ssl: Use gen_statem instead of gen_fsm

Also reduce timing issues in tests

9 files changed, 877 insertions, 749 deletions

diff --git a/lib/ssl/src/dtls_connection.erl b/lib/ssl/src/dtls_connection.erl
index e490de7eeb..2c9fe5cfb5 100644
--- a/lib/ssl/src/dtls_connection.erl
+++ b/lib/ssl/src/dtls_connection.erl
@@ -21,7 +21,7 @@
 
 %% Internal application API
 
--behaviour(gen_fsm).
+-behaviour(gen_statem).
 
 -include("dtls_connection.hrl").
 -include("dtls_handshake.hrl").
@@ -514,7 +514,6 @@ initial_state(Role, Host, Port, Socket, {SSLOptions, SocketOptions}, User,
 	   renegotiation = {false, first},
 	   allow_renegotiate = SSLOptions#ssl_options.client_renegotiation,
 	   start_or_recv_from = undefined,
-	   send_queue = queue:new(),
 	   protocol_cb = ?MODULE
 	  }.
 read_application_data(_,State) ->
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 025e8cea61..dbbb25025c 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -696,7 +696,7 @@ handle_options(Opts0, Role) ->
 							 default_option_role(server, true, Role), 
 							 server, Role),
 		    renegotiate_at = handle_option(renegotiate_at, Opts, ?DEFAULT_RENEGOTIATE_AT),
-		    hibernate_after = handle_option(hibernate_after, Opts, undefined),
+		    hibernate_after = handle_option(hibernate_after, Opts, infinity),
 		    erl_dist = handle_option(erl_dist, Opts, false),
 		    alpn_advertised_protocols =
 			handle_option(alpn_advertised_protocols, Opts, undefined),
@@ -885,10 +885,13 @@ validate_option(client_renegotiation, Value) when is_boolean(Value) ->
 validate_option(renegotiate_at, Value) when is_integer(Value) ->
     erlang:min(Value, ?DEFAULT_RENEGOTIATE_AT);
 
-validate_option(hibernate_after, undefined) ->
-    undefined;
+validate_option(hibernate_after, undefined) -> %% Backwards compatibility
+    infinity;
+validate_option(hibernate_after, infinity) ->
+    infinity;
 validate_option(hibernate_after, Value) when is_integer(Value), Value >= 0 ->
     Value;
+
 validate_option(erl_dist,Value) when is_boolean(Value) ->
     Value;
 validate_option(Opt, Value)
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index 0073e86e26..57fa1b904e 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -38,7 +38,7 @@
 
 %% Setup
 -export([connect/8, ssl_accept/7, handshake/2, handshake/3,
-	 socket_control/4, socket_control/5]).
+	 socket_control/4, socket_control/5, start_or_recv_cancel_timer/2]).
 
 %% User Events 
 -export([send/2, recv/3, close/2, shutdown/2,
@@ -47,12 +47,16 @@
 	 connection_information/1
 	]).
 
--export([handle_session/7]).
+%% General gen_statem state functions with extra callback argument 
+%% to determine if it is an SSL/TLS or DTLS gen_statem machine
+-export([init/4, hello/4, abbreviated/4, certify/4, cipher/4, connection/4, downgrade/4]).
 
-%% SSL FSM state functions 
--export([hello/3, abbreviated/3, certify/3, cipher/3, connection/3]).
-%% SSL all state functions 
--export([handle_sync_event/4, handle_info/3, terminate/3, format_status/2]).
+%% gen_statem callbacks
+-export([terminate/3, format_status/2]).
+
+%%
+-export([handle_info/3, handle_call/5, handle_session/7, ssl_config/3,
+	 prepare_connection/2, hibernate_after/3]).
 
 
 %%====================================================================
@@ -100,7 +104,7 @@ ssl_accept(Connection, Port, Socket, Opts, User, CbInfo, Timeout) ->
 %% Description: Starts ssl handshake. 
 %%--------------------------------------------------------------------
 handshake(#sslsocket{pid = Pid}, Timeout) ->  
-    case sync_send_all_state_event(Pid, {start, Timeout}) of
+    case call(Pid, {start, Timeout}) of
 	connected ->
 	    ok;
  	Error ->
@@ -114,7 +118,7 @@ handshake(#sslsocket{pid = Pid}, Timeout) ->
 %% Description: Starts ssl handshake with some new options 
 %%--------------------------------------------------------------------
 handshake(#sslsocket{pid = Pid}, SslOptions, Timeout) ->  
-    case sync_send_all_state_event(Pid, {start, SslOptions, Timeout}) of
+    case call(Pid, {start, SslOptions, Timeout}) of
 	connected ->
 	    ok;
  	Error ->
@@ -148,7 +152,7 @@ socket_control(Connection, Socket, Pid, Transport, ListenTracker) ->
 %% Description: Sends data over the ssl connection
 %%--------------------------------------------------------------------
 send(Pid, Data) -> 
-    sync_send_all_state_event(Pid, {application_data, 
+    call(Pid, {application_data, 
 				    %% iolist_to_binary should really
 				    %% be called iodata_to_binary()
 				    erlang:iolist_to_binary(Data)}).
@@ -160,7 +164,7 @@ send(Pid, Data) ->
 %% Description:  Receives data when active = false
 %%--------------------------------------------------------------------
 recv(Pid, Length, Timeout) -> 
-    sync_send_all_state_event(Pid, {recv, Length, Timeout}).
+    call(Pid, {recv, Length, Timeout}).
 
 %%--------------------------------------------------------------------
 -spec connection_information(pid()) -> {ok, list()} | {error, reason()}.
@@ -168,7 +172,7 @@ recv(Pid, Length, Timeout) ->
 %% Description: Get the SNI hostname
 %%--------------------------------------------------------------------
 connection_information(Pid) when is_pid(Pid) ->
-    sync_send_all_state_event(Pid, connection_information).
+    call(Pid, connection_information).
 
 %%--------------------------------------------------------------------
 -spec close(pid(), {close, Timeout::integer() | 
@@ -178,7 +182,7 @@ connection_information(Pid) when is_pid(Pid) ->
 %% Description:  Close an ssl connection
 %%--------------------------------------------------------------------
 close(ConnectionPid, How) ->
-    case sync_send_all_state_event(ConnectionPid, How) of
+    case call(ConnectionPid, How) of
 	{error, closed} ->
 	    ok;
 	Other ->
@@ -190,7 +194,7 @@ close(ConnectionPid, How) ->
 %% Description: Same as gen_tcp:shutdown/2
 %%--------------------------------------------------------------------
 shutdown(ConnectionPid, How) ->
-    sync_send_all_state_event(ConnectionPid, {shutdown, How}).
+    call(ConnectionPid, {shutdown, How}).
 
 %%--------------------------------------------------------------------
 -spec new_user(pid(), pid()) ->  ok | {error, reason()}.
@@ -199,7 +203,7 @@ shutdown(ConnectionPid, How) ->
 %% or once. 
 %%--------------------------------------------------------------------
 new_user(ConnectionPid, User) ->
-    sync_send_all_state_event(ConnectionPid, {new_user, User}).
+    call(ConnectionPid, {new_user, User}).
 
 %%--------------------------------------------------------------------
 -spec negotiated_protocol(pid()) -> {ok, binary()} | {error, reason()}.
@@ -207,7 +211,7 @@ new_user(ConnectionPid, User) ->
 %% Description:  Returns the negotiated protocol
 %%--------------------------------------------------------------------
 negotiated_protocol(ConnectionPid) ->
-    sync_send_all_state_event(ConnectionPid, negotiated_protocol).
+    call(ConnectionPid, negotiated_protocol).
 
 %%--------------------------------------------------------------------
 -spec get_opts(pid(), list()) -> {ok, list()} | {error, reason()}.    
@@ -215,14 +219,14 @@ negotiated_protocol(ConnectionPid) ->
 %% Description: Same as inet:getopts/2
 %%--------------------------------------------------------------------
 get_opts(ConnectionPid, OptTags) ->
-    sync_send_all_state_event(ConnectionPid, {get_opts, OptTags}).
+    call(ConnectionPid, {get_opts, OptTags}).
 %%--------------------------------------------------------------------
 -spec set_opts(pid(), list()) -> ok | {error, reason()}. 
 %%
 %% Description:  Same as inet:setopts/2
 %%--------------------------------------------------------------------
 set_opts(ConnectionPid, Options) ->
-    sync_send_all_state_event(ConnectionPid, {set_opts, Options}).
+    call(ConnectionPid, {set_opts, Options}).
 
 %%--------------------------------------------------------------------
 -spec session_info(pid()) -> {ok, list()} | {error, reason()}. 
@@ -230,7 +234,7 @@ set_opts(ConnectionPid, Options) ->
 %% Description:  Returns info about the ssl session
 %%--------------------------------------------------------------------
 session_info(ConnectionPid) ->
-    sync_send_all_state_event(ConnectionPid, session_info). 
+    call(ConnectionPid, session_info). 
 
 %%--------------------------------------------------------------------
 -spec peer_certificate(pid()) -> {ok, binary()| undefined} | {error, reason()}.
@@ -238,7 +242,7 @@ session_info(ConnectionPid) ->
 %% Description: Returns the peer cert
 %%--------------------------------------------------------------------
 peer_certificate(ConnectionPid) ->
-    sync_send_all_state_event(ConnectionPid, peer_certificate). 
+    call(ConnectionPid, peer_certificate). 
 
 %%--------------------------------------------------------------------
 -spec renegotiation(pid()) -> ok | {error, reason()}.
@@ -246,7 +250,7 @@ peer_certificate(ConnectionPid) ->
 %% Description: Starts a renegotiation of the ssl session.
 %%--------------------------------------------------------------------
 renegotiation(ConnectionPid) ->
-    sync_send_all_state_event(ConnectionPid, renegotiate). 
+    call(ConnectionPid, renegotiate). 
 
 %%--------------------------------------------------------------------
 -spec prf(pid(), binary() | 'master_secret', binary(),
@@ -256,9 +260,13 @@ renegotiation(ConnectionPid) ->
 %% Description: use a ssl sessions TLS PRF to generate key material
 %%--------------------------------------------------------------------
 prf(ConnectionPid, Secret, Label, Seed, WantedLength) ->
-    sync_send_all_state_event(ConnectionPid, {prf, Secret, Label, Seed, WantedLength}).
-
+    call(ConnectionPid, {prf, Secret, Label, Seed, WantedLength}).
 
+%%--------------------------------------------------------------------
+-spec handle_session(#server_hello{}, ssl_record:ssl_version(),
+		     binary(), #connection_states{}, _,_, #state{}) ->
+			    gen_statem:state_function_result().
+%%--------------------------------------------------------------------
 handle_session(#server_hello{cipher_suite = CipherSuite,
 			     compression_method = Compression}, 
 	       Version, NewId, ConnectionStates, ProtoExt, Protocol0,
@@ -290,61 +298,104 @@ handle_session(#server_hello{cipher_suite = CipherSuite,
 	    handle_resumed_session(NewId,
 				   State#state{connection_states = ConnectionStates})
     end.
-	
+
 %%--------------------------------------------------------------------
--spec hello(start | #hello_request{} | #server_hello{} | term(),
-	    #state{}, tls_connection | dtls_connection) ->
-		   gen_fsm_state_return().
+-spec ssl_config(#ssl_options{}, client | server, #state{}) -> #state{}.
 %%--------------------------------------------------------------------
-hello(start, #state{role = server} = State0, Connection) ->
-    {Record, State} = Connection:next_record(State0),
-    Connection:next_state(hello, hello, Record, State);
+ssl_config(Opts, Role, State) ->
+    {ok, Ref, CertDbHandle, FileRefHandle, CacheHandle, CRLDbInfo, 
+     OwnCert, Key, DHParams} = 
+	ssl_config:init(Opts, Role), 
+    Handshake = ssl_handshake:init_handshake_history(),
+    TimeStamp = erlang:monotonic_time(),
+    Session = State#state.session,
+    State#state{tls_handshake_history = Handshake,
+		session = Session#session{own_certificate = OwnCert,
+					  time_stamp = TimeStamp},
+		file_ref_db = FileRefHandle,
+		cert_db_ref = Ref,
+		cert_db = CertDbHandle,
+		crl_db = CRLDbInfo,
+		session_cache = CacheHandle,
+		private_key = Key,
+		diffie_hellman_params = DHParams,
+		ssl_options = Opts}.
 
-hello(#hello_request{}, #state{role = client} = State0, Connection) ->
-    {Record, State} = Connection:next_record(State0),
-    Connection:next_state(hello, hello, Record, State);
+%%====================================================================
+%% gen_statem state functions
+%%====================================================================	
+%%--------------------------------------------------------------------
+-spec init(gen_statem:event_type(),
+	   {start, timeout()} |  {start, {list(), list()}, timeout()}| term(),
+	    #state{}, tls_connection | dtls_connection) ->
+		   gen_statem:state_function_result().
+%%--------------------------------------------------------------------
 
-hello({common_client_hello, Type, ServerHelloExt},
-      State, Connection) ->
+init({call, From}, {start, Timeout}, State0, Connection) ->
+    Timer = start_or_recv_cancel_timer(Timeout, From),
+    {Record, State} = Connection:next_record(State0#state{start_or_recv_from = From,
+							  timer = Timer}),
+    Connection:next_event(hello, Record, State);
+init({call, From}, {start, {Opts, EmOpts}, Timeout}, 
+     #state{role = Role} = State0, Connection) ->
+    try 
+	State = ssl_config(Opts, Role, State0),
+	init({call, From}, {start, Timeout}, 
+	     State#state{ssl_options = Opts, socket_options = EmOpts}, Connection)
+    catch throw:Error ->
+	    {stop_and_reply, normal, {reply, From, {error, Error}}}
+    end;
+init({call, From}, Msg, State, Connection) ->
+    handle_call(Msg, From, init, State, Connection);
+init(_Type, _Event, _State, _Connection) ->
+    {keep_state_and_data, [postpone]}.
+	
+%%--------------------------------------------------------------------
+-spec hello(gen_statem:event_type(),
+	    #hello_request{} | #server_hello{} | term(),
+	    #state{}, tls_connection | dtls_connection) ->
+		   gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+hello({call, From}, Msg, State, Connection) ->
+    handle_call(Msg, From, hello, State, Connection);
+hello(internal, {common_client_hello, Type, ServerHelloExt}, State, Connection) ->
     do_server_hello(Type, ServerHelloExt, State, Connection);
-hello(timeout, State, _) ->
-    {next_state, hello, State, hibernate};
-
-hello(Msg, State, Connection) ->
-    Connection:handle_unexpected_message(Msg, hello, State).
+hello(info, Msg, State, _) ->
+    handle_info(Msg, hello, State);
+hello(Type, Msg, State, Connection) ->
+    handle_common_event(Type, Msg, hello, State, Connection).
 
 %%--------------------------------------------------------------------
--spec abbreviated(#hello_request{} | #finished{} | term(),
+-spec abbreviated(gen_statem:event_type(),
+		  #hello_request{} | #finished{} | term(),
 		  #state{}, tls_connection | dtls_connection) ->
-			 gen_fsm_state_return().
+			 gen_statem:state_function_result().
 %%--------------------------------------------------------------------
-abbreviated(#hello_request{}, State0, Connection) ->
-    {Record, State} = Connection:next_record(State0),
-    Connection:next_state(abbreviated, hello, Record, State);
+abbreviated({call, From}, Msg, State, Connection) ->
+    handle_call(Msg, From, abbreviated, State, Connection);
 
-abbreviated(#finished{verify_data = Data} = Finished,
+abbreviated(internal, #finished{verify_data = Data} = Finished,
 	    #state{role = server,
 		   negotiated_version = Version,
 		   expecting_finished = true,
 		   tls_handshake_history = Handshake,
 		   session = #session{master_secret = MasterSecret},
 		   connection_states = ConnectionStates0} =
-		State, Connection) ->
+		State0, Connection) ->
     case ssl_handshake:verify_connection(Version, Finished, client,
 					 get_current_prf(ConnectionStates0, write),
 					 MasterSecret, Handshake) of
         verified ->
 	    ConnectionStates =
 		ssl_record:set_client_verify_data(current_both, Data, ConnectionStates0),
-	    Connection:next_state_connection(abbreviated,
-					     ack_connection(
-					       State#state{connection_states = ConnectionStates,
-							   expecting_finished = false}));
+	    {Record, State} = prepare_connection(State0#state{connection_states = ConnectionStates,
+							      expecting_finished = false}, Connection),
+	    Connection:next_event(connection, Record, State);
 	#alert{} = Alert ->
-	    Connection:handle_own_alert(Alert, Version, abbreviated, State)
+	    Connection:handle_own_alert(Alert, Version, abbreviated, State0)
     end;
 
-abbreviated(#finished{verify_data = Data} = Finished,
+abbreviated(internal, #finished{verify_data = Data} = Finished,
 	    #state{role = client, tls_handshake_history = Handshake0,
 		   session = #session{master_secret = MasterSecret},
 		   negotiated_version = Version,
@@ -355,40 +406,49 @@ abbreviated(#finished{verify_data = Data} = Finished,
         verified ->
 	    ConnectionStates1 =
 		ssl_record:set_server_verify_data(current_read, Data, ConnectionStates0),
-	    State =
+	    State1 =
 		finalize_handshake(State0#state{connection_states = ConnectionStates1},
 				   abbreviated, Connection),
-	    Connection:next_state_connection(abbreviated,
-					     ack_connection(State#state{expecting_finished = false}));
-        #alert{} = Alert ->
+	    {Record, State} = prepare_connection(State1#state{expecting_finished = false}, Connection),
+	    Connection:next_event(connection, Record, State);
+	#alert{} = Alert ->
 	    Connection:handle_own_alert(Alert, Version, abbreviated, State0)
     end;
 
 %% only allowed to send next_protocol message after change cipher spec
 %% & before finished message and it is not allowed during renegotiation
-abbreviated(#next_protocol{selected_protocol = SelectedProtocol},
+abbreviated(internal, #next_protocol{selected_protocol = SelectedProtocol},
 	    #state{role = server, expecting_next_protocol_negotiation = true} = State0,
 	    Connection) ->
-    {Record, State} = Connection:next_record(State0#state{negotiated_protocol = SelectedProtocol}),
-    Connection:next_state(abbreviated, abbreviated, Record, State#state{expecting_next_protocol_negotiation = false});
-
-abbreviated(timeout, State, _) ->
-    {next_state, abbreviated, State, hibernate };
-
-abbreviated(Msg, State, Connection) ->
-    Connection:handle_unexpected_message(Msg, abbreviated, State).
-
+    {Record, State} =
+	Connection:next_record(State0#state{negotiated_protocol = SelectedProtocol}),
+    Connection:next_event(abbreviated, Record, 
+			  State#state{expecting_next_protocol_negotiation = false});
+abbreviated(internal, 
+	    #change_cipher_spec{type = <<1>>},  #state{connection_states = ConnectionStates0} =
+		State0, Connection) ->
+    ConnectionStates1 =
+	ssl_record:activate_pending_connection_state(ConnectionStates0, read),
+    {Record, State} = Connection:next_record(State0#state{connection_states = 
+							      ConnectionStates1}),
+    Connection:next_event(abbreviated, Record, State#state{expecting_finished = true});
+abbreviated(info, Msg, State, _) ->
+    handle_info(Msg, abbreviated, State);
+abbreviated(Type, Msg, State, Connection) ->
+    handle_common_event(Type, Msg, abbreviated, State, Connection).
+ 
 %%--------------------------------------------------------------------
--spec certify(#hello_request{} | #certificate{} |  #server_key_exchange{} |
+-spec certify(gen_statem:event_type(),
+	      #hello_request{} | #certificate{} |  #server_key_exchange{} |
 	      #certificate_request{} | #server_hello_done{} | #client_key_exchange{} | term(),
 	      #state{}, tls_connection | dtls_connection) ->
-		     gen_fsm_state_return().
+		     gen_statem:state_function_result().
 %%--------------------------------------------------------------------
-certify(#hello_request{}, State0, Connection) ->
-    {Record, State} = Connection:next_record(State0),
-    Connection:next_state(certify, hello, Record, State);
-
-certify(#certificate{asn1_certificates = []},
+certify({call, From}, Msg, State, Connection) ->
+    handle_call(Msg, From, certify, State, Connection);
+certify(info, Msg, State, _) ->
+    handle_info(Msg, certify, State);
+certify(internal, #certificate{asn1_certificates = []},
 	#state{role = server, negotiated_version = Version,
 	       ssl_options = #ssl_options{verify = verify_peer,
 					  fail_if_no_peer_cert = true}} =
@@ -396,15 +456,16 @@ certify(#certificate{asn1_certificates = []},
     Alert =  ?ALERT_REC(?FATAL,?HANDSHAKE_FAILURE),
     Connection:handle_own_alert(Alert, Version, certify, State);
 
-certify(#certificate{asn1_certificates = []},
+certify(internal, #certificate{asn1_certificates = []},
 	#state{role = server,
 	       ssl_options = #ssl_options{verify = verify_peer,
 					  fail_if_no_peer_cert = false}} =
 	State0, Connection) ->
-    {Record, State} = Connection:next_record(State0#state{client_certificate_requested = false}),
-    Connection:next_state(certify, certify, Record, State);
+    {Record, State} = 
+	Connection:next_record(State0#state{client_certificate_requested = false}),
+    Connection:next_event(certify, Record, State);
 
-certify(#certificate{} = Cert,
+certify(internal, #certificate{} = Cert,
         #state{negotiated_version = Version,
 	       role = Role,
 	       cert_db = CertDbHandle,
@@ -426,7 +487,7 @@ certify(#certificate{} = Cert,
             Connection:handle_own_alert(Alert, Version, certify, State)
     end;
 
-certify(#server_key_exchange{exchange_keys = Keys},
+certify(internal, #server_key_exchange{exchange_keys = Keys},
         #state{role = client, negotiated_version = Version,
 	       key_algorithm = Alg,
 	       public_key_info = PubKeyInfo,
@@ -438,28 +499,28 @@ certify(#server_key_exchange{exchange_keys = Keys},
        Alg == srp_dss; Alg == srp_rsa; Alg == srp_anon ->
 
     Params = ssl_handshake:decode_server_key(Keys, Alg, Version),
+
     %% Use negotiated value if TLS-1.2 otherwhise return default
     HashSign = negotiated_hashsign(Params#server_key_params.hashsign, Alg, PubKeyInfo, Version),
+
     case is_anonymous(Alg) of
 	true ->
 	    calculate_secret(Params#server_key_params.params,
 			     State#state{hashsign_algorithm = HashSign}, Connection);
 	false ->
-	    case  ssl_handshake:verify_server_key(Params, HashSign, ConnectionStates, Version, PubKeyInfo) of
+	    case  ssl_handshake:verify_server_key(Params, HashSign, 
+						  ConnectionStates, Version, PubKeyInfo) of
 		true ->
 		    calculate_secret(Params#server_key_params.params,
-				     State#state{hashsign_algorithm = HashSign}, Connection);
+				     State#state{hashsign_algorithm = HashSign}, 
+				     Connection);
 		false ->
 		    Connection:handle_own_alert(?ALERT_REC(?FATAL, ?DECRYPT_ERROR),
 						Version, certify, State)
 	    end
     end;
 
-certify(#server_key_exchange{} = Msg,
-        #state{role = client, key_algorithm = rsa} = State, Connection) ->
-    Connection:handle_unexpected_message(Msg, certify_server_keyexchange, State);
-
-certify(#certificate_request{hashsign_algorithms = HashSigns},
+certify(internal, #certificate_request{hashsign_algorithms = HashSigns},
 	#state{session = #session{own_certificate = Cert},
 	       key_algorithm = KeyExAlg,
 	       ssl_options = #ssl_options{signature_algs = SupportedHashSigns},
@@ -470,12 +531,12 @@ certify(#certificate_request{hashsign_algorithms = HashSigns},
 	    Connection:handle_own_alert(Alert, Version, certify, State0);
 	NegotiatedHashSign -> 
 	    {Record, State} = Connection:next_record(State0#state{client_certificate_requested = true}),
-	    Connection:next_state(certify, certify, Record,
+	    Connection:next_event(certify, Record,
 				  State#state{cert_hashsign_algorithm = NegotiatedHashSign})
     end;
 
 %% PSK and RSA_PSK might bypass the Server-Key-Exchange
-certify(#server_hello_done{},
+certify(internal, #server_hello_done{},
 	#state{session = #session{master_secret = undefined},
 	       negotiated_version = Version,
 	       psk_identity = PSKIdentity,
@@ -493,10 +554,10 @@ certify(#server_hello_done{},
 	    client_certify_and_key_exchange(State, Connection)
     end;
 
-certify(#server_hello_done{},
+certify(internal, #server_hello_done{},
 	#state{session = #session{master_secret = undefined},
 	       ssl_options = #ssl_options{user_lookup_fun = PSKLookup},
-	       negotiated_version = {Major, Minor},
+	       negotiated_version = {Major, Minor} = Version,
 	       psk_identity = PSKIdentity,
 	       premaster_secret = undefined,
 	       role = client,
@@ -504,16 +565,18 @@ certify(#server_hello_done{},
   when Alg == rsa_psk ->
     Rand = ssl_cipher:random_bytes(?NUM_OF_PREMASTERSECRET_BYTES-2),
     RSAPremasterSecret = <<?BYTE(Major), ?BYTE(Minor), Rand/binary>>,
-    case ssl_handshake:premaster_secret({Alg, PSKIdentity}, PSKLookup, RSAPremasterSecret) of
+    case ssl_handshake:premaster_secret({Alg, PSKIdentity}, PSKLookup, 
+					RSAPremasterSecret) of
 	#alert{} = Alert ->
-	    Alert;
+	    Connection:handle_own_alert(Alert, Version, certify, State0);
 	PremasterSecret ->
-	    State = master_secret(PremasterSecret, State0#state{premaster_secret = RSAPremasterSecret}),
+	    State = master_secret(PremasterSecret, 
+				  State0#state{premaster_secret = RSAPremasterSecret}),
 	    client_certify_and_key_exchange(State, Connection)
     end;
 
 %% Master secret was determined with help of server-key exchange msg
-certify(#server_hello_done{},
+certify(internal, #server_hello_done{}, 
 	#state{session = #session{master_secret = MasterSecret} = Session,
 	       connection_states = ConnectionStates0,
 	       negotiated_version = Version,
@@ -529,7 +592,7 @@ certify(#server_hello_done{},
     end;
 
 %% Master secret is calculated from premaster_secret
-certify(#server_hello_done{},
+certify(internal, #server_hello_done{},
 	#state{session = Session0,
 	       connection_states = ConnectionStates0,
 	       negotiated_version = Version,
@@ -546,14 +609,15 @@ certify(#server_hello_done{},
 	    Connection:handle_own_alert(Alert, Version, certify, State0)
     end;
 
-certify(#client_key_exchange{} = Msg,
+certify(internal = Type, #client_key_exchange{} = Msg,
 	#state{role = server,
 	       client_certificate_requested = true,
-	       ssl_options = #ssl_options{fail_if_no_peer_cert = true}} = State, Connection) ->
+	       ssl_options = #ssl_options{fail_if_no_peer_cert = true}} = State, 
+	Connection) ->
     %% We expect a certificate here
-    Connection:handle_unexpected_message(Msg, certify_client_key_exchange, State);
+    handle_common_event(Type, Msg, certify, State, Connection);
 
-certify(#client_key_exchange{exchange_keys = Keys},
+certify(internal, #client_key_exchange{exchange_keys = Keys},
 	State = #state{key_algorithm = KeyAlg, negotiated_version = Version}, Connection) ->
     try
 	certify_client_key_exchange(ssl_handshake:decode_client_key(Keys, KeyAlg, Version),
@@ -563,22 +627,23 @@ certify(#client_key_exchange{exchange_keys = Keys},
 	    Connection:handle_own_alert(Alert, Version, certify, State)
     end;
 
-certify(timeout, State, _) ->
-    {next_state, certify, State, hibernate};
-
-certify(Msg, State, Connection) ->
-    Connection:handle_unexpected_message(Msg, certify, State).
-
+certify(Type, Msg, State, Connection) ->
+    handle_common_event(Type, Msg, certify, State, Connection).
+ 
 %%--------------------------------------------------------------------
--spec cipher(#hello_request{} | #certificate_verify{} | #finished{} | term(),
+-spec cipher(gen_statem:event_type(),
+	     #hello_request{} | #certificate_verify{} | #finished{} | term(),
 	     #state{}, tls_connection | dtls_connection) ->
-		    gen_fsm_state_return().
+		    gen_statem:state_function_result().
 %%--------------------------------------------------------------------
-cipher(#hello_request{}, State0, Connection) ->
-    {Record, State} = Connection:next_record(State0),
-    Connection:next_state(cipher, hello, Record, State);
+cipher({call, From}, Msg, State, Connection) ->
+    handle_call(Msg, From, cipher, State, Connection);
 
-cipher(#certificate_verify{signature = Signature, hashsign_algorithm = CertHashSign},
+cipher(info, Msg, State, _) ->
+    handle_info(Msg, cipher, State);
+
+cipher(internal, #certificate_verify{signature = Signature, 
+				     hashsign_algorithm = CertHashSign},
        #state{role = server,
 	      key_algorithm = KexAlg,
 	      public_key_info = PublicKeyInfo,
@@ -593,19 +658,20 @@ cipher(#certificate_verify{signature = Signature, hashsign_algorithm = CertHashS
 					  Version, HashSign, MasterSecret, Handshake) of
 	valid ->
 	    {Record, State} = Connection:next_record(State0),
-	    Connection:next_state(cipher, cipher, Record,
+	    Connection:next_event(cipher, Record,
 				  State#state{cert_hashsign_algorithm = HashSign});
 	#alert{} = Alert ->
 	    Connection:handle_own_alert(Alert, Version, cipher, State0)
     end;
 
 %% client must send a next protocol message if we are expecting it
-cipher(#finished{}, #state{role = server, expecting_next_protocol_negotiation = true,
-			   negotiated_protocol = undefined, negotiated_version = Version} = State0,
+cipher(internal, #finished{},
+       #state{role = server, expecting_next_protocol_negotiation = true,
+	      negotiated_protocol = undefined, negotiated_version = Version} = State0,
        Connection) ->
     Connection:handle_own_alert(?ALERT_REC(?FATAL,?UNEXPECTED_MESSAGE), Version, cipher, State0);
 
-cipher(#finished{verify_data = Data} = Finished,
+cipher(internal, #finished{verify_data = Data} = Finished,
        #state{negotiated_version = Version,
 	      host = Host,
 	      port = Port,
@@ -621,109 +687,154 @@ cipher(#finished{verify_data = Data} = Finished,
 					 MasterSecret, Handshake0) of
         verified ->
 	    Session = register_session(Role, Host, Port, Session0),
-	    cipher_role(Role, Data, Session, State#state{expecting_finished = false}, Connection);
+	    cipher_role(Role, Data, Session, 
+			State#state{expecting_finished = false}, Connection);
         #alert{} = Alert ->
 	    Connection:handle_own_alert(Alert, Version, cipher, State)
     end;
 
 %% only allowed to send next_protocol message after change cipher spec
 %% & before finished message and it is not allowed during renegotiation
-cipher(#next_protocol{selected_protocol = SelectedProtocol},
+cipher(internal, #next_protocol{selected_protocol = SelectedProtocol},
        #state{role = server, expecting_next_protocol_negotiation = true,
 	      expecting_finished = true} = State0, Connection) ->
-    {Record, State} = Connection:next_record(State0#state{negotiated_protocol = SelectedProtocol}),
-    Connection:next_state(cipher, cipher, Record, State#state{expecting_next_protocol_negotiation = false});
-
-cipher(timeout, State, _) ->
-    {next_state, cipher, State, hibernate};
-
-cipher(Msg, State, Connection) ->
-    Connection:handle_unexpected_message(Msg, cipher, State).
+    {Record, State} = 
+	Connection:next_record(State0#state{negotiated_protocol = SelectedProtocol}),
+    Connection:next_event(cipher, Record, 
+			  State#state{expecting_next_protocol_negotiation = false});
+cipher(internal, #change_cipher_spec{type = <<1>>},  #state{connection_states = ConnectionStates0} =
+	   State0, Connection) ->
+    ConnectionStates1 =
+	ssl_record:activate_pending_connection_state(ConnectionStates0, read),
+    {Record, State} = Connection:next_record(State0#state{connection_states = 
+							      ConnectionStates1}),
+    Connection:next_event(cipher, Record, State#state{expecting_finished = true});
+cipher(Type, Msg, State, Connection) ->
+    handle_common_event(Type, Msg, cipher, State, Connection).
 
 %%--------------------------------------------------------------------
--spec connection(term(), #state{}, tls_connection | dtls_connection) ->
-			gen_fsm_state_return().
+-spec connection(gen_statem:event_type(), term(), 
+		 #state{}, tls_connection | dtls_connection) ->
+			gen_statem:state_function_result().
 %%--------------------------------------------------------------------
-connection(timeout, State,  _) ->
-    {next_state, connection, State, hibernate};
+connection({call, From}, {application_data, Data},  
+	   #state{protocol_cb = Connection} = State, Connection) ->
+    %% We should look into having a worker process to do this to 
+    %% parallize send and receive decoding and not block the receiver
+    %% if sending is overloading the socket.
+     try
+	 Connection:write_application_data(Data, From, State)
+     catch throw:Error ->
+	     hibernate_after(connection, State, [{reply, From, Error}])
+     end;
+connection({call, RecvFrom}, {recv, N, Timeout},  
+	   #state{protocol_cb = Connection,  socket_options =
+		      #socket_options{active = false}} = State0, Connection) ->
+    Timer = start_or_recv_cancel_timer(Timeout, RecvFrom),
+    Connection:passive_receive(State0#state{bytes_to_read = N,
+					    start_or_recv_from = RecvFrom, 
+					    timer = Timer}, connection);
+connection({call, From}, renegotiate, #state{protocol_cb = Connection} = State, 
+	   Connection) ->
+    Connection:renegotiate(State#state{renegotiation = {true, From}}, []);
+connection({call, From}, peer_certificate, 
+	   #state{session = #session{peer_certificate = Cert}} = State, _) ->
+    hibernate_after(connection, State, [{reply, From,  {ok, Cert}}]); 
+connection({call, From}, connection_information, State, _) ->
+    Info = connection_info(State),
+    hibernate_after(connection, State, [{reply, From, {ok, Info}}]);
+connection({call, From}, session_info,  #state{session = #session{session_id = Id,
+								  cipher_suite = Suite}} = State, _) ->
+    SessionInfo = [{session_id, Id}, 
+		   {cipher_suite, ssl_cipher:erl_suite_definition(Suite)}],
+    hibernate_after(connection, State, [{reply, From, SessionInfo}]);
+connection({call, From}, negotiated_protocol, 
+	   #state{negotiated_protocol = undefined} = State, _) ->
+    hibernate_after(connection, State, [{reply, From, {error, protocol_not_negotiated}}]);
+connection({call, From}, negotiated_protocol, 
+	   #state{negotiated_protocol = SelectedProtocol} = State, _) ->
+    hibernate_after(connection, State,
+		    [{reply, From, {ok, SelectedProtocol}}]);
+connection({call, From}, Msg, State, Connection) ->
+    handle_call(Msg, From, connection, State, Connection);
+connection(info, Msg, State, _) ->
+    handle_info(Msg, connection, State);
+connection(internal, {recv, _}, State, Connection) ->
+    Connection:passive_receive(State, connection);
+connection(Type, Msg, State, Connection) ->
+    handle_common_event(Type, Msg, connection, State, Connection).
 
-connection(Msg, State, Connection) ->
-    Connection:handle_unexpected_message(Msg, connection, State).
+%%--------------------------------------------------------------------
+-spec downgrade(gen_statem:event_type(), term(), 
+		#state{}, tls_connection | dtls_connection) ->
+		       gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+downgrade(internal, #alert{description = ?CLOSE_NOTIFY},
+	  #state{transport_cb = Transport, socket = Socket,
+		 downgrade = {Pid, From}} = State, _) ->
+    ssl_socket:setopts(Transport, Socket, [{active, false}, {packet, 0}, {mode, binary}]),
+    Transport:controlling_process(Socket, Pid),
+    gen_statem:reply(From, {ok, Socket}),
+    {stop, normal, State};
+downgrade(timeout, downgrade, #state{downgrade = {_, From}} = State, _) ->
+    gen_statem:reply(From, {error, timeout}),
+    {stop, normal, State};
+downgrade(Type, Event, State, Connection) ->
+    handle_common_event(Type, Event, downgrade, State, Connection).
 
 %%--------------------------------------------------------------------
-%% Description: Whenever a gen_fsm receives an event sent using
-%% gen_fsm:sync_send_all_state_event/2,3, this function is called to handle
-%% the event.
+%% Event handling functions called by state functions to handle
+%% common or unexpected events for the state.
 %%--------------------------------------------------------------------
-handle_sync_event({application_data, Data}, From, connection,  
-		  #state{protocol_cb = Connection} = State) ->
-    %% We should look into having a worker process to do this to 
-    %% parallize send and receive decoding and not block the receiver
-    %% if sending is overloading the socket.
-    try
-	Connection:write_application_data(Data, From, State)
-    catch throw:Error ->
-	    {reply, Error, connection, State, get_timeout(State)}
+handle_common_event(internal, {tls_record, TLSRecord}, StateName, State, Connection) -> 
+    Connection:handle_common_event(internal, TLSRecord, StateName, State);
+handle_common_event(internal, #hello_request{}, StateName, #state{role = client} = State0, Connection)
+  when StateName =:= connection ->
+    {Record, State} = Connection:next_record(State0),
+    Connection:next_event(StateName, Record, State);
+handle_common_event(timeout, hibernate, _, _, _) ->
+    {keep_state_and_data, [hibernate]};
+handle_common_event(internal, {application_data, Data}, StateName, State0, Connection) ->
+    case Connection:read_application_data(Data, State0) of
+	{stop, Reason, State} ->
+   	    {stop, Reason, State};
+	{Record, State} ->
+   	    Connection:next_event(StateName, Record, State)
     end;
-handle_sync_event({application_data, Data}, From, StateName, 
-		  #state{send_queue = Queue} = State) ->
+handle_common_event(internal, #change_cipher_spec{type = <<1>>}, StateName, 
+		    #state{negotiated_version = Version} = State, Connection) ->
+    Connection:handle_own_alert(?ALERT_REC(?FATAL, ?HANDSHAKE_FAILURE), Version, 
+				StateName, State);
+handle_common_event(internal, _, _, _, _) ->
+    {keep_state_and_data, [postpone]};
+handle_common_event(_Type, Msg, StateName, #state{negotiated_version = Version} = State, 
+		    Connection) ->
+    Alert =  ?ALERT_REC(?FATAL,?UNEXPECTED_MESSAGE),
+    Connection:handle_own_alert(Alert, Version, {StateName, Msg}, State).
+
+handle_call({application_data, _Data}, _, _, _, _) ->
     %% In renegotiation priorities handshake, send data when handshake is finished
-    {next_state, StateName,
-     State#state{send_queue = queue:in({From, Data}, Queue)},
-     get_timeout(State)};
-
-handle_sync_event({start, Timeout}, StartFrom, hello, #state{role = Role,
-							     protocol_cb = Connection, 
-							     ssl_options = SSLOpts} = State0) ->
-    try 
-	State = ssl_config(SSLOpts, Role, State0),
-	Timer = start_or_recv_cancel_timer(Timeout, StartFrom),
-	Connection:hello(start, State#state{start_or_recv_from = StartFrom,
-					    timer = Timer})
-    catch throw:Error ->
-	    {stop, normal, {error, Error}, State0}
-    end;
-
-handle_sync_event({start, {Opts, EmOpts}, Timeout}, From, StateName, State) ->
-    try 
-	handle_sync_event({start, Timeout}, From, StateName, State#state{socket_options = EmOpts,
-									 ssl_options = Opts})
-    catch throw:Error ->
-	    {stop, normal, {error, Error}, State}
-    end;	
-
-%% These two clauses below could happen if a server upgrades a socket in
-%% active mode. Note that in this case we are lucky that
-%% controlling_process has been evalueated before receiving handshake
-%% messages from client. The server should put the socket in passive
-%% mode before telling the client that it is willing to upgrade
-%% and before calling ssl:ssl_accept/2. These clauses are 
-%% here to make sure it is the users problem and not owers if
-%% they upgrade an active socket. 
-handle_sync_event({start,_}, _, connection, State) ->
-    {reply, connected, connection, State, get_timeout(State)};
-
-handle_sync_event({start, Timeout}, StartFrom, StateName,  #state{role = Role, ssl_options = SslOpts} = State0) ->
-    try 
-	State = ssl_config(SslOpts, Role, State0),
-	Timer = start_or_recv_cancel_timer(Timeout, StartFrom),
-	{next_state, StateName, State#state{start_or_recv_from = StartFrom,
-					    timer = Timer}, get_timeout(State)}
-    catch throw:Error ->
-	    {stop, normal, {error, Error}, State0}
-    end;	
-
-handle_sync_event({close, _} = Close, _, StateName, #state{protocol_cb = Connection} = State) ->
+    {keep_state_and_data, [postpone]};
+handle_call({close, {Pid, Timeout}}, From, StateName, State0, Connection) when is_pid(Pid) ->
+    %% terminate will send close alert to peer
+    State = State0#state{downgrade = {Pid, From}},
+    Connection:terminate(downgrade, StateName, State),
+    %% User downgrades connection
+    %% When downgrading an TLS connection to a transport connection
+    %% we must recive the close alert from the peer before releasing the 
+    %% transport socket.
+    {next_state, downgrade, State, [{timeout, Timeout, downgrade}]};
+handle_call({close, _} = Close, From, StateName, State, Connection) ->
     %% Run terminate before returning so that the reuseaddr
-    %% inet-option and possible downgrade will work as intended.
+    %% inet-option 
     Result = Connection:terminate(Close, StateName, State),
-    {stop, normal, Result, State#state{terminated = true}};
-
-handle_sync_event({shutdown, How0}, _, StateName,
-		  #state{transport_cb = Transport,
-			 negotiated_version = Version,
-			 connection_states = ConnectionStates,
-			 socket = Socket} = State) ->
+    {stop_and_reply, {shutdown, normal},  
+     {reply, From, Result}, State};
+handle_call({shutdown, How0}, From, _,
+	    #state{transport_cb = Transport,
+		   negotiated_version = Version,
+		   connection_states = ConnectionStates,
+		   socket = Socket}, _) ->
     case How0 of
 	How when How == write; How == both ->	    
 	    Alert = ?ALERT_REC(?WARNING, ?CLOSE_NOTIFY),
@@ -733,89 +844,84 @@ handle_sync_event({shutdown, How0}, _, StateName,
 	_ ->
 	    ok
     end,
-    
+
     case Transport:shutdown(Socket, How0) of
 	ok ->
-	    {reply, ok, StateName, State, get_timeout(State)};
+	    {keep_state_and_data, [{reply, From, ok}]};
 	Error ->
-	    {stop, normal, Error, State}
+	    gen_statem:reply(From, {error, Error}),
+	    {stop, normal}
     end;
-handle_sync_event({recv, _N, _Timeout}, _RecvFrom, StateName,  
-		  #state{socket_options = #socket_options{active = Active}} = State) when Active =/= false ->
-    {reply, {error, einval}, StateName, State, get_timeout(State)};
-handle_sync_event({recv, N, Timeout}, RecvFrom, connection = StateName,  
-		  #state{protocol_cb = Connection} = State0) ->
-    Timer = start_or_recv_cancel_timer(Timeout, RecvFrom),
-    Connection:passive_receive(State0#state{bytes_to_read = N,
-					    start_or_recv_from = RecvFrom, timer = Timer}, StateName);
-%% Doing renegotiate wait with handling request until renegotiate is
-%% finished. Will be handled by next_state_is_connection/2.
-handle_sync_event({recv, N, Timeout}, RecvFrom, StateName, State) ->
+handle_call({recv, _N, _Timeout}, From, _,  
+		  #state{socket_options = 
+			     #socket_options{active = Active}}, _) when Active =/= false ->
+    {keep_state_and_data, [{reply, From, {error, einval}}]};
+handle_call({recv, N, Timeout}, RecvFrom, StateName, State, _) ->
+    %% Doing renegotiate wait with handling request until renegotiate is
+    %% finished. 
     Timer = start_or_recv_cancel_timer(Timeout, RecvFrom),
     {next_state, StateName, State#state{bytes_to_read = N, start_or_recv_from = RecvFrom,
-					timer = Timer},
-     get_timeout(State)};
-handle_sync_event({new_user, User}, _From, StateName, 
-		  State =#state{user_application = {OldMon, _}}) ->
+					timer = Timer}, 
+     [{next_event, internal, {recv, RecvFrom}}]};
+handle_call({new_user, User}, From, StateName, 
+		  State =#state{user_application = {OldMon, _}}, _) ->
     NewMon = erlang:monitor(process, User),
     erlang:demonitor(OldMon, [flush]),
-    {reply, ok, StateName, State#state{user_application = {NewMon,User}},
-     get_timeout(State)};
-handle_sync_event({get_opts, OptTags}, _From, StateName,
+    {next_state, StateName, State#state{user_application = {NewMon,User}},
+     [{reply, From, ok}]};
+handle_call({get_opts, OptTags}, From, _,
 		  #state{socket = Socket,
 			 transport_cb = Transport,
-			 socket_options = SockOpts} = State) ->
+			 socket_options = SockOpts}, _) ->
     OptsReply = get_socket_opts(Transport, Socket, OptTags, SockOpts, []),
-    {reply, OptsReply, StateName, State, get_timeout(State)};
-handle_sync_event(negotiated_protocol, _From, StateName, #state{negotiated_protocol = undefined} = State) ->
-    {reply, {error, protocol_not_negotiated}, StateName, State, get_timeout(State)};
-handle_sync_event(negotiated_protocol, _From, StateName, #state{negotiated_protocol = SelectedProtocol} = State) ->
-    {reply, {ok, SelectedProtocol}, StateName, State, get_timeout(State)};
-handle_sync_event({set_opts, Opts0}, _From, StateName0, 
-		  #state{socket_options = Opts1, 
+    {keep_state_and_data, [{reply, From, OptsReply}]};
+handle_call({set_opts, Opts0}, From, connection = StateName0, 
+	    #state{socket_options = Opts1, 
 			 protocol_cb = Connection,
 			 socket = Socket,
 			 transport_cb = Transport,
-			 user_data_buffer = Buffer} = State0) ->
+			 user_data_buffer = Buffer} = State0, _) ->
     {Reply, Opts} = set_socket_opts(Transport, Socket, Opts0, Opts1, []),
     State1 = State0#state{socket_options = Opts},
     if 
 	Opts#socket_options.active =:= false ->
-	    {reply, Reply, StateName0, State1, get_timeout(State1)};
+	    hibernate_after(StateName0, State1, [{reply, From, Reply}]);
 	Buffer =:= <<>>, Opts1#socket_options.active =:= false ->
             %% Need data, set active once
 	    {Record, State2} = Connection:next_record_if_active(State1),
 	    %% Note: Renogotiation may cause StateName0 =/= StateName
-	    case Connection:next_state(StateName0, StateName0, Record, State2) of
-		{next_state, StateName, State, Timeout} ->
-		    {reply, Reply, StateName, State, Timeout};
+	    case Connection:next_event(StateName0, Record, State2) of
+		{next_state, StateName, State} ->
+		    hibernate_after(StateName, State, [{reply, From, Reply}]);
+		{next_state, StateName, State, Actions} -> 
+		    hibernate_after(StateName, State, [{reply, From, Reply} | Actions]);
 		{stop, Reason, State} ->
 		    {stop, Reason, State}
 	    end;
 	Buffer =:= <<>> ->
             %% Active once already set 
-	    {reply, Reply, StateName0, State1, get_timeout(State1)};
+	    hibernate_after(StateName0, State1, [{reply, From, Reply}]);
 	true ->
 	    case Connection:read_application_data(<<>>, State1) of
-		Stop = {stop,_,_} ->
-		    Stop;
+		{stop, Reason, State} ->
+		    {stop, Reason, State};
 		{Record, State2} ->
 		    %% Note: Renogotiation may cause StateName0 =/= StateName
-		    case Connection:next_state(StateName0, StateName0, Record, State2) of
-			{next_state, StateName, State, Timeout} ->
-			    {reply, Reply, StateName, State, Timeout};
-			{stop, Reason, State} ->
-			    {stop, Reason, State}
+		    case Connection:next_event(StateName0, Record, State2) of
+			{next_state, StateName, State} ->
+			    hibernate_after(StateName, State, [{reply, From, Reply}]);
+			{next_state, StateName, State, Actions} -> 
+			    hibernate_after(StateName, State, [{reply, From, Reply} | Actions]);
+			{stop, _, _} = Stop ->
+			    Stop
 		    end
 	    end
     end;
-handle_sync_event(renegotiate, From, connection,  #state{protocol_cb = Connection} = State) ->
-    Connection:renegotiate(State#state{renegotiation = {true, From}});
-handle_sync_event(renegotiate, _, StateName, State) ->
-    {reply, {error, already_renegotiating}, StateName, State, get_timeout(State)};
-handle_sync_event({prf, Secret, Label, Seed, WantedLength}, _, StateName,
-		  #state{connection_states = ConnectionStates,
-			 negotiated_version = Version} = State) ->
+handle_call(renegotiate, From, StateName, _, _) when StateName =/= connection ->
+    {keep_state_and_data, [{reply, From, {error, already_renegotiating}}]};
+handle_call({prf, Secret, Label, Seed, WantedLength}, From, _,
+	    #state{connection_states = ConnectionStates,
+		   negotiated_version = Version}, _) ->
     ConnectionState =
 	ssl_record:current_connection_state(ConnectionStates, read),
     SecParams = ConnectionState#connection_state.security_parameters,
@@ -837,27 +943,9 @@ handle_sync_event({prf, Secret, Label, Seed, WantedLength}, _, StateName,
 		exit:_ -> {error, badarg};
 		error:Reason -> {error, Reason}
 	    end,
-    {reply, Reply, StateName, State, get_timeout(State)};
-handle_sync_event(session_info, _, StateName, 
-		  #state{session = #session{session_id = Id,
-					    cipher_suite = Suite}} = State) ->
-    {reply, [{session_id, Id}, 
-	     {cipher_suite, ssl_cipher:erl_suite_definition(Suite)}],
-     StateName, State, get_timeout(State)};
-handle_sync_event(peer_certificate, _, StateName, 
-		  #state{session = #session{peer_certificate = Cert}} 
-		  = State) ->
-    {reply, {ok, Cert}, StateName, State, get_timeout(State)};
-handle_sync_event(connection_information, _, StateName, State) ->
-    Info = connection_info(State),
-    {reply, {ok, Info}, StateName, State, get_timeout(State)}.
-
-connection_info(#state{sni_hostname = SNIHostname, 
-		       session = #session{cipher_suite = CipherSuite}, 
-		       negotiated_version = Version, ssl_options = Opts}) ->
-    [{protocol, tls_record:protocol_version(Version)}, 
-     {cipher_suite, ssl_cipher:erl_suite_definition(CipherSuite)}, 
-     {sni_hostname, SNIHostname}] ++ ssl_options_list(Opts).
+    {keep_state_and_data, [{reply, From, Reply}]};
+handle_call(_,_,_,_,_) ->
+    {keep_state_and_data, [postpone]}.
 
 handle_info({ErrorTag, Socket, econnaborted}, StateName,  
 	    #state{socket = Socket, transport_cb = Transport,
@@ -865,7 +953,8 @@ handle_info({ErrorTag, Socket, econnaborted}, StateName,
 		   protocol_cb = Connection,
 		   error_tag = ErrorTag,
 		   tracker = Tracker} = State)  when StateName =/= connection ->
-    Connection:alert_user(Transport, Tracker,Socket, StartFrom, ?ALERT_REC(?FATAL, ?CLOSE_NOTIFY), Role),
+    Connection:alert_user(Transport, Tracker,Socket, 
+			  StartFrom, ?ALERT_REC(?FATAL, ?CLOSE_NOTIFY), Role),
     {stop, normal, State};
 
 handle_info({ErrorTag, Socket, Reason}, StateName, #state{socket = Socket,
@@ -888,47 +977,46 @@ handle_info({'EXIT', Socket, normal}, _StateName, #state{socket = Socket} = Stat
     {stop, {shutdown, transport_closed}, State};
 
 handle_info(allow_renegotiate, StateName, State) ->
-    {next_state, StateName, State#state{allow_renegotiate = true}, get_timeout(State)};
+    {next_state, StateName, State#state{allow_renegotiate = true}};
 
 handle_info({cancel_start_or_recv, StartFrom}, StateName,
 	    #state{renegotiation = {false, first}} = State) when StateName =/= connection ->
-    gen_fsm:reply(StartFrom, {error, timeout}),
-    {stop, {shutdown, user_timeout}, State#state{timer = undefined}};
+    {stop_and_reply, {shutdown, user_timeout},  
+     {reply, StartFrom, {error, timeout}}, State#state{timer = undefined}};
 
-handle_info({cancel_start_or_recv, RecvFrom}, StateName, #state{start_or_recv_from = RecvFrom} = State) ->
-    gen_fsm:reply(RecvFrom, {error, timeout}),
+handle_info({cancel_start_or_recv, RecvFrom}, StateName, 
+	    #state{start_or_recv_from = RecvFrom} = State) when RecvFrom =/= undefined ->
     {next_state, StateName, State#state{start_or_recv_from = undefined,
 					bytes_to_read = undefined,
-					timer = undefined}, get_timeout(State)};
+					timer = undefined}, [{reply, RecvFrom, {error, timeout}}]};
 
 handle_info({cancel_start_or_recv, _RecvFrom}, StateName, State) ->
-    {next_state, StateName, State#state{timer = undefined}, get_timeout(State)};
+    {next_state, StateName, State#state{timer = undefined}};
 
 handle_info(Msg, StateName, #state{socket = Socket, error_tag = Tag} = State) ->
     Report = io_lib:format("SSL: Got unexpected info: ~p ~n", [{Msg, Tag, Socket}]),
     error_logger:info_report(Report),
-    {next_state, StateName, State, get_timeout(State)}.
-
+    {next_state, StateName, State}.
 
+%%--------------------------------------------------------------------
+%% gen_statem callbacks
+%%--------------------------------------------------------------------
 terminate(_, _, #state{terminated = true}) ->
     %% Happens when user closes the connection using ssl:close/1
     %% we want to guarantee that Transport:close has been called
     %% when ssl:close/1 returns.
     ok;
+
 terminate({shutdown, transport_closed} = Reason, 
-	  _StateName, #state{send_queue = SendQueue, protocol_cb = Connection,
-			     socket = Socket, transport_cb = Transport,
-			     renegotiation = Renegotiate} = State) ->
+	  _StateName, #state{protocol_cb = Connection,
+			     socket = Socket, transport_cb = Transport} = State) ->
     handle_trusted_certs_db(State),
-    notify_senders(SendQueue),
-    notify_renegotiater(Renegotiate),
     Connection:close(Reason, Socket, Transport, undefined, undefined);
-terminate({shutdown, own_alert}, _StateName, #state{send_queue = SendQueue, protocol_cb = Connection,
-						    socket = Socket, transport_cb = Transport,
-						    renegotiation = Renegotiate} = State) ->
+terminate({shutdown, own_alert}, _StateName, #state{%%send_queue = SendQueue, 
+						protocol_cb = Connection,
+						socket = Socket, 
+						transport_cb = Transport} = State) ->
     handle_trusted_certs_db(State),
-    notify_senders(SendQueue),
-    notify_renegotiater(Renegotiate),
     case application:get_env(ssl, alert_timeout) of
 	{ok, Timeout} when is_integer(Timeout) ->
 	    Connection:close({timeout, Timeout}, Socket, Transport, undefined, undefined);
@@ -939,26 +1027,22 @@ terminate(Reason, connection, #state{negotiated_version = Version,
 				     protocol_cb = Connection,
 				     connection_states = ConnectionStates0, 
 				     ssl_options = #ssl_options{padding_check = Check},
-				     transport_cb = Transport, socket = Socket, 
-				     send_queue = SendQueue, renegotiation = Renegotiate} = State) ->
+				     transport_cb = Transport, socket = Socket
+				    } = State) ->
     handle_trusted_certs_db(State),
-    notify_senders(SendQueue),
-    notify_renegotiater(Renegotiate),
     {BinAlert, ConnectionStates} = terminate_alert(Reason, Version, ConnectionStates0),
     Transport:send(Socket, BinAlert),
     Connection:close(Reason, Socket, Transport, ConnectionStates, Check);
 
 terminate(Reason, _StateName, #state{transport_cb = Transport, protocol_cb = Connection,
-				      socket = Socket, send_queue = SendQueue,
-				      renegotiation = Renegotiate} = State) ->
+				     socket = Socket 
+				    } = State) ->
     handle_trusted_certs_db(State),
-    notify_senders(SendQueue),
-    notify_renegotiater(Renegotiate),
     Connection:close(Reason, Socket, Transport, undefined, undefined).
 
-format_status(normal, [_, State]) ->
-    [{data, [{"StateData", State}]}];  
-format_status(terminate, [_, State]) ->
+format_status(normal, [_, StateName, State]) ->
+    [{data, [{"State", {StateName, State}}]}];  
+format_status(terminate, [_, StateName, State]) ->
     SslOptions = (State#state.ssl_options),
     NewOptions = SslOptions#ssl_options{password = ?SECRET_PRINTOUT,
 					cert = ?SECRET_PRINTOUT,
@@ -967,39 +1051,29 @@ format_status(terminate, [_, State]) ->
 					dh = ?SECRET_PRINTOUT,
 					psk_identity = ?SECRET_PRINTOUT,
 					srp_identity = ?SECRET_PRINTOUT},
-    [{data, [{"StateData", State#state{connection_states = ?SECRET_PRINTOUT,
-				       protocol_buffers =  ?SECRET_PRINTOUT,
-				       user_data_buffer = ?SECRET_PRINTOUT,
-				       tls_handshake_history =  ?SECRET_PRINTOUT,
-				       session =  ?SECRET_PRINTOUT,
-				       private_key =  ?SECRET_PRINTOUT,
-				       diffie_hellman_params = ?SECRET_PRINTOUT,
-				       diffie_hellman_keys =  ?SECRET_PRINTOUT,
-				       srp_params = ?SECRET_PRINTOUT,
-				       srp_keys =  ?SECRET_PRINTOUT,
-				       premaster_secret =  ?SECRET_PRINTOUT,
-				       ssl_options = NewOptions
-				      }}]}].
+    [{data, [{"State", {StateName, State#state{connection_states = ?SECRET_PRINTOUT,
+					       protocol_buffers =  ?SECRET_PRINTOUT,
+					       user_data_buffer = ?SECRET_PRINTOUT,
+					       tls_handshake_history =  ?SECRET_PRINTOUT,
+					       session =  ?SECRET_PRINTOUT,
+					       private_key =  ?SECRET_PRINTOUT,
+					       diffie_hellman_params = ?SECRET_PRINTOUT,
+					       diffie_hellman_keys =  ?SECRET_PRINTOUT,
+					       srp_params = ?SECRET_PRINTOUT,
+					       srp_keys =  ?SECRET_PRINTOUT,
+					       premaster_secret =  ?SECRET_PRINTOUT,
+					       ssl_options = NewOptions}
+		       }}]}].
+
 %%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
-ssl_config(Opts, Role, State) ->
-    {ok, Ref, CertDbHandle, FileRefHandle, CacheHandle, CRLDbInfo, OwnCert, Key, DHParams} = 
-	ssl_config:init(Opts, Role), 
-    Handshake = ssl_handshake:init_handshake_history(),
-    TimeStamp = erlang:monotonic_time(),
-    Session = State#state.session,
-    State#state{tls_handshake_history = Handshake,
-		session = Session#session{own_certificate = OwnCert,
-					  time_stamp = TimeStamp},
-		file_ref_db = FileRefHandle,
-		cert_db_ref = Ref,
-		cert_db = CertDbHandle,
-		crl_db = CRLDbInfo,
-		session_cache = CacheHandle,
-		private_key = Key,
-		diffie_hellman_params = DHParams,
-		ssl_options = Opts}.
+connection_info(#state{sni_hostname = SNIHostname, 
+		       session = #session{cipher_suite = CipherSuite}, 
+		       negotiated_version = Version, ssl_options = Opts}) ->
+    [{protocol, tls_record:protocol_version(Version)}, 
+     {cipher_suite, ssl_cipher:erl_suite_definition(CipherSuite)}, 
+     {sni_hostname, SNIHostname}] ++ ssl_options_list(Opts).
 
 do_server_hello(Type, #hello_extensions{next_protocol_negotiation = NextProtocols} =
 		    ServerHelloExt,
@@ -1033,7 +1107,7 @@ new_server_hello(#server_hello{cipher_suite = CipherSuite,
 				 cipher_suite = CipherSuite,
 				 compression_method = Compression},
 	    {Record, State} = Connection:next_record(State2#state{session = Session}),
-	    Connection:next_state(hello, certify, Record, State)
+	    Connection:next_event(certify, Record, State)
     catch
         #alert{} = Alert ->
 	    Connection:handle_own_alert(Alert, Version, hello, State0)
@@ -1051,7 +1125,7 @@ resumed_server_hello(#state{session = Session,
 	    State2 =
 		finalize_handshake(State1, abbreviated, Connection),
 	    {Record, State} = Connection:next_record(State2),
-	    Connection:next_state(hello, abbreviated, Record, State);
+	    Connection:next_event(abbreviated, Record, State);
 	#alert{} = Alert ->
 	    Connection:handle_own_alert(Alert, Version, hello, State0)
     end.
@@ -1076,7 +1150,7 @@ handle_peer_cert(Role, PeerCert, PublicKeyInfo,
     State2 = handle_peer_cert_key(Role, PeerCert, PublicKeyInfo, KeyAlg, State1),
 
     {Record, State} = Connection:next_record(State2),
-    Connection:next_state(certify, certify, Record, State).
+    Connection:next_event(certify, Record, State).
 
 handle_peer_cert_key(client, _,
 		     {?'id-ecPublicKey',  #'ECPoint'{point = _ECPoint} = PublicKey,
@@ -1139,7 +1213,7 @@ client_certify_and_key_exchange(#state{negotiated_version = Version} =
 		       %% Reinitialize
 		       client_certificate_requested = false},
 	    {Record, State} = Connection:next_record(State3),
-	    Connection:next_state(certify, cipher, Record, State)
+	    Connection:next_event(cipher, Record, State)
     catch
         throw:#alert{} = Alert ->
 	    Connection:handle_own_alert(Alert, Version, certify, State0)
@@ -1173,20 +1247,25 @@ certify_client_key_exchange(#client_ec_diffie_hellman_public{dh_public = ClientP
     calculate_master_secret(PremasterSecret, State, Connection, certify, cipher);
 
 certify_client_key_exchange(#client_psk_identity{} = ClientKey,
-			    #state{ssl_options = #ssl_options{user_lookup_fun = PSKLookup}} = State0, Connection) ->
+			    #state{ssl_options = 
+				       #ssl_options{user_lookup_fun = PSKLookup}} = State0,
+			    Connection) ->
     PremasterSecret = ssl_handshake:premaster_secret(ClientKey, PSKLookup),
     calculate_master_secret(PremasterSecret, State0, Connection, certify, cipher);
 
 certify_client_key_exchange(#client_dhe_psk_identity{} = ClientKey,
 			    #state{diffie_hellman_params = #'DHParameter'{} = Params,
 				   diffie_hellman_keys = {_, ServerDhPrivateKey},
-				   ssl_options = #ssl_options{user_lookup_fun = PSKLookup}} = State0,
+				   ssl_options = 
+				       #ssl_options{user_lookup_fun = PSKLookup}} = State0,
 			    Connection) ->
-    PremasterSecret = ssl_handshake:premaster_secret(ClientKey, ServerDhPrivateKey, Params, PSKLookup),
+    PremasterSecret = 
+	ssl_handshake:premaster_secret(ClientKey, ServerDhPrivateKey, Params, PSKLookup),
     calculate_master_secret(PremasterSecret, State0, Connection, certify, cipher);
 certify_client_key_exchange(#client_rsa_psk_identity{} = ClientKey,
 			    #state{private_key = Key,
-				   ssl_options = #ssl_options{user_lookup_fun = PSKLookup}} = State0,
+				   ssl_options = 
+				       #ssl_options{user_lookup_fun = PSKLookup}} = State0,
 			    Connection) ->
     PremasterSecret = ssl_handshake:premaster_secret(ClientKey, Key, PSKLookup),
     calculate_master_secret(PremasterSecret, State0, Connection, certify, cipher);
@@ -1198,8 +1277,11 @@ certify_client_key_exchange(#client_srp_public{} = ClientKey,
     PremasterSecret = ssl_handshake:premaster_secret(ClientKey, Key, Params),
     calculate_master_secret(PremasterSecret, State0, Connection, certify, cipher).
 
-certify_server(#state{key_algorithm = Algo} = State, _)
-  when Algo == dh_anon; Algo == ecdh_anon; Algo == psk; Algo == dhe_psk; Algo == srp_anon  ->
+certify_server(#state{key_algorithm = Algo} = State, _) when Algo == dh_anon; 
+							     Algo == ecdh_anon; 
+							     Algo == psk; 
+							     Algo == dhe_psk; 
+							     Algo == srp_anon  ->
     State;
 
 certify_server(#state{cert_db = CertDbHandle,
@@ -1297,10 +1379,11 @@ key_exchange(#state{role = server, key_algorithm = dhe_psk,
     SecParams = ConnectionState#connection_state.security_parameters,
     #security_parameters{client_random = ClientRandom,
 			 server_random = ServerRandom} = SecParams,
-    Msg =  ssl_handshake:key_exchange(server, Version, {dhe_psk, PskIdentityHint, DHKeys, Params,
-					       HashSignAlgo, ClientRandom,
-					       ServerRandom,
-					       PrivateKey}),
+    Msg =  ssl_handshake:key_exchange(server, Version, {dhe_psk, 
+							PskIdentityHint, DHKeys, Params,
+							HashSignAlgo, ClientRandom,
+							ServerRandom,
+							PrivateKey}),
     State = Connection:send_handshake(Msg, State0),
     State#state{diffie_hellman_keys = DHKeys};
 
@@ -1389,7 +1472,8 @@ key_exchange(#state{role = client,
 		    ssl_options = SslOpts,
 		    key_algorithm = psk,
 		    negotiated_version = Version} = State0, Connection) ->
-    Msg =  ssl_handshake:key_exchange(client, Version, {psk, SslOpts#ssl_options.psk_identity}),
+    Msg =  ssl_handshake:key_exchange(client, Version, 
+				      {psk, SslOpts#ssl_options.psk_identity}),
     Connection:send_handshake(Msg, State0);
 
 key_exchange(#state{role = client,
@@ -1398,7 +1482,8 @@ key_exchange(#state{role = client,
 		    negotiated_version = Version,
 		    diffie_hellman_keys = {DhPubKey, _}} = State0, Connection) ->
     Msg =  ssl_handshake:key_exchange(client, Version,
-				      {dhe_psk, SslOpts#ssl_options.psk_identity, DhPubKey}),
+				      {dhe_psk, 
+				       SslOpts#ssl_options.psk_identity, DhPubKey}),
     Connection:send_handshake(Msg, State0);
 key_exchange(#state{role = client,
 		    ssl_options = SslOpts,
@@ -1438,7 +1523,8 @@ rsa_key_exchange(Version, PremasterSecret, PublicKeyInfo = {Algorithm, _, _})
 rsa_key_exchange(_, _, _) ->
     throw (?ALERT_REC(?FATAL,?HANDSHAKE_FAILURE)).
 
-rsa_psk_key_exchange(Version, PskIdentity, PremasterSecret, PublicKeyInfo = {Algorithm, _, _})
+rsa_psk_key_exchange(Version, PskIdentity, PremasterSecret, 
+		     PublicKeyInfo = {Algorithm, _, _})
   when Algorithm == ?rsaEncryption;
        Algorithm == ?md2WithRSAEncryption;
        Algorithm == ?md5WithRSAEncryption;
@@ -1473,10 +1559,11 @@ request_client_cert(#state{ssl_options = #ssl_options{verify = verify_none}} =
 		    State, _) ->
     State.
 
-calculate_master_secret(PremasterSecret, #state{negotiated_version = Version,
-						       connection_states = ConnectionStates0,
-						       session = Session0} = State0, Connection,
-			Current, Next) ->
+calculate_master_secret(PremasterSecret, 
+			#state{negotiated_version = Version,
+			       connection_states = ConnectionStates0,
+			       session = Session0} = State0, Connection,
+			_Current, Next) ->
     case ssl_handshake:master_secret(record_cb(Connection), Version, PremasterSecret,
 				     ConnectionStates0, server) of
 	{MasterSecret, ConnectionStates} ->
@@ -1484,7 +1571,7 @@ calculate_master_secret(PremasterSecret, #state{negotiated_version = Version,
 	    State1 = State0#state{connection_states = ConnectionStates,
 				  session = Session},
 	    {Record, State} = Connection:next_record(State1),
-	    Connection:next_state(Current, Next, Record, State);
+	    Connection:next_event(Next, Record, State);
 	#alert{} = Alert ->
 	    Connection:handle_own_alert(Alert, Version, certify, State0)
     end.
@@ -1535,31 +1622,36 @@ save_verify_data(client, #finished{verify_data = Data}, ConnectionStates, abbrev
 save_verify_data(server, #finished{verify_data = Data}, ConnectionStates, abbreviated) ->
     ssl_record:set_server_verify_data(current_write, Data, ConnectionStates).
 
-calculate_secret(#server_dh_params{dh_p = Prime, dh_g = Base, dh_y = ServerPublicDhKey} = Params,
-		     State, Connection) ->
+calculate_secret(#server_dh_params{dh_p = Prime, dh_g = Base, 
+				   dh_y = ServerPublicDhKey} = Params,
+		 State, Connection) ->
     Keys = {_, PrivateDhKey} = crypto:generate_key(dh, [Prime, Base]),
     PremasterSecret =
 	ssl_handshake:premaster_secret(ServerPublicDhKey, PrivateDhKey, Params),
     calculate_master_secret(PremasterSecret,
-			    State#state{diffie_hellman_keys = Keys}, Connection, certify, certify);
+			    State#state{diffie_hellman_keys = Keys}, 
+			    Connection, certify, certify);
 
 calculate_secret(#server_ecdh_params{curve = ECCurve, public = ECServerPubKey},
 		     State, Connection) ->
     ECDHKeys = public_key:generate_key(ECCurve),
-    PremasterSecret = ssl_handshake:premaster_secret(#'ECPoint'{point = ECServerPubKey}, ECDHKeys),
+    PremasterSecret = 
+	ssl_handshake:premaster_secret(#'ECPoint'{point = ECServerPubKey}, ECDHKeys),
     calculate_master_secret(PremasterSecret,
-			    State#state{diffie_hellman_keys = ECDHKeys}, Connection, certify, certify);
+			    State#state{diffie_hellman_keys = ECDHKeys}, 
+			    Connection, certify, certify);
 
 calculate_secret(#server_psk_params{
-			hint = IdentityHint},
+		    hint = IdentityHint},
 		 State0, Connection) ->
     %% store for later use
     {Record, State} = Connection:next_record(State0#state{psk_identity = IdentityHint}),
-    Connection:next_state(certify, certify, Record, State);
+    Connection:next_event(certify, Record, State);
 
 calculate_secret(#server_dhe_psk_params{
 		    dh_params = #server_dh_params{dh_p = Prime, dh_g = Base}} = ServerKey,
-		    #state{ssl_options = #ssl_options{user_lookup_fun = PSKLookup}} = State, Connection) ->
+		    #state{ssl_options = #ssl_options{user_lookup_fun = PSKLookup}} = 
+		     State, Connection) ->
     Keys = {_, PrivateDhKey} =
 	crypto:generate_key(dh, [Prime, Base]),
     PremasterSecret = ssl_handshake:premaster_secret(ServerKey, PrivateDhKey, PSKLookup),
@@ -1567,10 +1659,12 @@ calculate_secret(#server_dhe_psk_params{
 			    Connection, certify, certify);
 
 calculate_secret(#server_srp_params{srp_n = Prime, srp_g = Generator} = ServerKey,
-		 #state{ssl_options = #ssl_options{srp_identity = SRPId}} = State, Connection) ->
+		 #state{ssl_options = #ssl_options{srp_identity = SRPId}} = State, 
+		 Connection) ->
     Keys = generate_srp_client_keys(Generator, Prime, 0),
     PremasterSecret = ssl_handshake:premaster_secret(ServerKey, Keys, SRPId),
-    calculate_master_secret(PremasterSecret, State#state{srp_keys = Keys}, Connection, certify, certify).
+    calculate_master_secret(PremasterSecret, State#state{srp_keys = Keys}, Connection, 
+			    certify, certify).
 
 master_secret(#alert{} = Alert, _) ->
     Alert;
@@ -1626,21 +1720,23 @@ handle_srp_identity(Username, {Fun, UserState}) ->
     end.
 
 
-cipher_role(client, Data, Session, #state{connection_states = ConnectionStates0} = State,
+cipher_role(client, Data, Session, #state{connection_states = ConnectionStates0} = State0,
 	    Connection) ->
-    ConnectionStates = ssl_record:set_server_verify_data(current_both, Data, ConnectionStates0),
-    Connection:next_state_connection(cipher,
-				     ack_connection(
-				       State#state{session = Session,
-						   connection_states = ConnectionStates}));
-
+    ConnectionStates = ssl_record:set_server_verify_data(current_both, Data, 
+							 ConnectionStates0),
+     {Record, State} = prepare_connection(State0#state{session = Session,
+						       connection_states = ConnectionStates},
+					 Connection),
+    Connection:next_event(connection, Record, State);
 cipher_role(server, Data, Session,  #state{connection_states = ConnectionStates0} = State0,
 	    Connection) ->
-    ConnectionStates1 = ssl_record:set_client_verify_data(current_read, Data, ConnectionStates0),
-    State =
+    ConnectionStates1 = ssl_record:set_client_verify_data(current_read, Data, 
+							  ConnectionStates0),
+    State1 =
 	finalize_handshake(State0#state{connection_states = ConnectionStates1,
 					session = Session}, cipher, Connection),
-    Connection:next_state_connection(cipher, ack_connection(State#state{session = Session})).
+    {Record, State} = prepare_connection(State1, Connection),
+    Connection:next_event(connection, Record, State).
 
 select_curve(#state{client_ecc = {[Curve|_], _}}) ->
     {namedCurve, Curve};
@@ -1674,8 +1770,8 @@ record_cb(tls_connection) ->
 record_cb(dtls_connection) ->
     dtls_record.
 
-sync_send_all_state_event(FsmPid, Event) ->
-    try gen_fsm:sync_send_all_state_event(FsmPid, Event, infinity)
+call(FsmPid, Event) ->
+    try gen_statem:call(FsmPid, Event)
     catch
  	exit:{noproc, _} ->
  	    {error, closed};
@@ -1731,38 +1827,42 @@ set_socket_opts(Transport, Socket, [], SockOpts, Other) ->
 	    {{error, {options, {socket_options, Other, Error}}}, SockOpts}
     end;
 
-set_socket_opts(Transport,Socket, [{mode, Mode}| Opts], SockOpts, Other) when Mode == list; Mode == binary ->
+set_socket_opts(Transport,Socket, [{mode, Mode}| Opts], SockOpts, Other) 
+  when Mode == list; Mode == binary ->
     set_socket_opts(Transport, Socket, Opts, 
 		    SockOpts#socket_options{mode = Mode}, Other);
 set_socket_opts(_, _, [{mode, _} = Opt| _], SockOpts, _) ->
     {{error, {options, {socket_options, Opt}}}, SockOpts};
-set_socket_opts(Transport,Socket, [{packet, Packet}| Opts], SockOpts, Other) when Packet == raw;
-									Packet == 0;
-									Packet == 1;
-									Packet == 2;
-									Packet == 4;
-									Packet == asn1;
-									Packet == cdr;
-									Packet == sunrm;
-									Packet == fcgi;
-									Packet == tpkt;
-									Packet == line;
-									Packet == http;
-									Packet == httph;
-									Packet == http_bin;
-									Packet == httph_bin ->
+set_socket_opts(Transport,Socket, [{packet, Packet}| Opts], SockOpts, Other) 
+  when Packet == raw;
+       Packet == 0;
+       Packet == 1;
+       Packet == 2;
+       Packet == 4;
+       Packet == asn1;
+       Packet == cdr;
+       Packet == sunrm;
+       Packet == fcgi;
+       Packet == tpkt;
+       Packet == line;
+       Packet == http;
+       Packet == httph;
+       Packet == http_bin;
+       Packet == httph_bin ->
     set_socket_opts(Transport, Socket, Opts, 
 		    SockOpts#socket_options{packet = Packet}, Other);
 set_socket_opts(_, _, [{packet, _} = Opt| _], SockOpts, _) ->
     {{error, {options, {socket_options, Opt}}}, SockOpts};
-set_socket_opts(Transport, Socket, [{header, Header}| Opts], SockOpts, Other) when is_integer(Header) ->
+set_socket_opts(Transport, Socket, [{header, Header}| Opts], SockOpts, Other) 
+  when is_integer(Header) ->
     set_socket_opts(Transport, Socket, Opts, 
 		    SockOpts#socket_options{header = Header}, Other);
 set_socket_opts(_, _, [{header, _} = Opt| _], SockOpts, _) ->
     {{error,{options, {socket_options, Opt}}}, SockOpts};
-set_socket_opts(Transport, Socket, [{active, Active}| Opts], SockOpts, Other) when Active == once;
-										   Active == true;
-										   Active == false ->
+set_socket_opts(Transport, Socket, [{active, Active}| Opts], SockOpts, Other) 
+  when Active == once;
+       Active == true;
+       Active == false ->
     set_socket_opts(Transport, Socket, Opts, 
 		    SockOpts#socket_options{active = Active}, Other);
 set_socket_opts(_, _, [{active, _} = Opt| _], SockOpts, _) ->
@@ -1775,11 +1875,10 @@ start_or_recv_cancel_timer(infinity, _RecvFrom) ->
 start_or_recv_cancel_timer(Timeout, RecvFrom) ->
     erlang:send_after(Timeout, self(), {cancel_start_or_recv, RecvFrom}).
 
-get_timeout(#state{ssl_options=#ssl_options{hibernate_after = undefined}}) ->
-    infinity;
-get_timeout(#state{ssl_options=#ssl_options{hibernate_after = HibernateAfter}}) ->
-    HibernateAfter.
-
+hibernate_after(StateName, #state{ssl_options=#ssl_options{hibernate_after = HibernateAfter}} = State,
+		Actions) ->
+    {next_state, StateName, State, [{timeout, HibernateAfter, hibernate} | Actions]}.
+ 
 terminate_alert(normal, Version, ConnectionStates)  ->
     ssl_alert:encode(?ALERT_REC(?WARNING, ?CLOSE_NOTIFY),
 		     Version, ConnectionStates);
@@ -1789,10 +1888,12 @@ terminate_alert({Reason, _}, Version, ConnectionStates) when Reason == close;
 		     Version, ConnectionStates);
 
 terminate_alert(_, Version, ConnectionStates) ->
-    ssl_alert:encode(?ALERT_REC(?FATAL, ?INTERNAL_ERROR),
-		     Version, ConnectionStates).
+    {BinAlert, _} = ssl_alert:encode(?ALERT_REC(?FATAL, ?INTERNAL_ERROR),
+				 Version, ConnectionStates),
+    BinAlert.
 
-handle_trusted_certs_db(#state{ssl_options = #ssl_options{cacertfile = <<>>, cacerts = []}}) ->
+handle_trusted_certs_db(#state{ssl_options = 
+				   #ssl_options{cacertfile = <<>>, cacerts = []}}) ->
     %% No trusted certs specified
     ok;
 handle_trusted_certs_db(#state{cert_db_ref = Ref,
@@ -1802,7 +1903,8 @@ handle_trusted_certs_db(#state{cert_db_ref = Ref,
     %% with other connections and it is safe to delete them when the connection ends.
     ssl_pkix_db:remove_trusted_certs(Ref, CertDb);
 handle_trusted_certs_db(#state{file_ref_db = undefined}) ->
-    %% Something went wrong early (typically cacertfile does not exist) so there is nothing to handle
+    %% Something went wrong early (typically cacertfile does not
+    %% exist) so there is nothing to handle
     ok;
 handle_trusted_certs_db(#state{cert_db_ref = Ref,
 			       file_ref_db = RefDb,
@@ -1814,29 +1916,29 @@ handle_trusted_certs_db(#state{cert_db_ref = Ref,
 	    ok
     end.
 
-notify_senders(SendQueue) -> 
-    lists:foreach(fun({From, _}) ->
- 			  gen_fsm:reply(From, {error, closed})
- 		  end, queue:to_list(SendQueue)).
-
-notify_renegotiater({true, From}) when not is_atom(From)  ->
-    gen_fsm:reply(From, {error, closed});
-notify_renegotiater(_) ->
-    ok.
+prepare_connection(#state{renegotiation = Renegotiate, 
+			  start_or_recv_from = RecvFrom} = State0, Connection) 
+  when Renegotiate =/= {false, first}, 
+       RecvFrom =/= undefined ->
+    {Record, State} = Connection:next_record(State0),
+    {Record, ack_connection(State)};
+prepare_connection(State, _) ->
+    {no_record, ack_connection(State)}.
 
 ack_connection(#state{renegotiation = {true, Initiater}} = State) 
   when Initiater == internal;
        Initiater == peer ->
     State#state{renegotiation = undefined};
 ack_connection(#state{renegotiation = {true, From}} = State) ->    
-    gen_fsm:reply(From, ok),
+    gen_statem:reply(From, ok),
     State#state{renegotiation = undefined};
 ack_connection(#state{renegotiation = {false, first}, 
 		      start_or_recv_from = StartFrom,
 		      timer = Timer} = State) when StartFrom =/= undefined ->
-    gen_fsm:reply(StartFrom, connected),
+    gen_statem:reply(StartFrom, connected),
     cancel_timer(Timer),
-    State#state{renegotiation = undefined, start_or_recv_from = undefined, timer = undefined};
+    State#state{renegotiation = undefined, 
+		start_or_recv_from = undefined, timer = undefined};
 ack_connection(State) ->
     State.
 
@@ -1857,13 +1959,14 @@ register_session(server, _, Port, #session{is_resumable = new} = Session0) ->
 register_session(_, _, _, Session) ->
     Session. %% Already registered
 
-handle_new_session(NewId, CipherSuite, Compression, #state{session = Session0,
-							   protocol_cb = Connection} = State0) ->
+handle_new_session(NewId, CipherSuite, Compression, 
+		   #state{session = Session0,
+			  protocol_cb = Connection} = State0) ->
     Session = Session0#session{session_id = NewId,
 			       cipher_suite = CipherSuite,
 			       compression_method = Compression},
     {Record, State} = Connection:next_record(State0#state{session = Session}),
-    Connection:next_state(hello, certify, Record, State).
+    Connection:next_event(certify, Record, State).
 
 handle_resumed_session(SessId, #state{connection_states = ConnectionStates0,
 				      negotiated_version = Version,
@@ -1879,7 +1982,7 @@ handle_resumed_session(SessId, #state{connection_states = ConnectionStates0,
 		Connection:next_record(State0#state{
 			      connection_states = ConnectionStates,
 			      session = Session}),
-	    Connection:next_state(hello, abbreviated, Record, State);
+	    Connection:next_event(abbreviated, Record, State);
 	#alert{} = Alert ->
 	    Connection:handle_own_alert(Alert, Version, hello, State0)
     end.
diff --git a/lib/ssl/src/ssl_connection.hrl b/lib/ssl/src/ssl_connection.hrl
index bb41ef2b62..7682cb86ea 100644
--- a/lib/ssl/src/ssl_connection.hrl
+++ b/lib/ssl/src/ssl_connection.hrl
@@ -75,7 +75,7 @@
 	  renegotiation        :: undefined | {boolean(), From::term() | internal | peer},
 	  start_or_recv_from   :: term(),
 	  timer                :: undefined | reference(), % start_or_recive_timer
-	  send_queue           :: queue:queue(),
+	  %%send_queue           :: queue:queue(),
 	  terminated = false                          ::boolean(),
 	  allow_renegotiate = true                    ::boolean(),
           expecting_next_protocol_negotiation = false ::boolean(),
@@ -83,7 +83,8 @@
           negotiated_protocol = undefined             :: undefined | binary(),
 	  client_ecc,          % {Curves, PointFmt}
 	  tracker              :: pid() | 'undefined', %% Tracker process for listen socket
-	  sni_hostname = undefined
+	  sni_hostname = undefined,
+	  downgrade
 	 }).
 
 -define(DEFAULT_DIFFIE_HELLMAN_PARAMS,
diff --git a/lib/ssl/src/ssl_internal.hrl b/lib/ssl/src/ssl_internal.hrl
index 9c52f5a315..076e663cd4 100644
--- a/lib/ssl/src/ssl_internal.hrl
+++ b/lib/ssl/src/ssl_internal.hrl
@@ -118,7 +118,7 @@
 	  %% undefined if not hibernating, or number of ms of
 	  %% inactivity after which ssl_connection will go into
 	  %% hibernation
-	  hibernate_after      :: boolean() | 'undefined',
+	  hibernate_after      :: timeout(),
 	  %% This option should only be set to true by inet_tls_dist
 	  erl_dist = false     :: boolean(),
           alpn_advertised_protocols = undefined :: [binary()] | undefined ,
diff --git a/lib/ssl/src/tls_connection.erl b/lib/ssl/src/tls_connection.erl
index a1d13d1850..2193fc18c2 100644
--- a/lib/ssl/src/tls_connection.erl
+++ b/lib/ssl/src/tls_connection.erl
@@ -28,7 +28,7 @@
 
 -module(tls_connection).
 
--behaviour(gen_fsm).
+-behaviour(gen_statem).
 
 -include("tls_connection.hrl").
 -include("tls_handshake.hrl").
@@ -43,31 +43,32 @@
 %% Internal application API
 
 %% Setup
--export([start_fsm/8]).
+-export([start_fsm/8, start_link/7, init/1]).
 
 %% State transition handling	 
--export([next_record/1, next_state/4, next_state_connection/2]).
+-export([next_record/1, next_event/3]).
 
 %% Handshake handling
--export([renegotiate/1, send_handshake/2, send_change_cipher/2]).
+-export([renegotiate/2, send_handshake/2, send_change_cipher/2]).
 
 %% Alert and close handling
 -export([send_alert/2, handle_own_alert/4, handle_close_alert/3,
-	 handle_normal_shutdown/3, handle_unexpected_message/3,
+	 handle_normal_shutdown/3, 
 	 close/5, alert_user/6, alert_user/9
 	]).
 
 %% Data handling
 -export([write_application_data/3, read_application_data/2,
-	 passive_receive/2,  next_record_if_active/1]).
+	 passive_receive/2,  next_record_if_active/1, handle_common_event/4]).
 
-%% Called by tls_connection_sup
--export([start_link/7]). 
-
-%% gen_fsm callbacks
--export([init/1, hello/2, certify/2, cipher/2,
-	 abbreviated/2, connection/2, handle_event/3,
-         handle_sync_event/4, handle_info/3, terminate/3, code_change/4, format_status/2]).
+%% gen_statem state functions
+-export([init/3, error/3, downgrade/3, %% Initiation and take down states
+	 hello/3, certify/3, cipher/3, abbreviated/3, %% Handshake states 
+	 connection/3]). 
+%% gen_statem callbacks
+-export([terminate/3, code_change/4, format_status/2]).
+ 
+-define(GEN_STATEM_CB_MODE, state_functions).
 
 %%====================================================================
 %% Internal application API
@@ -147,23 +148,34 @@ start_link(Role, Host, Port, Socket, Options, User, CbInfo) ->
 
 init([Role, Host, Port, Socket, Options,  User, CbInfo]) ->
     process_flag(trap_exit, true),
-    State = initial_state(Role, Host, Port, Socket, Options, User, CbInfo),
-    gen_fsm:enter_loop(?MODULE, [], hello, State, get_timeout(State)).
+    State0 = initial_state(Role, Host, Port, Socket, Options, User, CbInfo),
+    try 
+	State = ssl_connection:ssl_config(State0#state.ssl_options, Role, State0),
+	gen_statem:enter_loop(?MODULE, [], ?GEN_STATEM_CB_MODE, init, State)
+    catch throw:Error ->
+	gen_statem:enter_loop(?MODULE, [], ?GEN_STATEM_CB_MODE, error, {Error, State0}) 
+    end.
 
 %%--------------------------------------------------------------------
-%% Description:There should be one instance of this function for each
-%% possible state name. Whenever a gen_fsm receives an event sent
-%% using gen_fsm:send_event/2, the instance of this function with the
-%% same name as the current state name StateName is called to handle
-%% the event. It is also called if a timeout occurs.
-%%
-hello(start, #state{host = Host, port = Port, role = client,
-		    ssl_options = SslOpts,
-		    session = #session{own_certificate = Cert} = Session0,
-		    session_cache = Cache, session_cache_cb = CacheCb,
-		    transport_cb = Transport, socket = Socket,
-		    connection_states = ConnectionStates0,
-		    renegotiation = {Renegotiation, _}} = State0) ->
+%% State functions
+%%--------------------------------------------------------------------
+%%--------------------------------------------------------------------
+-spec init(gen_statem:event_type(),
+	   {start, timeout()} | term(), #state{}) ->
+		   gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+
+init({call, From}, {start, Timeout}, 
+     #state{host = Host, port = Port, role = client,
+	    ssl_options = SslOpts,
+	    session = #session{own_certificate = Cert} = Session0,
+	    transport_cb = Transport, socket = Socket,
+	    connection_states = ConnectionStates0,
+	    renegotiation = {Renegotiation, _},
+	    session_cache = Cache,
+	    session_cache_cb = CacheCb
+	   } = State0) ->
+    Timer = ssl_connection:start_or_recv_cancel_timer(Timeout, From),
     Hello = tls_handshake:client_hello(Host, Port, ConnectionStates0, SslOpts,
 				       Cache, CacheCb, Renegotiation, Cert),
     
@@ -177,13 +189,36 @@ hello(start, #state{host = Host, port = Port, role = client,
 			  negotiated_version = Version, %% Requested version
 			  session =
 			      Session0#session{session_id = Hello#client_hello.session_id},
-			  tls_handshake_history = Handshake},
+			  tls_handshake_history = Handshake,
+			  start_or_recv_from = From,
+			  timer = Timer},
     {Record, State} = next_record(State1),
-    next_state(hello, hello, Record, State);
+    next_event(hello, Record, State);
+init(Type, Event, State) ->
+    ssl_connection:init(Type, Event, State, ?MODULE).
+ 
+%%--------------------------------------------------------------------
+-spec error(gen_statem:event_type(),
+	   {start, timeout()} | term(), #state{}) ->
+		   gen_statem:state_function_result().
+%%--------------------------------------------------------------------
 
-hello(Hello = #client_hello{client_version = ClientVersion,
-			    extensions = #hello_extensions{ec_point_formats = EcPointFormats,
-							   elliptic_curves = EllipticCurves}},
+error({call, From}, {start, _Timeout}, {Error, State}) ->
+    {stop_and_reply, normal, {reply, From, {error, Error}}, State};
+error({call, From}, Msg, State) ->
+    handle_call(Msg, From, error, State);
+error(_, _, _) ->
+     {keep_state_and_data, [postpone]}.
+ 
+%%--------------------------------------------------------------------
+-spec hello(gen_statem:event_type(),
+	    #hello_request{} | #client_hello{} | #server_hello{} | term(),
+	    #state{}) ->
+		   gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+hello(internal, #client_hello{client_version = ClientVersion,
+			      extensions = #hello_extensions{ec_point_formats = EcPointFormats,
+							     elliptic_curves = EllipticCurves}} = Hello,
       State = #state{connection_states = ConnectionStates0,
 		     port = Port, session = #session{own_certificate = Cert} = Session0,
 		     renegotiation = {Renegotiation, _},
@@ -203,7 +238,8 @@ hello(Hello = #client_hello{client_version = ClientVersion,
 			   undefined -> CurrentProtocol;
 			   _ -> Protocol0
 		       end,
-	    ssl_connection:hello({common_client_hello, Type, ServerHelloExt},
+	    
+	    ssl_connection:hello(internal, {common_client_hello, Type, ServerHelloExt},
 				 State#state{connection_states  = ConnectionStates,
 					     negotiated_version = Version,
 					     hashsign_algorithm = HashSign,
@@ -211,8 +247,7 @@ hello(Hello = #client_hello{client_version = ClientVersion,
 					     client_ecc = {EllipticCurves, EcPointFormats},
 					     negotiated_protocol = Protocol}, ?MODULE)
     end;
-
-hello(Hello = #server_hello{},
+hello(internal, #server_hello{} = Hello,
       #state{connection_states = ConnectionStates0,
 	     negotiated_version = ReqVersion,
 	     role = client,
@@ -225,25 +260,52 @@ hello(Hello = #server_hello{},
 	    ssl_connection:handle_session(Hello, 
 					  Version, NewId, ConnectionStates, ProtoExt, Protocol, State)
     end;
+hello(info, Event, State) ->
+    handle_info(Event, hello, State);
+hello(Type, Event, State) ->
+    ssl_connection:hello(Type, Event, State, ?MODULE).
 
-hello(Msg, State) ->
-    ssl_connection:hello(Msg, State, ?MODULE).
-
-abbreviated(Msg, State) ->
-    ssl_connection:abbreviated(Msg, State, ?MODULE).
+%%--------------------------------------------------------------------
+-spec abbreviated(gen_statem:event_type(), term(), #state{}) ->
+			 gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+abbreviated(info, Event, State) ->
+    handle_info(Event, abbreviated, State);
+abbreviated(Type, Event, State) ->
+    ssl_connection:abbreviated(Type, Event, State, ?MODULE).
 
-certify(Msg, State) ->
-    ssl_connection:certify(Msg, State, ?MODULE).
+%%--------------------------------------------------------------------
+-spec certify(gen_statem:event_type(), term(), #state{}) ->
+		     gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+certify(info, Event, State) ->
+    handle_info(Event, certify, State);
+certify(Type, Event, State) ->
+    ssl_connection:certify(Type, Event, State, ?MODULE).
 
-cipher(Msg, State) ->
-     ssl_connection:cipher(Msg, State, ?MODULE).
+%%--------------------------------------------------------------------
+-spec cipher(gen_statem:event_type(), term(), #state{}) ->
+		    gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+cipher(info, Event, State) ->
+    handle_info(Event, cipher, State);
+cipher(Type, Event, State) ->
+     ssl_connection:cipher(Type, Event, State, ?MODULE).
 
-connection(#hello_request{}, #state{host = Host, port = Port,
-				    session = #session{own_certificate = Cert} = Session0,
-				    session_cache = Cache, session_cache_cb = CacheCb,
-				    ssl_options = SslOpts,
-				    connection_states = ConnectionStates0,
-				    renegotiation = {Renegotiation, _}} = State0) ->
+%%--------------------------------------------------------------------
+-spec connection(gen_statem:event_type(),  
+		 #hello_request{} | #client_hello{}| term(), #state{}) ->
+			gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+connection(info, Event, State) ->
+    handle_info(Event, connection, State);
+connection(internal, #hello_request{},
+	   #state{host = Host, port = Port,
+		  session = #session{own_certificate = Cert} = Session0,
+		  session_cache = Cache, session_cache_cb = CacheCb,
+		  ssl_options = SslOpts,
+		  connection_states = ConnectionStates0,
+		  renegotiation = {Renegotiation, _}} = State0) ->
     Hello = tls_handshake:client_hello(Host, Port, ConnectionStates0, SslOpts,
 				       Cache, CacheCb, Renegotiation, Cert),
     State1 = send_handshake(Hello, State0),
@@ -251,58 +313,49 @@ connection(#hello_request{}, #state{host = Host, port = Port,
 	next_record(
 	  State1#state{session = Session0#session{session_id
 						  = Hello#client_hello.session_id}}),
-    next_state(connection, hello, Record, State);
-
-connection(#client_hello{} = Hello, #state{role = server, allow_renegotiate = true} = State) ->
+    next_event(hello, Record, State);
+connection(internal, #client_hello{} = Hello, 
+	   #state{role = server, allow_renegotiate = true} = State) ->
     %% Mitigate Computational DoS attack
     %% http://www.educatedguesswork.org/2011/10/ssltls_and_computational_dos.html
     %% http://www.thc.org/thc-ssl-dos/ Rather than disabling client
     %% initiated renegotiation we will disallow many client initiated
     %% renegotiations immediately after each other.
     erlang:send_after(?WAIT_TO_ALLOW_RENEGOTIATION, self(), allow_renegotiate),
-    hello(Hello, State#state{allow_renegotiate = false});
-
-connection(#client_hello{}, #state{role = server, allow_renegotiate = false} = State0) ->
+    {next_state, hello, State#state{allow_renegotiate = false}, [{next_event, internal, Hello}]};
+connection(internal, #client_hello{}, 
+	   #state{role = server, allow_renegotiate = false} = State0) ->
     Alert = ?ALERT_REC(?WARNING, ?NO_RENEGOTIATION),
-    State = send_alert(Alert, State0),
-    next_state_connection(connection, State);
-  
-connection(Msg, State) ->
-     ssl_connection:connection(Msg, State, tls_connection).
+    State1 = send_alert(Alert, State0),
+    {Record, State} = ssl_connection:prepare_connection(State1, ?MODULE),
+    next_event(connection, Record, State);
+connection(Type, Event, State) ->
+    ssl_connection:connection(Type, Event, State, ?MODULE).
 
 %%--------------------------------------------------------------------
-%% Description: Whenever a gen_fsm receives an event sent using
-%% gen_fsm:send_all_state_event/2, this function is called to handle
-%% the event. Not currently used!
+-spec downgrade(gen_statem:event_type(), term(), #state{}) ->
+		       gen_statem:state_function_result().
 %%--------------------------------------------------------------------
-handle_event(_Event, StateName, State) ->
-    {next_state, StateName, State, get_timeout(State)}.
+downgrade(Type, Event, State) ->
+     ssl_connection:downgrade(Type, Event, State, ?MODULE).
 
 %%--------------------------------------------------------------------
-%% Description: Whenever a gen_fsm receives an event sent using
-%% gen_fsm:sync_send_all_state_event/2,3, this function is called to handle
-%% the event.
+%% Event handling functions called by state functions to handle
+%% common or unexpected events for the state.
 %%--------------------------------------------------------------------
-handle_sync_event(Event, From, StateName, State) ->
-    ssl_connection:handle_sync_event(Event, From, StateName, State).
-
-%%--------------------------------------------------------------------
-%% Description: This function is called by a gen_fsm when it receives any
-%% other message than a synchronous or asynchronous event
-%% (or a system message).
-%%--------------------------------------------------------------------
-
+handle_call(Event, From, StateName, State) ->
+    ssl_connection:handle_call(Event, From, StateName, State, ?MODULE).
+ 
 %% raw data from socket, unpack records
 handle_info({Protocol, _, Data}, StateName,
             #state{data_tag = Protocol} = State0) ->
     case next_tls_record(Data, State0) of
 	{Record, State} ->
-	    next_state(StateName, StateName, Record, State);
+	    next_event(StateName, Record, State);
 	#alert{} = Alert ->
 	    handle_normal_shutdown(Alert, StateName, State0), 
-	    {stop, {shutdown, own_alert}, State0}
+	    {stop, {shutdown, own_alert}}
     end;
-
 handle_info({CloseTag, Socket}, StateName,
             #state{socket = Socket, close_tag = CloseTag,
 		   negotiated_version = Version} = State) ->
@@ -321,32 +374,98 @@ handle_info({CloseTag, Socket}, StateName,
 	    ok
     end,
     handle_normal_shutdown(?ALERT_REC(?FATAL, ?CLOSE_NOTIFY), StateName, State),
-    {stop, {shutdown, transport_closed}, State};
-
+    {stop, {shutdown, transport_closed}};
 handle_info(Msg, StateName, State) ->
     ssl_connection:handle_info(Msg, StateName, State).
 
+handle_common_event(internal, #alert{} = Alert, StateName, 
+		    #state{negotiated_version = Version} = State) ->
+    handle_own_alert(Alert, Version, StateName, State);
+
+%%% TLS record protocol level handshake messages 
+handle_common_event(internal,  #ssl_tls{type = ?HANDSHAKE, fragment = Data}, 
+		    StateName, #state{protocol_buffers =
+					  #protocol_buffers{tls_handshake_buffer = Buf0} = Buffers,
+				      negotiated_version = Version} = State0) ->
+    
+    Handle = 
+   	fun({#hello_request{} = Packet, _}, {connection, HState}) ->
+   		%% This message should not be included in handshake
+   		%% message hashes. Starts new handshake (renegotiation)
+		Hs0 = ssl_handshake:init_handshake_history(),
+		{HState#state{tls_handshake_history = Hs0,
+			      renegotiation = {true, peer}}, 
+		 {next_event, internal, Packet}};
+   	   ({#hello_request{}, _}, {next_state, _SName, HState}) ->
+   		%% This message should not be included in handshake
+   		%% message hashes. Already in negotiation so it will be ignored!
+		{HState, []};
+	   ({#client_hello{} = Packet, Raw}, {connection, HState0}) ->
+		HState = handle_sni_extension(Packet, HState0),
+		Version = Packet#client_hello.client_version,
+		Hs0 = ssl_handshake:init_handshake_history(),
+		Hs1 = ssl_handshake:update_handshake_history(Hs0, Raw),
+		{HState#state{tls_handshake_history = Hs1,
+			      renegotiation = {true, peer}}, 
+		 {next_event, internal, Packet}};
+	   
+	   ({Packet, Raw}, {_SName, HState0 = #state{tls_handshake_history=Hs0}}) ->
+		HState = handle_sni_extension(Packet, HState0),
+		Hs1 = ssl_handshake:update_handshake_history(Hs0, Raw),
+		{HState#state{tls_handshake_history=Hs1}, {next_event, internal, Packet}}
+   	end,
+    try
+	{Packets, Buf} = tls_handshake:get_tls_handshake(Version,Data,Buf0),
+	State1 = State0#state{protocol_buffers =
+				  Buffers#protocol_buffers{tls_packets = Packets,
+							   tls_handshake_buffer = Buf}},
+	{State, Events} = tls_handshake_events(Handle, StateName, State1, []),
+	case StateName of
+	    connection ->
+		ssl_connection:hibernate_after(StateName, State, Events);
+	    _ ->
+		{next_state, StateName, State, Events}
+	end
+    catch throw:#alert{} = Alert ->
+	    handle_own_alert(Alert, Version, StateName, State0)
+    end;
+%%% TLS record protocol level application data messages 
+handle_common_event(internal, #ssl_tls{type = ?APPLICATION_DATA, fragment = Data}, StateName, State) ->
+    {next_state, StateName, State, [{next_event, internal, {application_data, Data}}]};
+%%% TLS record protocol level change cipher messages
+handle_common_event(internal, #ssl_tls{type = ?CHANGE_CIPHER_SPEC, fragment = Data}, StateName, State) ->
+    {next_state, StateName, State, [{next_event, internal, #change_cipher_spec{type = Data}}]};
+%%% TLS record protocol level Alert messages
+handle_common_event(internal, #ssl_tls{type = ?ALERT, fragment = EncAlerts}, StateName,
+		    #state{negotiated_version = Version} = State) ->
+    case decode_alerts(EncAlerts) of
+	Alerts = [_|_] ->
+	    handle_alerts(Alerts,  {next_state, StateName, State});
+	#alert{} = Alert ->
+	    handle_own_alert(Alert, Version, StateName, State)
+    end;
+%% Ignore unknown TLS record level protocol messages
+handle_common_event(internal, #ssl_tls{type = _Unknown}, StateName, State) ->
+    {next_state, StateName, State}.
+
 %%--------------------------------------------------------------------
-%% Description:This function is called by a gen_fsm when it is about
-%% to terminate. It should be the opposite of Module:init/1 and do any
-%% necessary cleaning up. When it returns, the gen_fsm terminates with
-%% Reason. The return value is ignored.
+%% gen_statem callbacks
 %%--------------------------------------------------------------------
 terminate(Reason, StateName, State) ->
     catch ssl_connection:terminate(Reason, StateName, State).
 
+format_status(Type, Data) ->
+    ssl_connection:format_status(Type, Data).
+
 %%--------------------------------------------------------------------
 %% code_change(OldVsn, StateName, State, Extra) -> {ok, StateName, NewState}
 %% Description: Convert process state when code is changed
 %%--------------------------------------------------------------------
 code_change(_OldVsn, StateName, State0, {Direction, From, To}) ->
     State = convert_state(State0, Direction, From, To),
-    {ok, StateName, State};
+    {?GEN_STATEM_CB_MODE, StateName, State};
 code_change(_OldVsn, StateName, State, _) ->
-    {ok, StateName, State}.
-
-format_status(Type, Data) ->
-    ssl_connection:format_status(Type, Data).
+    {?GEN_STATEM_CB_MODE, StateName, State}.
 
 %%--------------------------------------------------------------------
 %%% Internal functions
@@ -396,7 +515,6 @@ initial_state(Role, Host, Port, Socket, {SSLOptions, SocketOptions, Tracker}, Us
 	   renegotiation = {false, first},
 	   allow_renegotiate = SSLOptions#ssl_options.client_renegotiation,
 	   start_or_recv_from = undefined,
-	   send_queue = queue:new(),
 	   protocol_cb = ?MODULE,
 	   tracker = Tracker
 	  }.
@@ -418,80 +536,6 @@ update_ssl_options_from_sni(OrigSSLOptions, SNIHostname) ->
             ssl:handle_options(SSLOption, OrigSSLOptions)
     end.
 
-next_state(Current,_, #alert{} = Alert, #state{negotiated_version = Version} = State) ->
-    handle_own_alert(Alert, Version, Current, State);
-
-next_state(_,Next, no_record, State) ->
-    {next_state, Next, State, get_timeout(State)};
-
-next_state(Current, Next, #ssl_tls{type = ?ALERT, fragment = EncAlerts}, #state{negotiated_version = Version} = State) ->
-    case decode_alerts(EncAlerts) of
-	Alerts = [_|_] ->
-	    handle_alerts(Alerts,  {next_state, Next, State, get_timeout(State)});
-	#alert{} = Alert ->
-	    handle_own_alert(Alert, Version, Current, State)
-    end;
-next_state(Current, Next, #ssl_tls{type = ?HANDSHAKE, fragment = Data},
-	   State0 = #state{protocol_buffers =
-			       #protocol_buffers{tls_handshake_buffer = Buf0} = Buffers,
-			   negotiated_version = Version}) ->
-    Handle = 
-   	fun({#hello_request{} = Packet, _}, {next_state, connection = SName, State}) ->
-   		%% This message should not be included in handshake
-   		%% message hashes. Starts new handshake (renegotiation)
-		Hs0 = ssl_handshake:init_handshake_history(),
-		?MODULE:SName(Packet, State#state{tls_handshake_history=Hs0,
-   						  renegotiation = {true, peer}});
-   	   ({#hello_request{} = Packet, _}, {next_state, SName, State}) ->
-   		%% This message should not be included in handshake
-   		%% message hashes. Already in negotiation so it will be ignored!
-   		?MODULE:SName(Packet, State);
-	   ({#client_hello{} = Packet, Raw}, {next_state, connection = SName, HState0}) ->
-		HState = handle_sni_extension(Packet, HState0),
-		Version = Packet#client_hello.client_version,
-		Hs0 = ssl_handshake:init_handshake_history(),
-		Hs1 = ssl_handshake:update_handshake_history(Hs0, Raw),
-		?MODULE:SName(Packet, HState#state{tls_handshake_history=Hs1,
-						   renegotiation = {true, peer}});
-	   ({Packet, Raw}, {next_state, SName, HState0 = #state{tls_handshake_history=Hs0}}) ->
-		HState = handle_sni_extension(Packet, HState0),
-		Hs1 = ssl_handshake:update_handshake_history(Hs0, Raw),
-		?MODULE:SName(Packet, HState#state{tls_handshake_history=Hs1});
-   	   (_, StopState) -> StopState
-   	end,
-    try
-	{Packets, Buf} = tls_handshake:get_tls_handshake(Version,Data,Buf0),
-	State = State0#state{protocol_buffers =
-				 Buffers#protocol_buffers{tls_packets = Packets,
-							  tls_handshake_buffer = Buf}},
-	handle_tls_handshake(Handle, Next, State)
-    catch throw:#alert{} = Alert ->
-	    handle_own_alert(Alert, Version, Current, State0)
-    end;
-
-next_state(_, StateName, #ssl_tls{type = ?APPLICATION_DATA, fragment = Data}, State0) ->
-    case read_application_data(Data, State0) of
-	Stop = {stop,_,_} ->
-   	    Stop;
-	{Record, State} ->
-   	    next_state(StateName, StateName, Record, State)
-    end;
-next_state(Current, Next, #ssl_tls{type = ?CHANGE_CIPHER_SPEC, fragment = <<1>>} = 
-	       _ChangeCipher, 
- 	   #state{connection_states = ConnectionStates0} = State0) 
-  when Next == cipher; Next == abbreviated ->
-    ConnectionStates1 =
-	ssl_record:activate_pending_connection_state(ConnectionStates0, read),
-    {Record, State} = next_record(State0#state{connection_states = ConnectionStates1}),
-    next_state(Current, Next, Record, State#state{expecting_finished = true});
-next_state(Current, _Next, #ssl_tls{type = ?CHANGE_CIPHER_SPEC, fragment = <<1>>} = 
- 	       _ChangeCipher, #state{negotiated_version = Version} = State) ->
-    handle_own_alert(?ALERT_REC(?FATAL, ?HANDSHAKE_FAILURE), Version, Current, State);
-next_state(Current, Next, #ssl_tls{type = _Unknown}, State0) ->
-    %% Ignore unknown type 
-    {Record, State} = next_record(State0),
-    next_state(Current, Next, Record, State).
-
 next_tls_record(Data, #state{protocol_buffers = #protocol_buffers{tls_record_buffer = Buf0,
 						tls_cipher_texts = CT0} = Buffers} = State0) ->
     case tls_record:get_tls_records(Data, Buf0) of
@@ -504,11 +548,6 @@ next_tls_record(Data, #state{protocol_buffers = #protocol_buffers{tls_record_buf
 	    Alert
     end.
 
-next_record(#state{protocol_buffers = #protocol_buffers{tls_packets = [], tls_cipher_texts = []},
-		   socket = Socket,
-		   transport_cb = Transport} = State) ->
-    ssl_socket:setopts(Transport, Socket, [{active,once}]),
-    {no_record, State};
 next_record(#state{protocol_buffers =
 		       #protocol_buffers{tls_packets = [], tls_cipher_texts = [CT | Rest]}
 		   = Buffers,
@@ -522,6 +561,11 @@ next_record(#state{protocol_buffers =
 	#alert{} = Alert ->
 	    {Alert, State}
     end;
+next_record(#state{protocol_buffers = #protocol_buffers{tls_packets = [], tls_cipher_texts = []},
+		   socket = Socket,
+		   transport_cb = Transport} = State) ->
+    ssl_socket:setopts(Transport, Socket, [{active,once}]),
+    {no_record, State};
 next_record(State) ->
     {no_record, State}.
 
@@ -533,55 +577,36 @@ next_record_if_active(State =
 next_record_if_active(State) ->
     next_record(State).
 
-next_state_connection(StateName, #state{send_queue = Queue0,
-					negotiated_version = Version,
-					socket = Socket,
-					transport_cb = Transport,
-					connection_states = ConnectionStates0
-				       } = State) ->     
-    %% Send queued up data that was queued while renegotiating
-    case queue:out(Queue0) of
-	{{value, {From, Data}}, Queue} ->
-	    {Msgs, ConnectionStates} = 
-		ssl_record:encode_data(Data, Version, ConnectionStates0),
-	    Result = Transport:send(Socket, Msgs),
-	    gen_fsm:reply(From, Result),
-	    next_state_connection(StateName,
-				  State#state{connection_states = ConnectionStates,
-						      send_queue = Queue});		
-	{empty, Queue0} ->
-	    next_state_is_connection(StateName, State)
-    end.
-
-%% In next_state_is_connection/1: clear tls_handshake,
-%% premaster_secret and public_key_info (only needed during handshake)
-%% to reduce memory foot print of a connection.
-next_state_is_connection(_, State = 
-		      #state{start_or_recv_from = RecvFrom,
-			     socket_options =
-			     #socket_options{active = false}}) when RecvFrom =/= undefined ->
-    passive_receive(State#state{premaster_secret = undefined,
-				public_key_info = undefined,
-				tls_handshake_history = ssl_handshake:init_handshake_history()}, connection);
-
-next_state_is_connection(StateName, State0) ->
-    {Record, State} = next_record_if_active(State0),
-    next_state(StateName, connection, Record, State#state{premaster_secret = undefined,
-							  public_key_info = undefined,
-							  tls_handshake_history = ssl_handshake:init_handshake_history()}).
-
 passive_receive(State0 = #state{user_data_buffer = Buffer}, StateName) -> 
     case Buffer of
 	<<>> ->
 	    {Record, State} = next_record(State0),
-	    next_state(StateName, StateName, Record, State);
+	    next_event(StateName, Record, State);
 	_ ->
-	    case read_application_data(<<>>, State0) of
-		Stop = {stop, _, _} ->
-		    Stop;
-		{Record, State} ->
-		    next_state(StateName, StateName, Record, State)
-	    end
+	    {Record, State} = read_application_data(<<>>, State0),
+	    next_event(StateName, Record, State)
+    end.
+
+next_event(StateName, Record, State) ->
+    next_event(StateName, Record, State, []).
+
+next_event(connection = StateName, no_record, State0, Actions) ->
+    case next_record_if_active(State0) of
+	{no_record, State} ->
+	    ssl_connection:hibernate_after(StateName, State, Actions);
+	{#ssl_tls{} = Record, State} ->
+	    {next_state, StateName, State, [{next_event, internal, {tls_record, Record}} | Actions]};
+	{#alert{} = Alert, State} ->
+	    {next_state, StateName, State, [{next_event, internal, Alert} | Actions]}
+    end;
+next_event(StateName, Record, State, Actions) ->
+    case Record of
+	no_record ->
+	    {next_state, StateName, State, Actions};
+	#ssl_tls{} = Record ->
+	    {next_state, StateName, State, [{next_event, internal, {tls_record, Record}} | Actions]};
+	#alert{} = Alert ->
+	    {next_state, StateName, State, [{next_event, internal, Alert} | Actions]}
     end.
 
 read_application_data(Data, #state{user_application = {_Mon, Pid},
@@ -625,11 +650,6 @@ read_application_data(Data, #state{user_application = {_Mon, Pid},
 	    {stop, normal, State0}
     end.
 
-get_timeout(#state{ssl_options=#ssl_options{hibernate_after = undefined}}) ->
-    infinity;
-get_timeout(#state{ssl_options=#ssl_options{hibernate_after = HibernateAfter}}) ->
-    HibernateAfter.
-
 %% Picks ClientData 
 get_data(_, _, <<>>) ->
     {more, <<>>};
@@ -736,7 +756,7 @@ header(N, Binary) ->
     [ByteN | header(N-1, NewBinary)].
 
 send_or_reply(false, _Pid, From, Data) when From =/= undefined ->
-    gen_fsm:reply(From, Data);
+    gen_statem:reply(From, Data);
 %% Can happen when handling own alert or tcp error/close and there is
 %% no outstanding gen_fsm sync events
 send_or_reply(false, no_pid, _, _) ->
@@ -747,51 +767,43 @@ send_or_reply(_, Pid, _From, Data) ->
 send_user(Pid, Msg) ->
     Pid ! Msg.
 
-handle_tls_handshake(Handle, StateName,
-		     #state{protocol_buffers =
-				#protocol_buffers{tls_packets = [Packet]} = Buffers} = State) ->
-    FsmReturn = {next_state, StateName, State#state{protocol_buffers =
-							Buffers#protocol_buffers{tls_packets = []}}},
-    Handle(Packet, FsmReturn);
-
-handle_tls_handshake(Handle, StateName,
-		     #state{protocol_buffers =
-				#protocol_buffers{tls_packets = [Packet | Packets]} = Buffers} =
-			 State0) ->
-    FsmReturn = {next_state, StateName, State0#state{protocol_buffers =
-							 Buffers#protocol_buffers{tls_packets =
-										      Packets}}},
-    case Handle(Packet, FsmReturn) of
-	{next_state, NextStateName, State, _Timeout} ->
-	    handle_tls_handshake(Handle, NextStateName, State);
-	{next_state, NextStateName, State} ->
-	    handle_tls_handshake(Handle, NextStateName, State);
-	{stop, _,_} = Stop ->
-	    Stop
-    end;
-
-handle_tls_handshake(_Handle, _StateName, #state{}) ->
-    throw(?ALERT_REC(?FATAL, ?HANDSHAKE_FAILURE)).
+tls_handshake_events(Handle, StateName,
+  		     #state{protocol_buffers =
+  				#protocol_buffers{tls_packets = [Packet]} = Buffers} = State0, Acc) ->
+    {State, Event} = Handle(Packet, {StateName, 
+				     State0#state{protocol_buffers =
+						      Buffers#protocol_buffers{tls_packets = []}}}),
+    {State, lists:reverse([Event |Acc])};
+tls_handshake_events(Handle, StateName,
+ 		     #state{protocol_buffers =
+ 				#protocol_buffers{tls_packets = 
+						      [Packet | Packets]} = Buffers} = State0, Acc) ->    
+    {State, Event} = Handle(Packet, {StateName, State0#state{protocol_buffers =
+								 Buffers#protocol_buffers{tls_packets =
+											      Packets}}}),
+    tls_handshake_events(Handle, StateName, State, [Event | Acc]);
+
+tls_handshake_events(_Handle, _, #state{}, _) ->
+     throw(?ALERT_REC(?FATAL, ?HANDSHAKE_FAILURE)).
 
 write_application_data(Data0, From, 
 		       #state{socket = Socket,
 			      negotiated_version = Version,
 			      transport_cb = Transport,
 			      connection_states = ConnectionStates0,
-			      send_queue = SendQueue,
 			      socket_options = SockOpts,
 			      ssl_options = #ssl_options{renegotiate_at = RenegotiateAt}} = State) ->
     Data = encode_packet(Data0, SockOpts),
     
     case time_to_renegotiate(Data, ConnectionStates0, RenegotiateAt) of
 	true ->
-	    renegotiate(State#state{send_queue = queue:in_r({From, Data}, SendQueue),
-				    renegotiation = {true, internal}});
+	    renegotiate(State#state{renegotiation = {true, internal}}, 
+			[{next_event, {call, From}, {application_data, Data0}}]);
 	false ->
 	    {Msgs, ConnectionStates} = ssl_record:encode_data(Data, Version, ConnectionStates0),
 	    Result = Transport:send(Socket, Msgs),
-	    {reply, Result,
-	     connection, State#state{connection_states = ConnectionStates}, get_timeout(State)}
+	        ssl_connection:hibernate_after(connection, State#state{connection_states = ConnectionStates}, 
+					       [{reply, From, Result}])
     end.
 
 encode_packet(Data, #socket_options{packet=Packet}) ->
@@ -823,69 +835,73 @@ is_time_to_renegotiate(N, M) when N < M->
     false;
 is_time_to_renegotiate(_,_) ->
     true.
-renegotiate(#state{role = client} = State) ->
+renegotiate(#state{role = client} = State, Actions) ->
     %% Handle same way as if server requested
     %% the renegotiation
     Hs0 = ssl_handshake:init_handshake_history(),
-    connection(#hello_request{}, State#state{tls_handshake_history = Hs0});
+    {next_state, connection, State#state{tls_handshake_history = Hs0}, 
+     [{next_event, internal, #hello_request{}} | Actions]};
+
 renegotiate(#state{role = server,
 		   socket = Socket,
 		   transport_cb = Transport,
 		   negotiated_version = Version,
-		   connection_states = ConnectionStates0} = State0) ->
+		   connection_states = ConnectionStates0} = State0, Actions) ->
     HelloRequest = ssl_handshake:hello_request(),
     Frag = tls_handshake:encode_handshake(HelloRequest, Version),
     Hs0 = ssl_handshake:init_handshake_history(),
     {BinMsg, ConnectionStates} = 
 	ssl_record:encode_handshake(Frag, Version, ConnectionStates0),
     Transport:send(Socket, BinMsg),
-    {Record, State} = next_record(State0#state{connection_states = 
-					       ConnectionStates,
-					       tls_handshake_history = Hs0}),
-    next_state(connection, hello, Record, State#state{allow_renegotiate = true}).
+    State1 = State0#state{connection_states = 
+			     ConnectionStates,
+			 tls_handshake_history = Hs0},
+    {Record, State} = next_record(State1),
+    next_event(hello, Record, State, Actions).
 
 handle_alerts([], Result) ->
     Result;
-handle_alerts(_, {stop, _, _} = Stop) ->
-    %% If it is a fatal alert immediately close 
+handle_alerts(_, {stop,_} = Stop) ->
     Stop;
-handle_alerts([Alert | Alerts], {next_state, StateName, State, _Timeout}) ->
-    handle_alerts(Alerts, handle_alert(Alert, StateName, State)).
-
+handle_alerts([Alert | Alerts], {next_state, StateName, State}) ->
+     handle_alerts(Alerts, handle_alert(Alert, StateName, State));
+handle_alerts([Alert | Alerts], {next_state, StateName, State, _Actions}) ->
+     handle_alerts(Alerts, handle_alert(Alert, StateName, State)).
 handle_alert(#alert{level = ?FATAL} = Alert, StateName,
 	     #state{socket = Socket, transport_cb = Transport, 
 		    ssl_options = SslOpts, start_or_recv_from = From, host = Host,
 		    port = Port, session = Session, user_application = {_Mon, Pid},
-		    role = Role, socket_options = Opts, tracker = Tracker} = State) ->
+		    role = Role, socket_options = Opts, tracker = Tracker}) ->
     invalidate_session(Role, Host, Port, Session),
     log_alert(SslOpts#ssl_options.log_alert, StateName, Alert),
     alert_user(Transport, Tracker, Socket, StateName, Opts, Pid, From, Alert, Role),
-    {stop, normal, State};
+    {stop, normal};
 
 handle_alert(#alert{level = ?WARNING, description = ?CLOSE_NOTIFY} = Alert, 
 	     StateName, State) -> 
     handle_normal_shutdown(Alert, StateName, State),
-    {stop, {shutdown, peer_close}, State};
+    {stop, {shutdown, peer_close}};
 
 handle_alert(#alert{level = ?WARNING, description = ?NO_RENEGOTIATION} = Alert, StateName, 
 	     #state{ssl_options = SslOpts, renegotiation = {true, internal}} = State) ->
     log_alert(SslOpts#ssl_options.log_alert, StateName, Alert),
     handle_normal_shutdown(Alert, StateName, State),
-    {stop, {shutdown, peer_close}, State};
+    {stop, {shutdown, peer_close}};
 
 handle_alert(#alert{level = ?WARNING, description = ?NO_RENEGOTIATION} = Alert, StateName, 
 	     #state{ssl_options = SslOpts, renegotiation = {true, From}} = State0) ->
     log_alert(SslOpts#ssl_options.log_alert, StateName, Alert),
-    gen_fsm:reply(From, {error, renegotiation_rejected}),
+    gen_statem:reply(From, {error, renegotiation_rejected}),
     {Record, State} = next_record(State0),
-    next_state(StateName, connection, Record, State);
+    %% Go back to connection!
+    next_event(connection, Record, State);
 
 %% Gracefully log and ignore all other warning alerts
 handle_alert(#alert{level = ?WARNING} = Alert, StateName,
 	     #state{ssl_options = SslOpts} = State0) ->
     log_alert(SslOpts#ssl_options.log_alert, StateName, Alert),
     {Record, State} = next_record(State0),
-    next_state(StateName, StateName, Record, State).
+    next_event(StateName, Record, State).
 
 alert_user(Transport, Tracker, Socket, connection, Opts, Pid, From, Alert, Role) ->
     alert_user(Transport, Tracker, Socket, Opts#socket_options.active, Pid, From, Alert, Role);
@@ -937,7 +953,7 @@ handle_own_alert(Alert, Version, StateName,
     catch _:_ ->
 	    ok
     end,
-    {stop, {shutdown, own_alert}, State}.
+    {stop, {shutdown, own_alert}}.
 
 handle_normal_shutdown(Alert, _, #state{socket = Socket,
 					transport_cb = Transport,
@@ -954,11 +970,6 @@ handle_normal_shutdown(Alert, StateName, #state{socket = Socket,
 						start_or_recv_from = RecvFrom, role = Role}) ->
     alert_user(Transport, Tracker, Socket, StateName, Opts, Pid, RecvFrom, Alert, Role).
 
-handle_unexpected_message(Msg, Info, #state{negotiated_version = Version} = State) ->
-    Alert =  ?ALERT_REC(?FATAL,?UNEXPECTED_MESSAGE),
-    handle_own_alert(Alert, Version, {Info, Msg}, State).
-
-
 handle_close_alert(Data, StateName, State0) ->
     case next_tls_record(Data, State0) of
 	{#ssl_tls{type = ?ALERT, fragment = EncAlerts}, State} ->
@@ -979,27 +990,6 @@ invalidate_session(client, Host, Port, Session) ->
 invalidate_session(server, _, Port, Session) ->
     ssl_manager:invalidate_session(Port, Session).
 
-%% User downgrades connection
-%% When downgrading an TLS connection to a transport connection
-%% we must recive the close message before releasing the 
-%% transport socket.
-close({close, {Pid, Timeout}}, Socket, Transport, ConnectionStates, Check) when is_pid(Pid) -> 
-    ssl_socket:setopts(Transport, Socket, [{active, false}, {packet, ssl_tls}]),
-    case Transport:recv(Socket, 0, Timeout) of
-	{ok, {ssl_tls, Socket, ?ALERT, Version,  Fragment}} ->
-	    case tls_record:decode_cipher_text(#ssl_tls{type = ?ALERT,
-							version = Version,
-							fragment = Fragment
-						       }, ConnectionStates, Check) of
-		{#ssl_tls{fragment = Plain}, _} ->
-		    [Alert| _] = decode_alerts(Plain),
-		    downgrade(Alert, Transport, Socket, Pid)
-	    end;
-	{error, timeout} ->
-	    {error, timeout};
-	_ ->
-	    {error, no_tls_close}
-    end;
 %% User closes or recursive call!
 close({close, Timeout}, Socket, Transport = gen_tcp, _,_) ->
     ssl_socket:setopts(Transport, Socket, [{active, false}]),
@@ -1020,15 +1010,11 @@ close({shutdown, own_alert}, Socket, Transport = gen_tcp, ConnectionStates, Chec
     %% with the network but we want to maximise the odds that
     %% peer application gets all data sent on the tcp connection.
     close({close, ?DEFAULT_TIMEOUT}, Socket, Transport, ConnectionStates, Check);
+close(downgrade, _,_,_,_) ->
+    ok;
 %% Other
 close(_, Socket, Transport, _,_) -> 
     Transport:close(Socket).
-downgrade(#alert{description = ?CLOSE_NOTIFY}, Transport, Socket, Pid) ->
-    ssl_socket:setopts(Transport, Socket, [{active, false}, {packet, 0}, {mode, binary}]),
-    Transport:controlling_process(Socket, Pid),
-    {ok, Socket};
-downgrade(_, _,_,_) ->
-    {error, no_tls_close}.
 	       
 convert_state(#state{ssl_options = Options} = State, up, "5.3.5", "5.3.6") ->
     State#state{ssl_options = convert_options_partial_chain(Options, up)};
@@ -1069,4 +1055,3 @@ handle_sni_extension(#client_hello{extensions = HelloExtensions}, State0) ->
     end;
 handle_sni_extension(_, State0) ->
     State0.
-
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index 3fea38078f..78a13f703a 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -720,21 +720,27 @@ clear_pem_cache(Config) when is_list(Config) ->
     State = ssl_test_lib:state(Prop),
     [_,FilRefDb |_] = element(6, State),
     {Server, Client} = basic_verify_test_no_close(Config),
-    2 = ets:info(FilRefDb, size), 
+    CountReferencedFiles = fun({_,-1}, Acc) ->
+				   Acc;
+			      ({_, N}, Acc) ->
+				   N + Acc
+			   end,
+    
+    2 = ets:foldl(CountReferencedFiles, 0, FilRefDb), 
     ssl:clear_pem_cache(),
     _ = sys:get_status(whereis(ssl_manager)),
     {Server1, Client1} = basic_verify_test_no_close(Config),
-    4 = ets:info(FilRefDb, size), 
+    4 =  ets:foldl(CountReferencedFiles, 0, FilRefDb), 
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client),
-    ct:sleep(5000),
+    ct:sleep(2000),
     _ = sys:get_status(whereis(ssl_manager)),
-    2 = ets:info(FilRefDb, size),
+    2 =  ets:foldl(CountReferencedFiles, 0, FilRefDb), 
     ssl_test_lib:close(Server1),
     ssl_test_lib:close(Client1),
-    ct:sleep(5000),
+    ct:sleep(2000),
     _ = sys:get_status(whereis(ssl_manager)),
-    0 = ets:info(FilRefDb, size).
+    0 =  ets:foldl(CountReferencedFiles, 0, FilRefDb).
 
 %%--------------------------------------------------------------------
 
@@ -2565,6 +2571,13 @@ der_input(Config) when is_list(Config) ->
     DataDir = ?config(data_dir, Config),
     DHParamFile = filename:join(DataDir, "dHParam.pem"),
 
+    {status, _, _, StatusInfo} = sys:get_status(whereis(ssl_manager)),
+    [_, _,_, _, Prop] = StatusInfo,
+    State = ssl_test_lib:state(Prop),
+    [CADb | _] = element(6, State),
+
+    Size = ets:info(CADb, size),
+
     SeverVerifyOpts = ?config(server_verification_opts, Config),
     {ServerCert, ServerKey, ServerCaCerts, DHParams} = der_input_opts([{dhfile, DHParamFile} |
 								       SeverVerifyOpts]),
@@ -2592,13 +2605,8 @@ der_input(Config) when is_list(Config) ->
     ssl_test_lib:check_result(Server, ok, Client, ok),
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client),
+    Size = ets:info(CADb, size).
 
-    {status, _, _, StatusInfo} = sys:get_status(whereis(ssl_manager)),
-    [_, _,_, _, Prop] = StatusInfo,
-    State = ssl_test_lib:state(Prop),
-    [CADb | _] = element(6, State),
-    [] = ets:tab2list(CADb).
-    
 %%--------------------------------------------------------------------
 der_input_opts(Opts) ->
     Certfile = proplists:get_value(certfile, Opts),
@@ -3060,6 +3068,7 @@ hibernate(Config) ->
     {current_function, _} =
         process_info(Pid, current_function),
 
+    ssl_test_lib:check_result(Server, ok, Client, ok),
     timer:sleep(1100),
 
     {current_function, {erlang, hibernate, 3}} =
@@ -3093,15 +3102,29 @@ hibernate_right_away(Config) ->
 
     Server1 = ssl_test_lib:start_server(StartServerOpts),
     Port1 = ssl_test_lib:inet_port(Server1),
-    {Client1, #sslsocket{}} = ssl_test_lib:start_client(StartClientOpts ++
+    {Client1, #sslsocket{pid = Pid1}} = ssl_test_lib:start_client(StartClientOpts ++
                     [{port, Port1}, {options, [{hibernate_after, 0}|ClientOpts]}]),
+
+    ssl_test_lib:check_result(Server1, ok, Client1, ok),
+
+    {current_function, {erlang, hibernate, 3}} =
+	process_info(Pid1, current_function),
+
     ssl_test_lib:close(Server1),
     ssl_test_lib:close(Client1),
 
     Server2 = ssl_test_lib:start_server(StartServerOpts),
     Port2 = ssl_test_lib:inet_port(Server2),
-    {Client2, #sslsocket{}} = ssl_test_lib:start_client(StartClientOpts ++
+    {Client2, #sslsocket{pid = Pid2}} = ssl_test_lib:start_client(StartClientOpts ++
                     [{port, Port2}, {options, [{hibernate_after, 1}|ClientOpts]}]),
+
+    ssl_test_lib:check_result(Server2, ok, Client2, ok),
+
+    ct:sleep(100), %% Schedule out
+
+    {current_function, {erlang, hibernate, 3}} =
+	process_info(Pid2, current_function),
+
     ssl_test_lib:close(Server2),
     ssl_test_lib:close(Client2).
 
diff --git a/lib/ssl/test/ssl_certificate_verify_SUITE.erl b/lib/ssl/test/ssl_certificate_verify_SUITE.erl
index 66ccbb1da4..1ce6f3b567 100644
--- a/lib/ssl/test/ssl_certificate_verify_SUITE.erl
+++ b/lib/ssl/test/ssl_certificate_verify_SUITE.erl
@@ -110,6 +110,17 @@ init_per_group(_, Config) ->
 end_per_group(_GroupName, Config) ->
     Config.
 
+init_per_testcase(TestCase, Config) when TestCase == cert_expired;
+					 TestCase == invalid_signature_client;
+					 TestCase == invalid_signature_server;
+					 TestCase == extended_key_usage_verify_none;
+					 TestCase == extended_key_usage_verify_peer;
+					 TestCase == critical_extension_verify_none;
+					 TestCase == critical_extension_verify_peer;
+					 TestCase == no_authority_key_identifier;
+					 TestCase == no_authority_key_identifier_and_nonstandard_encoding->
+    ssl:clear_pem_cache(),
+    init_per_testcase(common, Config);
 init_per_testcase(_TestCase, Config) ->
     ct:log("TLS/SSL version ~p~n ", [tls_record:supported_protocol_versions()]),
     ct:timetrap({seconds, 5}),
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index db9e1c3d38..38cc3532d8 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -1041,10 +1041,13 @@ receive_rizzo_duong_beast() ->
 	    end
     end.
 
-state([{data,[{"State", State}]} | _]) ->
-    State;
-state([{data,[{"StateData", State}]} | _]) ->
+
+state([{data,[{"State", {_StateName, StateData}}]} | _]) -> %% gen_statem
+    StateData;
+state([{data,[{"State", State}]} | _]) -> %% gen_server
     State;
+state([{data,[{"StateData", State}]} | _]) -> %% gen_fsm
+     State;
 state([_ | Rest]) ->
     state(Rest).