) of
         true -> ecc_test(sect571r1, COpts, SOpts, [], ECCOpts, Config);
         false -> {skip, "unsupported named curves"}
-    end.
+     end.
 
 ecc_default_order_custom_curves(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([],ecdhe_ecdsa, ecdhe_ecdsa, Config),   
+    Default = ssl_test_lib:default_cert_chain_conf(),
+     {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                        {client_chain, Default}],
+                                                       ecdhe_ecdsa, ecdhe_ecdsa, Config),   
     ECCOpts = [{eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
-        true -> ecc_test(sect571r1, COpts, SOpts, [], ECCOpts, Config);
+         true -> ecc_test(sect571r1, COpts, SOpts, [], ECCOpts, Config);
         false -> {skip, "unsupported named curves"}
     end.
 
 ecc_client_order(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([],ecdhe_ecdsa, ecdhe_ecdsa, Config),   
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}],
+                                                      ecdhe_ecdsa, ecdhe_ecdsa, Config),   
     ECCOpts = [{honor_ecc_order, false}],
     case supported_eccs([{eccs, [sect571r1]}]) of
-        true -> ecc_test(sect571r1, COpts, SOpts, [], ECCOpts, Config);
+         true -> ecc_test(sect571r1, COpts, SOpts, [], ECCOpts, Config);
         false -> {skip, "unsupported named curves"}
     end.
 
 ecc_client_order_custom_curves(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([],ecdhe_ecdsa, ecdhe_ecdsa, Config),   
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default},
+                                                        {client_chain, Default}],
+                                                      ecdhe_ecdsa, ecdhe_ecdsa, Config),   
     ECCOpts = [{honor_ecc_order, false}, {eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
         true -> ecc_test(sect571r1, COpts, SOpts, [], ECCOpts, Config);
@@ -336,45 +383,62 @@ ecc_client_order_custom_curves(Config) ->
     end.
 
 ecc_unknown_curve(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([],ecdhe_ecdsa, ecdhe_ecdsa, Config),   
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default},
+                                                       {client_chain, Default}],
+                                                      ecdhe_ecdsa, ecdhe_ecdsa, Config),   
     ECCOpts = [{eccs, ['123_fake_curve']}],
     ecc_test_error(COpts, SOpts, [], ECCOpts, Config).
 
 client_ecdh_rsa_server_ecdhe_ecdsa_server_custom(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([],ecdh_rsa, ecdhe_ecdsa, Config),
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default},
+                                                       {client_chain, Default}], 
+                                                      ecdh_rsa, ecdhe_ecdsa, Config),
     ECCOpts = [{honor_ecc_order, true}, {eccs, [secp256r1, sect571r1]}],
-    case supported_eccs(ECCOpts) of
-        true -> ecc_test(secp256r1, COpts, SOpts, [], ECCOpts, Config);
-        false -> {skip, "unsupported named curves"}
-    end.
+     case supported_eccs(ECCOpts) of
+         true -> ecc_test(secp256r1, COpts, SOpts, [], ECCOpts, Config);
+         false -> {skip, "unsupported named curves"}
+     end.
 
 client_ecdh_rsa_server_ecdhe_rsa_server_custom(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([],ecdh_rsa, ecdhe_rsa, Config),
-    ECCOpts = [{honor_ecc_order, true}, {eccs, [secp256r1, sect571r1]}],
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}],
+                                                      ecdh_rsa, ecdhe_rsa, Config),
+     ECCOpts = [{honor_ecc_order, true}, {eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
         true -> ecc_test(undefined, COpts, SOpts, [], ECCOpts, Config);
         false -> {skip, "unsupported named curves"}
     end.
 
 client_ecdhe_rsa_server_ecdhe_ecdsa_server_custom(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([],ecdhe_rsa, ecdhe_ecdsa, Config),
+    Default = ssl_test_lib:default_cert_chain_conf(),
+     {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                        {client_chain, Default}],
+                                                       ecdhe_rsa, ecdhe_ecdsa, Config),
     ECCOpts = [{honor_ecc_order, true}, {eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
-        true -> ecc_test(secp256r1, COpts, SOpts, [], ECCOpts, Config);
+         true -> ecc_test(secp256r1, COpts, SOpts, [], ECCOpts, Config);
         false -> {skip, "unsupported named curves"}
     end.
 
 client_ecdhe_rsa_server_ecdhe_rsa_server_custom(Config) ->
-   {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([], ecdhe_rsa, ecdhe_rsa, Config),
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}], 
+                                                      ecdhe_rsa, ecdhe_rsa, Config),
     ECCOpts = [{honor_ecc_order, true}, {eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
         true -> ecc_test(undefined, COpts, SOpts, [], ECCOpts, Config);
         false -> {skip, "unsupported named curves"}
-    end.
+     end.
 client_ecdhe_rsa_server_ecdh_rsa_server_custom(Config) ->
-   {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_peer_opts, 
-                                                        [{extensions, [{key_usage, [keyEncipherment]
-                                                                       }]}]}], ecdhe_rsa, ecdh_rsa, Config),
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    Ext = x509_test:extensions([{key_usage, [keyEncipherment]}]),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, [[], [], [{extensions, Ext}]]},
+                                                       {client_chain, Default}], 
+                                                      ecdhe_rsa, ecdh_rsa, Config),
     ECCOpts = [{honor_ecc_order, true}, {eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
         true -> ecc_test(undefined, COpts, SOpts, [], ECCOpts, Config);
@@ -382,7 +446,10 @@ client_ecdhe_rsa_server_ecdh_rsa_server_custom(Config) ->
     end.
 
 client_ecdhe_ecdsa_server_ecdhe_ecdsa_server_custom(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([], ecdhe_ecdsa, ecdhe_ecdsa, Config),
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}], 
+                                                      ecdhe_ecdsa, ecdhe_ecdsa, Config),
     ECCOpts = [{honor_ecc_order, true}, {eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
         true -> ecc_test(secp256r1, COpts, SOpts, [], ECCOpts, Config);
@@ -390,7 +457,10 @@ client_ecdhe_ecdsa_server_ecdhe_ecdsa_server_custom(Config) ->
     end.
 
 client_ecdhe_ecdsa_server_ecdhe_rsa_server_custom(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([],ecdhe_ecdsa, ecdhe_rsa, Config),
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}],
+                                                      ecdhe_ecdsa, ecdhe_rsa, Config),
     ECCOpts = [{honor_ecc_order, true}, {eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
         true -> ecc_test(undefined, COpts, SOpts, [], ECCOpts, Config);
@@ -398,7 +468,10 @@ client_ecdhe_ecdsa_server_ecdhe_rsa_server_custom(Config) ->
     end.
 
 client_ecdhe_ecdsa_server_ecdhe_ecdsa_client_custom(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([],ecdhe_ecdsa, ecdhe_ecdsa, Config),
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}],
+                                                      ecdhe_ecdsa, ecdhe_ecdsa, Config),
     ECCOpts = [{eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
         true -> ecc_test(secp256r1, COpts, SOpts, ECCOpts, [], Config);
@@ -406,7 +479,10 @@ client_ecdhe_ecdsa_server_ecdhe_ecdsa_client_custom(Config) ->
     end.
 
 client_ecdhe_rsa_server_ecdhe_ecdsa_client_custom(Config) ->
-    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([],ecdhe_rsa, ecdhe_ecdsa, Config),
+    Default = ssl_test_lib:default_cert_chain_conf(),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
+                                                       {client_chain, Default}],
+                                                      ecdhe_rsa, ecdhe_ecdsa, Config),
     ECCOpts = [{eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
         true -> ecc_test(secp256r1, COpts, SOpts, ECCOpts, [], Config);
diff --git a/lib/ssl/test/ssl_certificate_verify_SUITE.erl b/lib/ssl/test/ssl_certificate_verify_SUITE.erl
index c3fd73bf09..0bc265fa10 100644
--- a/lib/ssl/test/ssl_certificate_verify_SUITE.erl
+++ b/lib/ssl/test/ssl_certificate_verify_SUITE.erl
@@ -439,7 +439,7 @@ server_require_peer_cert_partial_chain_fun_fail(Config) when is_list(Config) ->
     [{_,_,_}, {_, IntermidiateCA, _} | _] = public_key:pem_decode(ServerCAs),
 
     PartialChain =  fun(_CertChain) ->
-			   ture = false %% crash on purpose
+                            ture = false %% crash on purpose
 		    end,
 
     Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
@@ -567,9 +567,12 @@ cert_expired() ->
 cert_expired(Config) when is_list(Config) ->
     {Year, Month, Day} = date(),
     Active = proplists:get_value(active, Config),
-    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_ca_0, 
-                                                                     [{validity, {{Year-2, Month, Day}, 
-                                                                                  {Year-1, Month, Day}}}]}], 
+    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_chain,
+                                                                     [[], 
+                                                                      [{validity, {{Year-2, Month, Day}, 
+                                                                                   {Year-1, Month, Day}}}],
+                                                                      []
+                                                                     ]}], 
                                                                    Config, "_expired"),
     ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
     ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),                                                     
@@ -598,11 +601,11 @@ extended_key_usage_verify_server() ->
     [{doc,"Test cert that has a critical extended_key_usage extension in server cert"}].
 
 extended_key_usage_verify_server(Config) when is_list(Config) -> 
-    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_peer_opts, 
-                                                                     [{extensions, 
-                                                                       [{?'id-ce-extKeyUsage',
-                                                                         [?'id-kp-serverAuth'], true}]
-                                                                      }]}], Config, "_keyusage_server"),
+    Ext = x509_test:extensions([{?'id-ce-extKeyUsage',
+                                 [?'id-kp-serverAuth'], true}]),
+    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_chain, 
+                                                                     [[],[], [{extensions, Ext}]]}], Config, 
+                                                                   "_keyusage_server"),
     ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
     ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),                                                     
     Active = proplists:get_value(active, Config),
@@ -632,14 +635,13 @@ extended_key_usage_verify_both() ->
     [{doc,"Test cert that has a critical extended_key_usage extension in client verify_peer mode"}].
 
 extended_key_usage_verify_both(Config) when is_list(Config) ->
-     {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_peer_opts, 
-                                                                      [{extensions, [{?'id-ce-extKeyUsage',
-                                                                                      [?'id-kp-serverAuth'], true}]
-                                                                      }]},
-                                                                     {client_peer_opts, 
-                                                                      [{extensions, [{?'id-ce-extKeyUsage',
-                                                                                      [?'id-kp-clientAuth'], true}]
-                                                                      }]}], Config, "_keyusage_both"),
+    ServerExt = x509_test:extensions([{?'id-ce-extKeyUsage',
+                                       [?'id-kp-serverAuth'], true}]),
+    ClientExt = x509_test:extensions([{?'id-ce-extKeyUsage',
+                                       [?'id-kp-clientAuth'], true}]),
+    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{client_chain, [[],[],[{extensions, ClientExt}]]},
+                                                                    {server_chain, [[],[],[{extensions, ServerExt}]]}], 
+                                                                   Config, "_keyusage_both"),
     ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
     ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),        
     Active = proplists:get_value(active, Config),
@@ -668,10 +670,10 @@ critical_extension_verify_server() ->
     [{doc,"Test cert that has a critical unknown extension in verify_peer mode"}].
 
 critical_extension_verify_server(Config) when is_list(Config) ->
-    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{client_peer_opts, 
-                                                                     [{extensions, [{{2,16,840,1,113730,1,1},
-                                                                                      <<3,2,6,192>>, true}]
-                                                                      }]}], Config, "_client_unknown_extension"),
+    Ext = x509_test:extensions([{{2,16,840,1,113730,1,1}, <<3,2,6,192>>, true}]),
+    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{client_chain, 
+                                                                     [[],[], [{extensions, Ext}]]}], 
+                                                                   Config, "_client_unknown_extension"),
     ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
     ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),              
     Active = proplists:get_value(active, Config),
@@ -705,10 +707,10 @@ critical_extension_verify_client() ->
     [{doc,"Test cert that has a critical unknown extension in verify_peer mode"}].
 
 critical_extension_verify_client(Config) when is_list(Config) ->
-    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_peer_opts, 
-                                                                     [{extensions, [{{2,16,840,1,113730,1,1},
-                                                                                     <<3,2,6,192>>, true}]
-                                                                      }]}], Config, "_server_unknown_extensions"),
+    Ext = x509_test:extensions([{{2,16,840,1,113730,1,1}, <<3,2,6,192>>, true}]),
+    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_chain, 
+                                                                     [[],[],[{extensions, Ext}]]}], 
+                                                                   Config, "_server_unknown_extensions"),
     ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
     ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),              
     Active = proplists:get_value(active, Config),
@@ -741,11 +743,10 @@ critical_extension_verify_none() ->
     [{doc,"Test cert that has a critical unknown extension in verify_none mode"}].
 
 critical_extension_verify_none(Config) when is_list(Config) ->
-    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{client_peer_opts, 
-                                                                     [{extensions, 
-                                                                       [{{2,16,840,1,113730,1,1},
-                                                                          <<3,2,6,192>>, true}]
-                                                                      }]}], Config, "_unknown_extensions"),
+    Ext = x509_test:extensions([{{2,16,840,1,113730,1,1}, <<3,2,6,192>>, true}]),
+    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_chain, 
+                                                                     [[],[], [{extensions, Ext}]]}], 
+                                                                   Config, "_unknown_extensions"),
     ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
     ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),             
     Active = proplists:get_value(active, Config),
@@ -780,12 +781,7 @@ no_authority_key_identifier() ->
       " but are present in trusted certs db."}].
 
 no_authority_key_identifier(Config) when is_list(Config) ->
-   {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_peer_opts, 
-                                                                      [{extensions, [{auth_key_id, undefined}]
-                                                                      }]},
-                                                                     {client_peer_opts, 
-                                                                      [{extensions, [{auth_key_id, undefined}]
-                                                                       }]}], Config, "_peer_no_auth_key_id"),
+   {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([], Config, "_peer_no_auth_key_id"),
     ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
     ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),        
 
@@ -822,14 +818,10 @@ no_authority_key_identifier_keyEncipherment() ->
       " authorityKeyIdentifier extension, but are present in trusted certs db."}].
 
 no_authority_key_identifier_keyEncipherment(Config) when is_list(Config) ->
-    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_peer_opts, 
-                                                                      [{extensions, [{auth_key_id, undefined},
-                                                                                     {key_usage, [digitalSignature,
-                                                                                                  keyEncipherment]}]
-                                                                      }]},
-                                                                     {client_peer_opts, 
-                                                                      [{extensions, [{auth_key_id, undefined}]
-                                                                       }]}], Config, "_peer_keyEncipherment"),
+    ClientExt = x509_test:extensions([{key_usage, [digitalSignature, keyEncipherment]}]),
+    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{client_chain, 
+                                                                     [[],[],[{extensions, ClientExt}]]}], 
+                                                                   Config, "_peer_keyEncipherment"),
     ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
     ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),        
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
@@ -932,12 +924,10 @@ client_with_cert_cipher_suites_handshake() ->
     [{doc, "Test that client with a certificate without keyEncipherment usage "
     " extension can connect to a server with restricted cipher suites "}].
 client_with_cert_cipher_suites_handshake(Config) when is_list(Config) ->
-  {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{client_peer_opts, 
-                                                                     [{extensions, 
-                                                                       [{key_usage, [digitalSignature]}]
-                                                                      }]}], Config, "_sign_only_extensions"),
-    
-
+    Ext = x509_test:extensions([{key_usage, [digitalSignature]}]),
+  {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{client_chain, 
+                                                                     [[], [], [{extensions, Ext}]]}], 
+                                                                 Config, "_sign_only_extensions"),
     ClientOpts =  ssl_test_lib:ssl_options(ClientOpts0, Config),
     ServerOpts =  ssl_test_lib:ssl_options(ServerOpts0, Config),
 
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index aae2927575..13265debb1 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -449,11 +449,12 @@ make_dsa_cert(Config) ->
     CryptoSupport = crypto:supports(),
     case proplists:get_bool(dss, proplists:get_value(public_keys, CryptoSupport)) of
         true ->
+            ClientChain = proplists:get_value(client_chain, Config, default_cert_chain_conf()),
+            ServerChain = proplists:get_value(server_chain, Config, default_cert_chain_conf()),
+            CertChainConf = gen_conf(dsa, dsa, ClientChain, ServerChain),
             ClientFileBase = filename:join([proplists:get_value(priv_dir, Config), "dsa"]),
             ServerFileBase = filename:join([proplists:get_value(priv_dir, Config), "dsa"]),
-            KeyGenSpec = key_gen_info(dsa, dsa),
-            
-            GenCertData = x509_test:gen_test_certs([{digest, sha} | KeyGenSpec]),
+            GenCertData = public_key:pkix_test_data(CertChainConf),
             [{server_config, ServerConf}, 
              {client_config, ClientConf}] = 
                 x509_test:gen_pem_config_files(GenCertData, ClientFileBase, ServerFileBase),
@@ -469,12 +470,13 @@ make_dsa_cert(Config) ->
       false ->
           Config
   end.
-make_rsa_cert_chains(ChainConf, Config, Suffix) ->
-   CryptoSupport = crypto:supports(),
-    KeyGenSpec = key_gen_info(rsa, rsa),
+make_rsa_cert_chains(UserConf, Config, Suffix) ->
+    ClientChain = proplists:get_value(client_chain, UserConf, default_cert_chain_conf()),
+    ServerChain = proplists:get_value(server_chain, UserConf, default_cert_chain_conf()),
+    CertChainConf = gen_conf(rsa, rsa, ClientChain, ServerChain),
     ClientFileBase = filename:join([proplists:get_value(priv_dir, Config), "rsa" ++ Suffix]),
     ServerFileBase = filename:join([proplists:get_value(priv_dir, Config), "rsa" ++ Suffix]),
-    GenCertData = x509_test:gen_test_certs([{digest, appropriate_sha(CryptoSupport)} | KeyGenSpec] ++ ChainConf),
+    GenCertData = public_key:pkix_test_data(CertChainConf),
     [{server_config, ServerConf}, 
      {client_config, ClientConf}] = 
         x509_test:gen_pem_config_files(GenCertData, ClientFileBase, ServerFileBase),               
@@ -482,12 +484,13 @@ make_rsa_cert_chains(ChainConf, Config, Suffix) ->
      [{reuseaddr, true}, {verify, verify_peer} | ServerConf]
     }.
 
-make_ec_cert_chains(ChainConf, ClientChainType, ServerChainType, Config) ->
-    CryptoSupport = crypto:supports(),
-    KeyGenSpec = key_gen_info(ClientChainType, ServerChainType),
+make_ec_cert_chains(UserConf, ClientChainType, ServerChainType, Config) ->
+    ClientChain = proplists:get_value(client_chain, UserConf, default_cert_chain_conf()),
+    ServerChain = proplists:get_value(server_chain, UserConf, default_cert_chain_conf()),
+    CertChainConf = gen_conf(ClientChainType, ServerChainType, ClientChain, ServerChain),
     ClientFileBase = filename:join([proplists:get_value(priv_dir, Config), atom_to_list(ClientChainType)]),
     ServerFileBase = filename:join([proplists:get_value(priv_dir, Config), atom_to_list(ServerChainType)]),
-    GenCertData = x509_test:gen_test_certs([{digest, appropriate_sha(CryptoSupport)} | KeyGenSpec] ++ ChainConf),
+    GenCertData = public_key:pkix_test_data(CertChainConf),
     [{server_config, ServerConf}, 
      {client_config, ClientConf}] = 
         x509_test:gen_pem_config_files(GenCertData, ClientFileBase, ServerFileBase),               
@@ -495,56 +498,113 @@ make_ec_cert_chains(ChainConf, ClientChainType, ServerChainType, Config) ->
      [{reuseaddr, true}, {verify, verify_peer} | ServerConf]
     }.
 
-key_gen_info(ClientChainType, ServerChainType) ->
-    key_gen_spec("client", ClientChainType) ++ key_gen_spec("server", ServerChainType).
+default_cert_chain_conf() ->
+    %% Use only default options
+    [[],[],[]].
+
+gen_conf(ClientChainType, ServerChainType, UserClient, UserServer) ->
+    ClientTag = conf_tag("client"),
+    ServerTag = conf_tag("server"),
+
+    DefaultClient = chain_spec(client, ClientChainType), 
+    DefaultServer = chain_spec(server, ServerChainType),
+    
+    ClientConf = merge_chain_spec(UserClient, DefaultClient, []),
+    ServerConf = merge_chain_spec(UserServer, DefaultServer, []),
+    
+    new_format([{ClientTag, ClientConf}, {ServerTag, ServerConf}]).
+
+new_format(Conf) ->
+    CConf = proplists:get_value(client_chain, Conf),
+    SConf = proplists:get_value(server_chain, Conf),
+    #{server_chain => proplist_to_map(SConf),
+      client_chain => proplist_to_map(CConf)}.
+
+proplist_to_map([Head | Rest]) -> 
+    [Last | Tail] = lists:reverse(Rest),
+    #{root => Head,
+      intermediates => lists:reverse(Tail),
+      peer => Last}.
+
+conf_tag(Role) ->
+    list_to_atom(Role ++ "_chain").
 
-key_gen_spec(Role, ecdh_rsa) ->
+chain_spec(_Role, ecdh_rsa) ->
+    Digest = {digest, appropriate_sha(crypto:supports())},
     CurveOid = hd(tls_v1:ecc_curves(0)),
-    [{list_to_atom(Role ++ "_key_gen"),  {namedCurve, CurveOid}},
-     {list_to_atom(Role ++ "_key_gen_chain"),  [hardcode_rsa_key(1),
-                                                {namedCurve, CurveOid}]}
-    ];
-key_gen_spec(Role, ecdhe_ecdsa) ->
+     [[Digest, {key, {namedCurve, CurveOid}}],
+      [Digest, {key, hardcode_rsa_key(1)}],
+      [Digest, {key, {namedCurve, CurveOid}}]];
+
+chain_spec(_Role, ecdhe_ecdsa) ->
+    Digest = {digest, appropriate_sha(crypto:supports())},
     CurveOid = hd(tls_v1:ecc_curves(0)),
-     [{list_to_atom(Role ++ "_key_gen"),  {namedCurve, CurveOid}},
-      {list_to_atom(Role ++ "_key_gen_chain"),  [{namedCurve, CurveOid},
-                                                 {namedCurve, CurveOid}]}
-    ];
-key_gen_spec(Role, ecdh_ecdsa) ->
+    [[Digest, {key, {namedCurve, CurveOid}}],
+     [Digest, {key, {namedCurve, CurveOid}}],
+     [Digest, {key, {namedCurve, CurveOid}}]];
+
+chain_spec(_Role, ecdh_ecdsa) ->
+    Digest = {digest, appropriate_sha(crypto:supports())},
     CurveOid = hd(tls_v1:ecc_curves(0)),
-    [{list_to_atom(Role ++ "_key_gen"),  {namedCurve, CurveOid}},
-     {list_to_atom(Role ++ "_key_gen_chain"),  [{namedCurve, CurveOid},
-                                                {namedCurve, CurveOid}]}
-    ];
-key_gen_spec(Role, ecdhe_rsa) ->
-    [{list_to_atom(Role ++ "_key_gen"),  hardcode_rsa_key(1)},
-     {list_to_atom(Role ++ "_key_gen_chain"),  [hardcode_rsa_key(2),
-                                                hardcode_rsa_key(3)]}
-    ];
-key_gen_spec(Role, rsa) ->
-    [{list_to_atom(Role ++ "_key_gen"),  hardcode_rsa_key(1)},
-     {list_to_atom(Role ++ "_key_gen_chain"),  [hardcode_rsa_key(2),
-                                                hardcode_rsa_key(3)]}
-    ];
-key_gen_spec(Role, dsa) ->
-    [{list_to_atom(Role ++ "_key_gen"),  hardcode_dsa_key(1)},
-     {list_to_atom(Role ++ "_key_gen_chain"),  [hardcode_dsa_key(2),
-                                                hardcode_dsa_key(3)]}
-    ].
+    [[Digest, {key, {namedCurve, CurveOid}}],
+     [Digest, {key, {namedCurve, CurveOid}}],
+     [Digest, {key, {namedCurve, CurveOid}}]];
+chain_spec(_Role, ecdhe_rsa) ->
+    Digest = {digest, appropriate_sha(crypto:supports())},
+    [[Digest, {key, hardcode_rsa_key(1)}],
+     [Digest, {key, hardcode_rsa_key(2)}],
+     [Digest, {key, hardcode_rsa_key(3)}]];
+chain_spec(_Role, ecdsa) ->
+    Digest = {digest, appropriate_sha(crypto:supports())},
+    CurveOid = hd(tls_v1:ecc_curves(0)),
+    [[Digest, {key, {namedCurve, CurveOid}}],
+     [Digest, {key, {namedCurve, CurveOid}}],
+     [Digest, {key, {namedCurve, CurveOid}}]];
+chain_spec(_Role, rsa) ->
+    Digest = {digest, appropriate_sha(crypto:supports())},
+    [[Digest, {key, hardcode_rsa_key(1)}],
+                                      [Digest, {key, hardcode_rsa_key(2)}],
+                                      [Digest, {key, hardcode_rsa_key(3)}]];
+chain_spec(_Role, dsa) ->
+    Digest = {digest, appropriate_sha(crypto:supports())},
+    [[Digest, {key, hardcode_dsa_key(1)}],
+     [Digest, {key, hardcode_dsa_key(2)}],
+     [Digest, {key, hardcode_dsa_key(3)}]].
+
+merge_chain_spec([], [], Acc)->
+    lists:reverse(Acc);
+merge_chain_spec([User| UserRest], [Default | DefaultRest], Acc) ->
+    Merge = merge_spec(User, Default, confs(), []),
+    merge_chain_spec(UserRest, DefaultRest, [Merge | Acc]).
+
+confs() ->
+    [key, digest, validity, extensions].
+
+merge_spec(_, _, [], Acc) ->
+    Acc;
+merge_spec(User, Default, [Conf | Rest], Acc) ->
+    case proplists:get_value(Conf, User, undefined) of
+        undefined ->
+            case proplists:get_value(Conf, Default, undefined) of
+                undefined ->
+                    merge_spec(User, Default, Rest, Acc);
+                Value  ->
+                    merge_spec(User, Default, Rest, [{Conf, Value} | Acc])
+            end;
+        Value ->
+                merge_spec(User, Default, Rest, [{Conf, Value} | Acc])
+    end.
+
 make_ecdsa_cert(Config) ->
     CryptoSupport = crypto:supports(),
     case proplists:get_bool(ecdsa, proplists:get_value(public_keys, CryptoSupport)) of
         true ->
             ClientFileBase = filename:join([proplists:get_value(priv_dir, Config), "ecdsa"]),
             ServerFileBase = filename:join([proplists:get_value(priv_dir, Config), "ecdsa"]),
-            CurveOid = hd(tls_v1:ecc_curves(0)),
-            GenCertData = x509_test:gen_test_certs([{server_key_gen, {namedCurve, CurveOid}}, 
-                                                    {client_key_gen, {namedCurve, CurveOid}},
-                                                    {server_key_gen_chain, [{namedCurve, CurveOid},
-                                                                            {namedCurve, CurveOid}]},
-                                                    {client_key_gen_chain, [{namedCurve, CurveOid},
-                                                                            {namedCurve, CurveOid}]},
-                                                    {digest, appropriate_sha(CryptoSupport)}]),
+            ClientChain = proplists:get_value(client_chain, Config, default_cert_chain_conf()),
+            ServerChain = proplists:get_value(server_chain, Config, default_cert_chain_conf()),
+            CertChainConf = gen_conf(ecdsa, ecdsa, ClientChain, ServerChain),
+            GenCertData = public_key:pkix_test_data(CertChainConf),
             [{server_config, ServerConf}, 
              {client_config, ClientConf}] = 
                 x509_test:gen_pem_config_files(GenCertData, ClientFileBase, ServerFileBase),               
@@ -563,13 +623,10 @@ make_rsa_cert(Config) ->
         true ->
             ClientFileBase = filename:join([proplists:get_value(priv_dir, Config), "rsa"]),
             ServerFileBase = filename:join([proplists:get_value(priv_dir, Config), "rsa"]),
-            GenCertData = x509_test:gen_test_certs([{server_key_gen, hardcode_rsa_key(1)}, 
-                                                    {client_key_gen, hardcode_rsa_key(2)},
-                                                    {server_key_gen_chain, [hardcode_rsa_key(3),
-                                                                            hardcode_rsa_key(4)]},
-                                                    {client_key_gen_chain, [hardcode_rsa_key(5),
-                                                                            hardcode_rsa_key(6)]},
-                                                    {digest, appropriate_sha(CryptoSupport)}]),
+            ClientChain = proplists:get_value(client_chain, Config, default_cert_chain_conf()),
+            ServerChain = proplists:get_value(server_chain, Config, default_cert_chain_conf()),
+            CertChainConf = gen_conf(rsa, rsa, ClientChain, ServerChain),
+            GenCertData = public_key:pkix_test_data(CertChainConf),
             [{server_config, ServerConf}, 
              {client_config, ClientConf}] = 
                 x509_test:gen_pem_config_files(GenCertData, ClientFileBase, ServerFileBase),               
@@ -601,16 +658,10 @@ make_ecdh_rsa_cert(Config) ->
 	true ->
             ClientFileBase = filename:join([proplists:get_value(priv_dir, Config), "ecdh_rsa"]),
             ServerFileBase = filename:join([proplists:get_value(priv_dir, Config), "ecdh_rsa"]),
-            CurveOid = hd(tls_v1:ecc_curves(0)),
-            GenCertData = x509_test:gen_test_certs([{server_key_gen, {namedCurve, CurveOid}}, 
-                                                    {client_key_gen, {namedCurve, CurveOid}},
-                                                    {server_key_gen_chain, [hardcode_rsa_key(1),
-                                                                            {namedCurve, CurveOid}
-                                                                           ]},
-                                                    {client_key_gen_chain, [hardcode_rsa_key(2),
-                                                                            {namedCurve, CurveOid}
-                                                                           ]},
-                                                    {digest, appropriate_sha(CryptoSupport)}]),
+            ClientChain = proplists:get_value(client_chain, Config, default_cert_chain_conf()),
+            ServerChain = proplists:get_value(server_chain, Config, default_cert_chain_conf()),
+            CertChainConf = gen_conf(ecdh_rsa, ecdh_rsa, ClientChain, ServerChain),
+            GenCertData = public_key:pkix_test_data(CertChainConf),
             [{server_config, ServerConf}, 
              {client_config, ClientConf}] = 
                 x509_test:gen_pem_config_files(GenCertData, ClientFileBase, ServerFileBase),
@@ -1505,73 +1556,79 @@ tls_version(Atom) ->
     tls_record:protocol_version(Atom).
 
 hardcode_rsa_key(1) ->
-    {'RSAPrivateKey', 'two-prime',
-                 23995666614853919027835084074500048897452890537492185072956789802729257783422306095699263934587064480357348855732149402060270996295002843755712064937715826848741191927820899197493902093529581182351132392364214171173881547273475904587683433713767834856230531387991145055273426806331200574039205571401702219159773947658558490957010003143162250693492642996408861265758000254664396313741422909188635443907373976005987612936763564996605457102336549804831742940035613780926178523017685712710473543251580072875247250504243621640157403744718833162626193206685233710319205099867303242759099560438381385658382486042995679707669,
-                 17,
-                 11292078406990079542510627799764728892919007311761028269626724613049062486316379339152594792746853873109340637991599718616598115903530750002688030558925094987642913848386305504703012749896273497577003478759630198199473669305165131570674557041773098755873191241407597673069847908861741446606684974777271632545629600685952292605647052193819136445675100211504432575554351515262198132231537860917084269870590492135731720141577986787033006338680118008484613510063003323516659048210893001173583018220214626635609151105287049126443102976056146630518124476470236027123782297108342869049542023328584384300970694412006494684657,
-                 169371138592582642967021557955633494538845517070305333860805485424261447791289944610138334410987654265476540480228705481960508520379619587635662291973699651583489223555422528867090299996446070521801757353675026048850480903160224210802452555900007597342687137394192939372218903554801584969667104937092080815197,
-                 141675062317286527042995673340952251894209529891636708844197799307963834958115010129693036021381525952081167155681637592199810112261679449166276939178032066869788822014115556349519329537177920752776047051833616197615329017439297361972726138285974555338480581117881706656603857310337984049152655480389797687577,
-                 119556097830058336212015217380447172615655659108450823901745048534772786676204666783627059584226579481512852103690850928442711896738555003036938088452023283470698275450886490965004917644550167427154181661417665446247398284583687678213495921811770068712485038160606780733330990744565824684470897602653233516609,
-                 41669135975672507953822256864985956439473391144599032012999352737636422046504414744027363535700448809435637398729893409470532385959317485048904982111185902020526124121798693043976273393287623750816484427009887116945685005129205106462566511260580751570141347387612266663707016855981760014456663376585234613993,
-                 76837684977089699359024365285678488693966186052769523357232308621548155587515525857011429902602352279058920284048929101483304120686557782043616693940283344235057989514310975192908256494992960578961614059245280827077951132083993754797053182279229469590276271658395444955906108899267024101096069475145863928441,
-                 asn1_NOVALUE};
+    #'RSAPrivateKey'{
+       version = 'two-prime',
+       modulus = 23995666614853919027835084074500048897452890537492185072956789802729257783422306095699263934587064480357348855732149402060270996295002843755712064937715826848741191927820899197493902093529581182351132392364214171173881547273475904587683433713767834856230531387991145055273426806331200574039205571401702219159773947658558490957010003143162250693492642996408861265758000254664396313741422909188635443907373976005987612936763564996605457102336549804831742940035613780926178523017685712710473543251580072875247250504243621640157403744718833162626193206685233710319205099867303242759099560438381385658382486042995679707669,
+       publicExponent = 17,
+       privateExponent = 11292078406990079542510627799764728892919007311761028269626724613049062486316379339152594792746853873109340637991599718616598115903530750002688030558925094987642913848386305504703012749896273497577003478759630198199473669305165131570674557041773098755873191241407597673069847908861741446606684974777271632545629600685952292605647052193819136445675100211504432575554351515262198132231537860917084269870590492135731720141577986787033006338680118008484613510063003323516659048210893001173583018220214626635609151105287049126443102976056146630518124476470236027123782297108342869049542023328584384300970694412006494684657,
+       prime1 = 169371138592582642967021557955633494538845517070305333860805485424261447791289944610138334410987654265476540480228705481960508520379619587635662291973699651583489223555422528867090299996446070521801757353675026048850480903160224210802452555900007597342687137394192939372218903554801584969667104937092080815197,
+       prime2 = 141675062317286527042995673340952251894209529891636708844197799307963834958115010129693036021381525952081167155681637592199810112261679449166276939178032066869788822014115556349519329537177920752776047051833616197615329017439297361972726138285974555338480581117881706656603857310337984049152655480389797687577,
+       exponent1 = 119556097830058336212015217380447172615655659108450823901745048534772786676204666783627059584226579481512852103690850928442711896738555003036938088452023283470698275450886490965004917644550167427154181661417665446247398284583687678213495921811770068712485038160606780733330990744565824684470897602653233516609,
+       exponent2 = 41669135975672507953822256864985956439473391144599032012999352737636422046504414744027363535700448809435637398729893409470532385959317485048904982111185902020526124121798693043976273393287623750816484427009887116945685005129205106462566511260580751570141347387612266663707016855981760014456663376585234613993,
+       coefficient = 76837684977089699359024365285678488693966186052769523357232308621548155587515525857011429902602352279058920284048929101483304120686557782043616693940283344235057989514310975192908256494992960578961614059245280827077951132083993754797053182279229469590276271658395444955906108899267024101096069475145863928441,
+       otherPrimeInfos = asn1_NOVALUE};
 
 hardcode_rsa_key(2) ->
-{'RSAPrivateKey', 'two-prime',
-                 21343679768589700771839799834197557895311746244621307033143551583788179817796325695589283169969489517156931770973490560582341832744966317712674900833543896521418422508485833901274928542544381247956820115082240721897193055368570146764204557110415281995205343662628196075590438954399631753508888358737971039058298703003743872818150364935790613286541190842600031570570099801682794056444451081563070538409720109449780410837763602317050353477918147758267825417201591905091231778937606362076129350476690460157227101296599527319242747999737801698427160817755293383890373574621116766934110792127739174475029121017282777887777,
-                 17,
-                 18832658619343853622211588088997845201745658451136447382185486691577805721584993260814073385267196632785528033211903435807948675951440868570007265441362261636545666919252206383477878125774454042314841278013741813438699754736973658909592256273895837054592950290554290654932740253882028017801960316533503857992358685308186680144968293076156011747178275038098868263178095174694099811498968993700538293188879611375604635940554394589807673542938082281934965292051746326331046224291377703201248790910007232374006151098976879987912446997911775904329728563222485791845480864283470332826504617837402078265424772379987120023773,
-                 146807662748886761089048448970170315054939768171908279335181627815919052012991509112344782731265837727551849787333310044397991034789843793140419387740928103541736452627413492093463231242466386868459637115999163097726153692593711599245170083315894262154838974616739452594203727376460632750934355508361223110419,
-                 145385325050081892763917667176962991350872697916072592966410309213561884732628046256782356731057378829876640317801978404203665761131810712267778698468684631707642938779964806354584156202882543264893826268426566901882487709510744074274965029453915224310656287149777603803201831202222853023280023478269485417083,
-                 51814469205489445090252393754177758254684624060673510353593515699736136004585238510239335081623236845018299924941168250963996835808180162284853901555621683602965806809675350150634081614988136541809283687999704622726877773856604093851236499993845033701707873394143336209718962603456693912094478414715725803677,
-                 51312467664734785681382706062457526359131540440966797517556579722433606376221663384746714140373192528191755406283051201483646739222992016094510128871300458249756331334105225772206172777487956446433115153562317730076172132768497908567634716277852432109643395464627389577600646306666889302334125933506877206029,
-                 30504662229874176232343608562807118278893368758027179776313787938167236952567905398252901545019583024374163153775359371298239336609182249464886717948407152570850677549297935773605431024166978281486607154204888016179709037883348099374995148481968169438302456074511782717758301581202874062062542434218011141540,
- asn1_NOVALUE};
-
+    #'RSAPrivateKey'{
+       version = 'two-prime',
+       modulus = 21343679768589700771839799834197557895311746244621307033143551583788179817796325695589283169969489517156931770973490560582341832744966317712674900833543896521418422508485833901274928542544381247956820115082240721897193055368570146764204557110415281995205343662628196075590438954399631753508888358737971039058298703003743872818150364935790613286541190842600031570570099801682794056444451081563070538409720109449780410837763602317050353477918147758267825417201591905091231778937606362076129350476690460157227101296599527319242747999737801698427160817755293383890373574621116766934110792127739174475029121017282777887777,
+       publicExponent = 17,
+       privateExponent = 18832658619343853622211588088997845201745658451136447382185486691577805721584993260814073385267196632785528033211903435807948675951440868570007265441362261636545666919252206383477878125774454042314841278013741813438699754736973658909592256273895837054592950290554290654932740253882028017801960316533503857992358685308186680144968293076156011747178275038098868263178095174694099811498968993700538293188879611375604635940554394589807673542938082281934965292051746326331046224291377703201248790910007232374006151098976879987912446997911775904329728563222485791845480864283470332826504617837402078265424772379987120023773,
+       prime1 = 146807662748886761089048448970170315054939768171908279335181627815919052012991509112344782731265837727551849787333310044397991034789843793140419387740928103541736452627413492093463231242466386868459637115999163097726153692593711599245170083315894262154838974616739452594203727376460632750934355508361223110419,
+       prime2 = 145385325050081892763917667176962991350872697916072592966410309213561884732628046256782356731057378829876640317801978404203665761131810712267778698468684631707642938779964806354584156202882543264893826268426566901882487709510744074274965029453915224310656287149777603803201831202222853023280023478269485417083,
+       exponent1 = 51814469205489445090252393754177758254684624060673510353593515699736136004585238510239335081623236845018299924941168250963996835808180162284853901555621683602965806809675350150634081614988136541809283687999704622726877773856604093851236499993845033701707873394143336209718962603456693912094478414715725803677,
+       exponent2 = 51312467664734785681382706062457526359131540440966797517556579722433606376221663384746714140373192528191755406283051201483646739222992016094510128871300458249756331334105225772206172777487956446433115153562317730076172132768497908567634716277852432109643395464627389577600646306666889302334125933506877206029,
+       coefficient = 30504662229874176232343608562807118278893368758027179776313787938167236952567905398252901545019583024374163153775359371298239336609182249464886717948407152570850677549297935773605431024166978281486607154204888016179709037883348099374995148481968169438302456074511782717758301581202874062062542434218011141540,
+       otherPrimeInfos = asn1_NOVALUE};
 hardcode_rsa_key(3) -> 
-{'RSAPrivateKey', 'two-prime',
-                 25089040456112869869472694987833070928503703615633809313972554887193090845137746668197820419383804666271752525807484521370419854590682661809972833718476098189250708650325307850184923546875260207894844301992963978994451844985784504212035958130279304082438876764367292331581532569155681984449177635856426023931875082020262146075451989132180409962870105455517050416234175675478291534563995772675388370042873175344937421148321291640477650173765084699931690748536036544188863178325887393475703801759010864779559318631816411493486934507417755306337476945299570726975433250753415110141783026008347194577506976486290259135429,
-                 17,
-                 8854955455098659953931539407470495621824836570223697404931489960185796768872145882893348383311931058684147950284994536954265831032005645344696294253579799360912014817761873358888796545955974191021709753644575521998041827642041589721895044045980930852625485916835514940558187965584358347452650930302268008446431977397918214293502821599497633970075862760001650736520566952260001423171553461362588848929781360590057040212831994258783694027013289053834376791974167294527043946669963760259975273650548116897900664646809242902841107022557239712438496384819445301703021164043324282687280801738470244471443835900160721870265,
-                 171641816401041100605063917111691927706183918906535463031548413586331728772311589438043965564336865070070922328258143588739626712299625805650832695450270566547004154065267940032684307994238248203186986569945677705100224518137694769557564475390859269797990555863306972197736879644001860925483629009305104925823,
-                 146170909759497809922264016492088453282310383272504533061020897155289106805616042710009332510822455269704884883705830985184223718261139908416790475825625309815234508695722132706422885088219618698987115562577878897003573425367881351537506046253616435685549396767356003663417208105346307649599145759863108910523,
-                 60579464612132153154728441333538327425711971378777222246428851853999433684345266860486105493295364142377972586444050678378691780811632637288529186629507258781295583787741625893888579292084087601124818789392592131211843947578009918667375697196773859928702549128225990187436545756706539150170692591519448797349,
-                 137572620950115585809189662580789132500998007785886619351549079675566218169991569609420548245479957900898715184664311515467504676010484619686391036071176762179044243478326713135456833024206699951987873470661533079532774988581535389682358631768109586527575902839864474036157372334443583670210960715165278974609,
-                 15068630434698373319269196003209754243798959461311186548759287649485250508074064775263867418602372588394608558985183294561315208336731894947137343239541687540387209051236354318837334154993136528453613256169847839789803932725339395739618592522865156272771578671216082079933457043120923342632744996962853951612,
- asn1_NOVALUE};
+    #'RSAPrivateKey'{ 
+       version = 'two-prime',
+       modulus = 25089040456112869869472694987833070928503703615633809313972554887193090845137746668197820419383804666271752525807484521370419854590682661809972833718476098189250708650325307850184923546875260207894844301992963978994451844985784504212035958130279304082438876764367292331581532569155681984449177635856426023931875082020262146075451989132180409962870105455517050416234175675478291534563995772675388370042873175344937421148321291640477650173765084699931690748536036544188863178325887393475703801759010864779559318631816411493486934507417755306337476945299570726975433250753415110141783026008347194577506976486290259135429,
+       publicExponent = 17,
+       privateExponent = 8854955455098659953931539407470495621824836570223697404931489960185796768872145882893348383311931058684147950284994536954265831032005645344696294253579799360912014817761873358888796545955974191021709753644575521998041827642041589721895044045980930852625485916835514940558187965584358347452650930302268008446431977397918214293502821599497633970075862760001650736520566952260001423171553461362588848929781360590057040212831994258783694027013289053834376791974167294527043946669963760259975273650548116897900664646809242902841107022557239712438496384819445301703021164043324282687280801738470244471443835900160721870265,
+       prime1 = 171641816401041100605063917111691927706183918906535463031548413586331728772311589438043965564336865070070922328258143588739626712299625805650832695450270566547004154065267940032684307994238248203186986569945677705100224518137694769557564475390859269797990555863306972197736879644001860925483629009305104925823,
+       prime2 =146170909759497809922264016492088453282310383272504533061020897155289106805616042710009332510822455269704884883705830985184223718261139908416790475825625309815234508695722132706422885088219618698987115562577878897003573425367881351537506046253616435685549396767356003663417208105346307649599145759863108910523,
+       exponent1 = 60579464612132153154728441333538327425711971378777222246428851853999433684345266860486105493295364142377972586444050678378691780811632637288529186629507258781295583787741625893888579292084087601124818789392592131211843947578009918667375697196773859928702549128225990187436545756706539150170692591519448797349,
+       exponent2 = 137572620950115585809189662580789132500998007785886619351549079675566218169991569609420548245479957900898715184664311515467504676010484619686391036071176762179044243478326713135456833024206699951987873470661533079532774988581535389682358631768109586527575902839864474036157372334443583670210960715165278974609,
+       coefficient = 15068630434698373319269196003209754243798959461311186548759287649485250508074064775263867418602372588394608558985183294561315208336731894947137343239541687540387209051236354318837334154993136528453613256169847839789803932725339395739618592522865156272771578671216082079933457043120923342632744996962853951612,
+       otherPrimeInfos = asn1_NOVALUE};
 hardcode_rsa_key(4) -> 
-{'RSAPrivateKey', 'two-prime',
-                 28617237755030755643854803617273584643843067580642149032833640135949799721163782522787597288521902619948688786051081993247908700824196122780349730169173433743054172191054872553484065655968335396052034378669869864779940355219732200954630251223541048434478476115391643898092650304645086338265930608997389611376417609043761464100338332976874588396803891301015812818307951159858145399281035705713082131199940309445719678087542976246147777388465712394062188801177717719764254900022006288880246925156931391594131839991579403409541227225173269459173129377291869028712271737734702830877034334838181789916127814298794576266389,
-                 17,
-                 26933870828264240605980991639786903194205240075898493207372837775011576208154148256741268036255908348187001210401018346586267012540419880263858569570986761169933338532757527109161473558558433313931326474042230460969355628442100895016122589386862163232450330461545076609969553227901257730132640573174013751883368376011370428995523268034111482031427024082719896108094847702954695363285832195666458915142143884210891427766607838346722974883433132513540317964796373298134261669479023445911856492129270184781873446960437310543998533283339488055776892320162032014809906169940882070478200435536171854883284366514852906334641,
-                 177342190816702392178883147766999616783253285436834252111702533617098994535049411784501174309695427674025956656849179054202187436663487378682303508229883753383891163725167367039879190685255046547908384208614573353917213168937832054054779266431207529839577747601879940934691505396807977946728204814969824442867,
-                 161367340863680900415977542864139121629424927689088951345472941851682581254789586032968359551717004797621579428672968948552429138154521719743297455351687337112710712475376510559020211584326773715482918387500187602625572442687231345855402020688502483137168684570635690059254866684191216155909970061793538842967,
-                 62591361464718491357252875682470452982324688977706206627659717747211409835899792394529826226951327414362102349476180842659595565881230839534930649963488383547255704844176717778780890830090016428673547367746320007264898765507470136725216211681602657590439205035957626212244060728285168687080542875871702744541,
-                 28476589564178982426348978152495139111074987239250991413906989738532220221433456358759122273832412611344984605059935696803369847909621479954699550944415412431654831613301737157474154985469430655673456186029444871051571607533040825739188591886206320553618003159523945304574388238386685203984112363845918619347,
-                 34340318160575773065401929915821192439103777558577109939078671096408836197675640654693301707202885840826672396546056002756167635035389371579540325327619480512374920136684787633921441576901246290213545161954865184290700344352088099063404416346968182170720521708773285279884132629954461545103181082503707725012,
- asn1_NOVALUE};
+    #'RSAPrivateKey'{
+       version ='two-prime',
+       modulus = 28617237755030755643854803617273584643843067580642149032833640135949799721163782522787597288521902619948688786051081993247908700824196122780349730169173433743054172191054872553484065655968335396052034378669869864779940355219732200954630251223541048434478476115391643898092650304645086338265930608997389611376417609043761464100338332976874588396803891301015812818307951159858145399281035705713082131199940309445719678087542976246147777388465712394062188801177717719764254900022006288880246925156931391594131839991579403409541227225173269459173129377291869028712271737734702830877034334838181789916127814298794576266389,
+       publicExponent = 17,
+       privateExponent = 26933870828264240605980991639786903194205240075898493207372837775011576208154148256741268036255908348187001210401018346586267012540419880263858569570986761169933338532757527109161473558558433313931326474042230460969355628442100895016122589386862163232450330461545076609969553227901257730132640573174013751883368376011370428995523268034111482031427024082719896108094847702954695363285832195666458915142143884210891427766607838346722974883433132513540317964796373298134261669479023445911856492129270184781873446960437310543998533283339488055776892320162032014809906169940882070478200435536171854883284366514852906334641,
+       prime1 = 177342190816702392178883147766999616783253285436834252111702533617098994535049411784501174309695427674025956656849179054202187436663487378682303508229883753383891163725167367039879190685255046547908384208614573353917213168937832054054779266431207529839577747601879940934691505396807977946728204814969824442867,
+       prime2 = 161367340863680900415977542864139121629424927689088951345472941851682581254789586032968359551717004797621579428672968948552429138154521719743297455351687337112710712475376510559020211584326773715482918387500187602625572442687231345855402020688502483137168684570635690059254866684191216155909970061793538842967,
+       exponent1 = 62591361464718491357252875682470452982324688977706206627659717747211409835899792394529826226951327414362102349476180842659595565881230839534930649963488383547255704844176717778780890830090016428673547367746320007264898765507470136725216211681602657590439205035957626212244060728285168687080542875871702744541,
+       exponent2 = 28476589564178982426348978152495139111074987239250991413906989738532220221433456358759122273832412611344984605059935696803369847909621479954699550944415412431654831613301737157474154985469430655673456186029444871051571607533040825739188591886206320553618003159523945304574388238386685203984112363845918619347,
+       coefficient = 34340318160575773065401929915821192439103777558577109939078671096408836197675640654693301707202885840826672396546056002756167635035389371579540325327619480512374920136684787633921441576901246290213545161954865184290700344352088099063404416346968182170720521708773285279884132629954461545103181082503707725012,
+       otherPrimeInfos = asn1_NOVALUE};
+
 hardcode_rsa_key(5) -> 
-{'RSAPrivateKey', 'two-prime',
-                 26363170152814518327068346871197765236382539835597898797762992537312221863402655353436079974302838986536256364057947538018476963115004626096654613827403121905035011992899481598437933532388248462251770039307078647864188314916665766359828262009578648593031111569685489178543405615478739906285223620987558499488359880003693226535420421293716164794046859453204135383236667988765227190694994861629971618548127529849059769249520775574008363789050621665120207265361610436965088511042779948238320901918522125988916609088415989475825860046571847719492980547438560049874493788767083330042728150253120940100665370844282489982633,
-                 17,
-                 10855423004100095781734025182257903332628104638187370093196526338893267826106975733767797636477639582691399679317978398007608161282648963686857782164224814902073240232370374775827384395689278778574258251479385325591136364965685903795223402003944149420659869469870495544106108194608892902588033255700759382142132115013969680562678811046675523365751498355532768935784747314021422035957153013494814430893022253205880275287307995039363642554998244274484818208792520243113824379110193356010059999642946040953102866271737127640405568982049887176990990501963784502429481034227543991366980671390566584211881030995602076468001,
-                 163564135568104310461344551909369650951960301778977149705601170951529791054750122905880591964737953456660497440730575925978769763154927541340839715938951226089095007207042122512586007411328664679011914120351043948122025612160733403945093961374276707993674792189646478659304624413958625254578122842556295400709,
-                 161179405627326572739107057023381254841260287988433675196680483761672455172873134522398837271764104320975746111042211695289319249471386600030523328069395763313848583139553961129874895374324504709512019736703349829576024049432816885712623938437949550266365056310544300920756181033500610331519029869549723159637,
-                 115457036871603042678596154288966812436677860079277988027483179495197499568058910286503947269226790675289762899339230065396778656344654735064122152427494983121714122734382674714766593466820233891067233496718383963380253373289929461608301619793607087995535147427985749641862087821617853120878674947686796753441,
-                 142217122612346975946270932667689342506994371754500301644129838613240401623123353990351915239791856753802128921507833848784693455415929352968108818884760967629866396887841730408713142977345151214275311532385308673155315337734838428569962298621720191411498579097539089047726042088382891468987379296661520434973,
-                 40624877259097915043489529504071755460170951428490878553842519165800720914888257733191322215286203357356050737713125202129282154441426952501134581314792133018830748896123382106683994268028624341502298766844710276939303555637478596035491641473828661569958212421472263269629366559343208764012473880251174832392,
- asn1_NOVALUE};
+    #'RSAPrivateKey'{ 
+       version= 'two-prime',
+       modulus = 26363170152814518327068346871197765236382539835597898797762992537312221863402655353436079974302838986536256364057947538018476963115004626096654613827403121905035011992899481598437933532388248462251770039307078647864188314916665766359828262009578648593031111569685489178543405615478739906285223620987558499488359880003693226535420421293716164794046859453204135383236667988765227190694994861629971618548127529849059769249520775574008363789050621665120207265361610436965088511042779948238320901918522125988916609088415989475825860046571847719492980547438560049874493788767083330042728150253120940100665370844282489982633,
+       publicExponent = 17,
+       privateExponent = 10855423004100095781734025182257903332628104638187370093196526338893267826106975733767797636477639582691399679317978398007608161282648963686857782164224814902073240232370374775827384395689278778574258251479385325591136364965685903795223402003944149420659869469870495544106108194608892902588033255700759382142132115013969680562678811046675523365751498355532768935784747314021422035957153013494814430893022253205880275287307995039363642554998244274484818208792520243113824379110193356010059999642946040953102866271737127640405568982049887176990990501963784502429481034227543991366980671390566584211881030995602076468001,
+       prime1 =163564135568104310461344551909369650951960301778977149705601170951529791054750122905880591964737953456660497440730575925978769763154927541340839715938951226089095007207042122512586007411328664679011914120351043948122025612160733403945093961374276707993674792189646478659304624413958625254578122842556295400709,
+       prime2 = 161179405627326572739107057023381254841260287988433675196680483761672455172873134522398837271764104320975746111042211695289319249471386600030523328069395763313848583139553961129874895374324504709512019736703349829576024049432816885712623938437949550266365056310544300920756181033500610331519029869549723159637,
+       exponent1 = 115457036871603042678596154288966812436677860079277988027483179495197499568058910286503947269226790675289762899339230065396778656344654735064122152427494983121714122734382674714766593466820233891067233496718383963380253373289929461608301619793607087995535147427985749641862087821617853120878674947686796753441,
+       exponent2 = 142217122612346975946270932667689342506994371754500301644129838613240401623123353990351915239791856753802128921507833848784693455415929352968108818884760967629866396887841730408713142977345151214275311532385308673155315337734838428569962298621720191411498579097539089047726042088382891468987379296661520434973,
+       coefficient = 40624877259097915043489529504071755460170951428490878553842519165800720914888257733191322215286203357356050737713125202129282154441426952501134581314792133018830748896123382106683994268028624341502298766844710276939303555637478596035491641473828661569958212421472263269629366559343208764012473880251174832392,
+       otherPrimeInfos = asn1_NOVALUE};
 hardcode_rsa_key(6) -> 
-{'RSAPrivateKey', 'two-prime',
-                 22748888494866396715768692484866595111939200209856056370972713870125588774286266397044592487895293134537316190976192161177144143633669641697309689280475257429554879273045671863645233402796222694405634510241820106743648116753479926387434021380537483429927516962909367257212902212159798399531316965145618774905828756510318897899298783143203190245236381440043169622358239226123652592179006905016804587837199618842875361941208299410035232803124113612082221121192550063791073372276763648926636149384299189072950588522522800393261949880796214514243704858378436010975184294077063518776479282353562934591448646412389762167039,
-                 17,
-                 6690849557313646092873144848490175032923294179369428344403739373566349639495960705013115437616262686628622409110644753287395336362844012263914614494257428655751435080307550548130951000822418439531068973600535325512837681398082331290421770994275730420566916753796872722709677121223470117509210872101652580854566448661533030419787125312956120661097410038933324613372774190658239039998357548275441758790939430824924502690997433186652165055694361752689819209062683281242276039100201318203707142383491769671330743466041394101421674581185260900666085723130684175548215193875544802254923825103844262661010117443222587769713,
-                 164748737139489923768181260808494855987398781964531448608652166632780898215212977127034263859971474195908846263894581556691971503119888726148555271179103885786024920582830105413607436718060544856016793981261118694063993837665813285582095833772675610567592660039821387740255651489996976698808018635344299728063,
-                 138082323967104548254375818343885141517788525705334488282154811252858957969378263753268344088034079842223206527922445018725900110643394926788280539200323021781309918753249061620424428562366627334409266756720941754364262467100514166396917565961434203543659974860389803369482625510495464845206228470088664021953,
-                 19382204369351755737433089506881747763223386113474288071606137250915399790025056132592266336467232258342217207517009594904937823896457497193947678962247515974826461245038835931012639613889475865413740468383661022831058098548919210068481862796785365949128548239978986792971253116470232552800943368864035262125,
-                 48734937870742781736838524121371226418043009072470995864289933383361985165662916618800592031070851709019955245149098241903258862580021738866451955011878713569874088971734962924855680669070574353320917678842685325069739694270769705787147376221682660074232932303666989424523279591939575827719845342384234360689,
-                 81173034184183681160439870161505779100040258708276674532866007896310418779840630960490793104541748007902477778658270784073595697910785917474138815202903114440800310078464142273778315781957021015333260021813037604142367434117205299831740956310682461174553260184078272196958146289378701001596552915990080834227,
-                 asn1_NOVALUE}.
+    #'RSAPrivateKey'{ 
+       version = 'two-prime',
+       modulus = 22748888494866396715768692484866595111939200209856056370972713870125588774286266397044592487895293134537316190976192161177144143633669641697309689280475257429554879273045671863645233402796222694405634510241820106743648116753479926387434021380537483429927516962909367257212902212159798399531316965145618774905828756510318897899298783143203190245236381440043169622358239226123652592179006905016804587837199618842875361941208299410035232803124113612082221121192550063791073372276763648926636149384299189072950588522522800393261949880796214514243704858378436010975184294077063518776479282353562934591448646412389762167039,
+       publicExponent = 17,
+       privateExponent = 6690849557313646092873144848490175032923294179369428344403739373566349639495960705013115437616262686628622409110644753287395336362844012263914614494257428655751435080307550548130951000822418439531068973600535325512837681398082331290421770994275730420566916753796872722709677121223470117509210872101652580854566448661533030419787125312956120661097410038933324613372774190658239039998357548275441758790939430824924502690997433186652165055694361752689819209062683281242276039100201318203707142383491769671330743466041394101421674581185260900666085723130684175548215193875544802254923825103844262661010117443222587769713,
+       prime1 = 164748737139489923768181260808494855987398781964531448608652166632780898215212977127034263859971474195908846263894581556691971503119888726148555271179103885786024920582830105413607436718060544856016793981261118694063993837665813285582095833772675610567592660039821387740255651489996976698808018635344299728063,
+       prime2 = 138082323967104548254375818343885141517788525705334488282154811252858957969378263753268344088034079842223206527922445018725900110643394926788280539200323021781309918753249061620424428562366627334409266756720941754364262467100514166396917565961434203543659974860389803369482625510495464845206228470088664021953,
+       exponent1 = 19382204369351755737433089506881747763223386113474288071606137250915399790025056132592266336467232258342217207517009594904937823896457497193947678962247515974826461245038835931012639613889475865413740468383661022831058098548919210068481862796785365949128548239978986792971253116470232552800943368864035262125,
+       exponent2 = 48734937870742781736838524121371226418043009072470995864289933383361985165662916618800592031070851709019955245149098241903258862580021738866451955011878713569874088971734962924855680669070574353320917678842685325069739694270769705787147376221682660074232932303666989424523279591939575827719845342384234360689,
+       coefficient = 81173034184183681160439870161505779100040258708276674532866007896310418779840630960490793104541748007902477778658270784073595697910785917474138815202903114440800310078464142273778315781957021015333260021813037604142367434117205299831740956310682461174553260184078272196958146289378701001596552915990080834227,
+       otherPrimeInfos = asn1_NOVALUE}.
 
 hardcode_dsa_key(1) -> 
     {'DSAPrivateKey',0,
@@ -1581,19 +1638,21 @@ hardcode_dsa_key(1) ->
      48598545580251057979126570873881530215432219542526130654707948736559463436274835406081281466091739849794036308281564299754438126857606949027748889019480936572605967021944405048011118039171039273602705998112739400664375208228641666852589396502386172780433510070337359132965412405544709871654840859752776060358,
      1457508827177594730669011716588605181448418352823};
 hardcode_dsa_key(2) -> 
-    {'DSAPrivateKey',0,
-     145447354557382582722944332987784622105075065624518040072393858097520305927329240484963764783346271194321683798321743658303478090647837211867389721684646254999291098347011037298359107547264573476540026676832159205689428125157386525591130716464335426605521884822982379206842523670736739023467072341958074788151,
-     742801637799670234315651916144768554943688916729,
-     79727684678125120155622004643594683941478642656111969487719464672433839064387954070113655822700268007902716505761008423792735229036965034283173483862273639257533568978482104785033927768441235063983341565088899599358397638308472931049309161811156189887217888328371767967629005149630676763492409067382020352505,
-     35853727034965131665219275925554159789667905059030049940938124723126925435403746979702929280654735557166864135215989313820464108440192507913554896358611966877432546584986661291483639036057475682547385322659469460385785257933737832719745145778223672383438466035853830832837226950912832515496378486927322864228,
-     801315110178350279541885862867982846569980443911};
+    #'DSAPrivateKey'{
+       version = 0,
+       p = 145447354557382582722944332987784622105075065624518040072393858097520305927329240484963764783346271194321683798321743658303478090647837211867389721684646254999291098347011037298359107547264573476540026676832159205689428125157386525591130716464335426605521884822982379206842523670736739023467072341958074788151,
+       q = 742801637799670234315651916144768554943688916729,
+       g = 79727684678125120155622004643594683941478642656111969487719464672433839064387954070113655822700268007902716505761008423792735229036965034283173483862273639257533568978482104785033927768441235063983341565088899599358397638308472931049309161811156189887217888328371767967629005149630676763492409067382020352505,
+       y = 35853727034965131665219275925554159789667905059030049940938124723126925435403746979702929280654735557166864135215989313820464108440192507913554896358611966877432546584986661291483639036057475682547385322659469460385785257933737832719745145778223672383438466035853830832837226950912832515496378486927322864228,
+       x = 801315110178350279541885862867982846569980443911};
 hardcode_dsa_key(3) -> 
-    {'DSAPrivateKey',0,
-     99438313664986922963487511141216248076486724382260996073922424025828494981416579966171753999204426907349400798052572573634137057487829150578821328280864500098312146772602202702021153757550650696224643730869835650674962433068943942837519621267815961566259265204876799778977478160416743037274938277357237615491,
-     1454908511695148818053325447108751926908854531909,
-     20302424198893709525243209250470907105157816851043773596964076323184805650258390738340248469444700378962907756890306095615785481696522324901068493502141775433048117442554163252381401915027666416630898618301033737438756165023568220631119672502120011809327566543827706483229480417066316015458225612363927682579,
-     48598545580251057979126570873881530215432219542526130654707948736559463436274835406081281466091739849794036308281564299754438126857606949027748889019480936572605967021944405048011118039171039273602705998112739400664375208228641666852589396502386172780433510070337359132965412405544709871654840859752776060358,
-     1457508827177594730669011716588605181448418352823}.
+    #'DSAPrivateKey'{
+       version = 0,
+       p =  99438313664986922963487511141216248076486724382260996073922424025828494981416579966171753999204426907349400798052572573634137057487829150578821328280864500098312146772602202702021153757550650696224643730869835650674962433068943942837519621267815961566259265204876799778977478160416743037274938277357237615491,
+       q =  1454908511695148818053325447108751926908854531909,
+       g =  20302424198893709525243209250470907105157816851043773596964076323184805650258390738340248469444700378962907756890306095615785481696522324901068493502141775433048117442554163252381401915027666416630898618301033737438756165023568220631119672502120011809327566543827706483229480417066316015458225612363927682579,
+       y =  48598545580251057979126570873881530215432219542526130654707948736559463436274835406081281466091739849794036308281564299754438126857606949027748889019480936572605967021944405048011118039171039273602705998112739400664375208228641666852589396502386172780433510070337359132965412405544709871654840859752776060358,
+       x = 1457508827177594730669011716588605181448418352823}.
 
 dtls_hello() ->
     [1,
diff --git a/lib/ssl/test/x509_test.erl b/lib/ssl/test/x509_test.erl
index 4da1537ef6..031fad1216 100644
--- a/lib/ssl/test/x509_test.erl
+++ b/lib/ssl/test/x509_test.erl
@@ -24,23 +24,10 @@
 
  -include_lib("public_key/include/public_key.hrl").
 
- -export([gen_test_certs/1, gen_pem_config_files/3]).
+-export([extensions/1, gen_pem_config_files/3]).
 
- gen_test_certs(Opts) ->
-     SRootKey = gen_key(proplists:get_value(server_key_gen, Opts)),
-     CRootKey = gen_key(proplists:get_value(client_key_gen, Opts)),
-     ServerRoot = root_cert("server", SRootKey, Opts),
-     ClientRoot = root_cert("client", CRootKey, Opts),
-     [{ServerCert, ServerKey} | ServerCAsKeys] = config(server, ServerRoot, SRootKey, Opts),
-     [{ClientCert, ClientKey} | ClientCAsKeys] = config(client, ClientRoot, CRootKey, Opts),
-     ServerCAs = ca_config(ClientRoot, ServerCAsKeys),
-     ClientCAs = ca_config(ServerRoot, ClientCAsKeys),
-     [{server_config, [{cert, ServerCert}, {key, ServerKey}, {cacerts, ServerCAs}]}, 
-      {client_config, [{cert, ClientCert}, {key, ClientKey}, {cacerts, ClientCAs}]}].
-
-gen_pem_config_files(GenCertData, ClientBase, ServerBase) ->
-    ServerConf = proplists:get_value(server_config, GenCertData),
-    ClientConf = proplists:get_value(client_config, GenCertData),
+gen_pem_config_files(#{server_config := ServerConf,
+                       client_config := ClientConf}, ClientBase, ServerBase) ->
     
     ServerCaCertFile = ServerBase ++ "_server_cacerts.pem",
     ServerCertFile = ServerBase ++ "_server_cert.pem",
@@ -62,147 +49,33 @@ gen_pem_config_files(GenCertData, ClientBase, ServerBase) ->
                       {keyfile, ServerKeyFile}, {cacertfile, ServerCaCertFile}]}, 
      {client_config, [{certfile, ClientCertFile}, 
                       {keyfile, ClientKeyFile}, {cacertfile, ClientCaCertFile}]}].
-
-
- do_gen_pem_config_files(Config, CertFile, KeyFile, CAFile) ->
-     CAs = proplists:get_value(cacerts, Config),
-     Cert = proplists:get_value(cert, Config),
-     Key = proplists:get_value(key, Config),
-     der_to_pem(CertFile, [cert_entry(Cert)]),
-     der_to_pem(KeyFile, [key_entry(Key)]),
-     der_to_pem(CAFile, ca_entries(CAs)).
-
- cert_entry(Cert) ->
-     {'Certificate', Cert, not_encrypted}.
-
- key_entry(Key = #'RSAPrivateKey'{}) ->
-     Der = public_key:der_encode('RSAPrivateKey', Key),
-     {'RSAPrivateKey', Der, not_encrypted};
- key_entry(Key = #'DSAPrivateKey'{}) ->
-     Der =  public_key:der_encode('DSAPrivateKey', Key),
-     {'DSAPrivateKey', Der, not_encrypted};
- key_entry(Key = #'ECPrivateKey'{}) ->
-     Der =  public_key:der_encode('ECPrivateKey', Key),
-     {'ECPrivateKey', Der, not_encrypted}.
-
- ca_entries(CAs) ->
-     [{'Certificate', CACert, not_encrypted} || CACert <- CAs].
-
- gen_key(KeyGen) ->
-     case is_key(KeyGen) of
-         true ->
-             KeyGen;
-         false ->
-             public_key:generate_key(KeyGen)
-     end.
-
-root_cert(Role, PrivKey, Opts) ->
-     TBS = cert_template(),
-     Issuer = issuer("root", Role, " ROOT CA"),
-     OTPTBS = TBS#'OTPTBSCertificate'{
-                signature = sign_algorithm(PrivKey, Opts),
-                issuer = Issuer,
-                validity = validity(Opts),  
-                subject = Issuer,
-                subjectPublicKeyInfo = public_key(PrivKey),
-                extensions = extensions(Role, ca, Opts)
-               },
-     public_key:pkix_sign(OTPTBS, PrivKey).
-
-config(Role, Root, Key, Opts) ->
-    KeyGenOpt = list_to_atom(atom_to_list(Role) ++ "_key_gen_chain"),
-    KeyGens = proplists:get_value(KeyGenOpt, Opts, default_key_gen()),
-    Keys = lists:map(fun gen_key/1, KeyGens),
-    cert_chain(Role, Root, Key, Opts, Keys).
-
-cert_template() ->
-    #'OTPTBSCertificate'{
-       version = v3,              
-       serialNumber = trunc(rand:uniform()*100000000)*10000 + 1,
-       issuerUniqueID = asn1_NOVALUE,       
-       subjectUniqueID = asn1_NOVALUE
-      }.
-
-issuer(Contact, Role, Name) ->
-  subject(Contact, Role ++ Name).
-
-subject(Contact, Name) ->
-    Opts = [{email, Contact ++ "@erlang.org"},
-	    {name,  Name},
-	    {city, "Stockholm"},
-	    {country, "SE"},
-	    {org, "erlang"},
-	    {org_unit, "automated testing"}],
-    subject(Opts).
-
-subject(SubjectOpts) when is_list(SubjectOpts) ->
-    Encode = fun(Opt) ->
-		     {Type,Value} = subject_enc(Opt),
-		     [#'AttributeTypeAndValue'{type=Type, value=Value}]
-	     end,
-    {rdnSequence, [Encode(Opt) || Opt <- SubjectOpts]}.
-
-subject_enc({name,  Name}) ->       
-    {?'id-at-commonName', {printableString, Name}};
-subject_enc({email, Email}) ->      
-    {?'id-emailAddress', Email};
-subject_enc({city,  City}) ->       
-    {?'id-at-localityName', {printableString, City}};
-subject_enc({state, State}) ->      
-    {?'id-at-stateOrProvinceName', {printableString, State}};
-subject_enc({org, Org}) ->          
-    {?'id-at-organizationName', {printableString, Org}};
-subject_enc({org_unit, OrgUnit}) -> 
-    {?'id-at-organizationalUnitName', {printableString, OrgUnit}};
-subject_enc({country, Country}) ->  
-    {?'id-at-countryName', Country};
-subject_enc({serial, Serial}) ->    
-    {?'id-at-serialNumber', Serial};
-subject_enc({title, Title}) ->      
-    {?'id-at-title', {printableString, Title}};
-subject_enc({dnQualifer, DnQ}) ->   
-    {?'id-at-dnQualifier', DnQ};
-subject_enc(Other) -> 
-    Other.
-
-validity(Opts) ->
-    DefFrom0 = calendar:gregorian_days_to_date(calendar:date_to_gregorian_days(date())-1),
-    DefTo0   = calendar:gregorian_days_to_date(calendar:date_to_gregorian_days(date())+7),
-    {DefFrom, DefTo} = proplists:get_value(validity, Opts, {DefFrom0, DefTo0}),
-    Format = fun({Y,M,D}) -> 
-                     lists:flatten(io_lib:format("~w~2..0w~2..0w000000Z",[Y,M,D])) 
-             end,
-    #'Validity'{notBefore={generalTime, Format(DefFrom)},
-		notAfter ={generalTime, Format(DefTo)}}.
-
-extensions(Role, Type, Opts) ->
-    Exts  = proplists:get_value(extensions, Opts, []),
-    lists:flatten([extension(Ext) || Ext <- default_extensions(Role, Type, Exts)]).
-
-%% Common extension: name_constraints, policy_constraints, ext_key_usage, inhibit_any, 
-%% auth_key_id, subject_key_id, policy_mapping,
-
-default_extensions(_, ca, Exts) ->
-    Def = [{key_usage,  [keyCertSign, cRLSign]}, 
-	   {basic_constraints, default}],
-    add_default_extensions(Def, Exts);
-
-default_extensions(server, peer, Exts) ->
-    Hostname = net_adm:localhost(),
-    Def = [{key_usage, [digitalSignature, keyAgreement]},
-           {subject_alt, Hostname}],
-    add_default_extensions(Def, Exts);
-    
-default_extensions(_, peer, Exts) ->
-    Exts.
-
-add_default_extensions(Def, Exts) ->
-    Filter = fun({Key, _}, D) -> 
-                     lists:keydelete(Key, 1, D); 
-                ({Key, _, _}, D) -> 
-                     lists:keydelete(Key, 1, D)
-             end,
-    Exts ++ lists:foldl(Filter, Def, Exts).
+extensions(Exts) ->
+    [extension(Ext) || Ext <- Exts].
+
+
+do_gen_pem_config_files(Config, CertFile, KeyFile, CAFile) ->
+    CAs = proplists:get_value(cacerts, Config),
+    Cert = proplists:get_value(cert, Config),
+    Key = proplists:get_value(key, Config),
+    der_to_pem(CertFile, [cert_entry(Cert)]),
+    der_to_pem(KeyFile, [key_entry(Key)]),
+    der_to_pem(CAFile, ca_entries(CAs)).
+
+cert_entry(Cert) ->
+    {'Certificate', Cert, not_encrypted}.
+
+key_entry(Key = #'RSAPrivateKey'{}) ->
+    Der = public_key:der_encode('RSAPrivateKey', Key),
+    {'RSAPrivateKey', Der, not_encrypted};
+key_entry(Key = #'DSAPrivateKey'{}) ->
+    Der =  public_key:der_encode('DSAPrivateKey', Key),
+    {'DSAPrivateKey', Der, not_encrypted};
+key_entry(Key = #'ECPrivateKey'{}) ->
+    Der =  public_key:der_encode('ECPrivateKey', Key),
+    {'ECPrivateKey', Der, not_encrypted}.
+
+ca_entries(CAs) ->
+    [{'Certificate', CACert, not_encrypted} || CACert <- CAs].
 
 extension({_, undefined}) ->
     [];
@@ -222,13 +95,6 @@ extension({basic_constraints, Data}) ->
 	    #'Extension'{extnID = ?'id-ce-basicConstraints',
 			 extnValue = Data}
     end;
-extension({auth_key_id, {Oid, Issuer, SNr}}) ->
-    #'Extension'{extnID = ?'id-ce-authorityKeyIdentifier',
-                 extnValue = #'AuthorityKeyIdentifier'{
-                                keyIdentifier = Oid,	    
-                                authorityCertIssuer = Issuer,     
-                                authorityCertSerialNumber = SNr},
-                 critical = false};
 extension({key_usage, Value}) ->
     #'Extension'{extnID = ?'id-ce-keyUsage',
                  extnValue = Value,
@@ -240,113 +106,6 @@ extension({subject_alt, Hostname}) ->
 extension({Id, Data, Critical}) ->
     #'Extension'{extnID = Id, extnValue = Data, critical = Critical}.
 
-public_key(#'RSAPrivateKey'{modulus=N, publicExponent=E}) ->
-    Public = #'RSAPublicKey'{modulus=N, publicExponent=E},
-    Algo = #'PublicKeyAlgorithm'{algorithm= ?rsaEncryption, parameters='NULL'},
-    #'OTPSubjectPublicKeyInfo'{algorithm = Algo,
-			       subjectPublicKey = Public};
-public_key(#'DSAPrivateKey'{p=P, q=Q, g=G, y=Y}) ->
-    Algo = #'PublicKeyAlgorithm'{algorithm= ?'id-dsa', 
-				 parameters={params, #'Dss-Parms'{p=P, q=Q, g=G}}},
-    #'OTPSubjectPublicKeyInfo'{algorithm = Algo, subjectPublicKey = Y};
-public_key(#'ECPrivateKey'{version = _Version,
-			  privateKey = _PrivKey,
-			  parameters = Params,
-			  publicKey = PubKey}) ->
-    Algo = #'PublicKeyAlgorithm'{algorithm= ?'id-ecPublicKey', parameters=Params},
-    #'OTPSubjectPublicKeyInfo'{algorithm = Algo,
-			       subjectPublicKey = #'ECPoint'{point = PubKey}}.
-
-sign_algorithm(#'RSAPrivateKey'{}, Opts) ->
-    Type = rsa_digest_oid(proplists:get_value(digest, Opts, sha1)),
-    #'SignatureAlgorithm'{algorithm  = Type,
-                          parameters = 'NULL'};
-sign_algorithm(#'DSAPrivateKey'{p=P, q=Q, g=G}, _Opts) ->
-    #'SignatureAlgorithm'{algorithm  = ?'id-dsa-with-sha1',
-                          parameters = {params,#'Dss-Parms'{p=P, q=Q, g=G}}};
-sign_algorithm(#'ECPrivateKey'{parameters = Parms}, Opts) ->
-    Type = ecdsa_digest_oid(proplists:get_value(digest, Opts, sha1)),
-    #'SignatureAlgorithm'{algorithm  = Type,
-                          parameters = Parms}.
-
-rsa_digest_oid(sha1) ->
-    ?'sha1WithRSAEncryption';
-rsa_digest_oid(sha512) ->
-    ?'sha512WithRSAEncryption';
-rsa_digest_oid(sha384) ->
-    ?'sha384WithRSAEncryption';
-rsa_digest_oid(sha256) ->
-    ?'sha256WithRSAEncryption';
-rsa_digest_oid(md5) ->
-   ?'md5WithRSAEncryption'.
-
-ecdsa_digest_oid(sha1) ->
-    ?'ecdsa-with-SHA1';
-ecdsa_digest_oid(sha512) ->
-    ?'ecdsa-with-SHA512';
-ecdsa_digest_oid(sha384) ->
-    ?'ecdsa-with-SHA384';
-ecdsa_digest_oid(sha256) ->
-    ?'ecdsa-with-SHA256'.
-
-ca_config(Root, CAsKeys) ->
-    [Root | [CA || {CA, _}  <- CAsKeys]].
-
-cert_chain(Role, Root, RootKey, Opts, Keys) ->
-    cert_chain(Role, Root, RootKey, Opts, Keys, 0, []).
-
-cert_chain(Role, IssuerCert, IssuerKey, Opts, [Key], _, Acc) ->
-    PeerOpts = list_to_atom(atom_to_list(Role) ++ "_peer_opts"),
-    Cert = cert(Role, public_key:pkix_decode_cert(IssuerCert, otp), 
-                IssuerKey, Key, "admin", " Peer cert", Opts, PeerOpts, peer),
-    [{Cert, Key}, {IssuerCert, IssuerKey} | Acc];
-cert_chain(Role, IssuerCert, IssuerKey, Opts, [Key | Keys], N, Acc) ->
-    CAOpts = list_to_atom(atom_to_list(Role) ++ "_ca_" ++ integer_to_list(N)),
-    Cert = cert(Role, public_key:pkix_decode_cert(IssuerCert, otp), IssuerKey, Key, "webadmin", 
-                " Intermidiate CA " ++ integer_to_list(N), Opts, CAOpts, ca),
-    cert_chain(Role, Cert, Key, Opts, Keys, N+1, [{IssuerCert, IssuerKey} | Acc]).
-        
-cert(Role, #'OTPCertificate'{tbsCertificate = #'OTPTBSCertificate'{subject = Issuer,
-                                                                   serialNumber = SNr
-                                                                  }}, 
-     PrivKey, Key, Contact, Name, Opts, CertOptsName, Type) ->
-    CertOpts = proplists:get_value(CertOptsName, Opts, []),
-    TBS = cert_template(),         
-    OTPTBS = TBS#'OTPTBSCertificate'{
-               signature = sign_algorithm(PrivKey, Opts),
-               issuer =  Issuer,
-               validity = validity(CertOpts),  
-               subject = subject(Contact, atom_to_list(Role) ++ Name),
-               subjectPublicKeyInfo = public_key(Key),
-               extensions = extensions(Role, Type, 
-                                       add_default_extensions([{auth_key_id, {auth_key_oid(Role), Issuer, SNr}}],
-                                                              CertOpts))
-              },
-    public_key:pkix_sign(OTPTBS, PrivKey).
-
-is_key(#'DSAPrivateKey'{}) ->
-    true;
-is_key(#'RSAPrivateKey'{}) ->
-    true;
-is_key(#'ECPrivateKey'{}) ->
-    true;
-is_key(_) ->
-    false.
-
 der_to_pem(File, Entries) ->
     PemBin = public_key:pem_encode(Entries),
     file:write_file(File, PemBin).
-
-default_key_gen() ->
-    case tls_v1:ecc_curves(0) of
-        [] ->
-            [{rsa, 2048, 17}, {rsa, 2048, 17}];
-        [_|_] ->
-            [{namedCurve, hd(tls_v1:ecc_curves(0))},
-             {namedCurve, hd(tls_v1:ecc_curves(0))}]
-    end.
-
-auth_key_oid(server) ->
-    ?'id-kp-serverAuth';
-auth_key_oid(client) ->
-    ?'id-kp-clientAuth'.
diff --git a/lib/ssl/vsn.mk b/lib/ssl/vsn.mk
index 25b2a2bec0..bb77326751 100644
--- a/lib/ssl/vsn.mk
+++ b/lib/ssl/vsn.mk
@@ -1 +1 @@
-SSL_VSN = 8.2
+SSL_VSN = 8.2.1