Merge branch 'raimo/ssl-dist-bench/OTP-14657'

* origin/raimo/ssl-dist-bench/OTP-14657:
  Write SSL distribution benchmarks
  Polish SSL distribution
  Handle whitebox test message
  Correct distribution doc
  Use SNI when connecting
  Use -ssl_dist_optfile options
  Read in -ssl_dist_optfile to ETS
  Facilitate test certs with common root
  Stop checking DNS name for SNI

20 files changed, 1521 insertions, 550 deletions

diff --git a/lib/kernel/doc/src/net_kernel.xml b/lib/kernel/doc/src/net_kernel.xml
index 0b94fc0fa6..94c8fb9e20 100644
--- a/lib/kernel/doc/src/net_kernel.xml
+++ b/lib/kernel/doc/src/net_kernel.xml
@@ -230,7 +230,12 @@ $ <input>erl -sname foobar</input></pre>
           <item>
             <p>The tuple <c>{nodedown_reason, Reason}</c> is included in
               <c>InfoList</c> in <c>nodedown</c> messages.</p>
-            <p><c>Reason</c> can be any of the following:</p>
+            <p>
+	      <c>Reason</c> can, depending on which
+	      distribution module or process that is used be any term,
+	      but for the standard TCP distribution module it is
+	      any of the following:
+	    </p>
             <taglist>
               <tag><c>connection_setup_failed</c></tag>
               <item><p>The connection setup failed (after <c>nodeup</c>
diff --git a/lib/public_key/doc/src/public_key.xml b/lib/public_key/doc/src/public_key.xml
index 5230cef496..dea35bc390 100644
--- a/lib/public_key/doc/src/public_key.xml
+++ b/lib/public_key/doc/src/public_key.xml
@@ -774,6 +774,7 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
 
   <func>
     <name>pkix_test_data(Options) -> Config </name>
+    <name>pkix_test_data([chain_opts()]) -> [conf_opt()]</name>
     <fsummary>Creates certificate test data.</fsummary>
     <type>
       <v>Options = #{chain_type() := chain_opts()} </v>
@@ -781,30 +782,83 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
       
       <v>chain_type() = server_chain | client_chain </v>
 
-      <v>chain_opts() = #{chain_end() := [cert_opt()],
-          intermediates => [[cert_opt()]]}</v>
-      <d>A valid chain must have at least a ROOT and a peer cert</d>
-
-      <v>chain_end() = root | peer </v>
-
+      <v>chain_opts() = #{root := [cert_opt()] | root_cert(),
+      peer := [cert_opt()],
+      intermediates => [[cert_opt()]]}</v>
+      <d>
+	A valid chain must have at least a ROOT and a peer cert.
+	The root cert can be given either as a cert pre-generated by
+	<seealso marker="#pkix_test_root_cert-2">
+	  pkix_test_root_cert/2
+	</seealso>, or as root cert generation options.
+      </d>
+      <v>root_cert() = #{cert := der_encoded(), key := Key}</v>
+      <d>
+	A root certificate generated by
+	<seealso marker="#pkix_test_root_cert-2">
+	  pkix_test_root_cert/2
+	</seealso>.
+      </d>
       <v>cert_opt() = {Key, Value}</v>
       <d>For available options see <seealso marker="#cert_opt"> cert_opt()</seealso> below.</d>
 
       <v>Config = #{server_config := [conf_opt()],
       client_config := [conf_opt()]}</v>
 
-      <v>conf_opt() = {cert, der_encoded()} | {key, der_encoded()} |{cacerts, [der_encoded()]}</v>
-      <d>This is a subset of the type <seealso marker="ssl:ssl#type-ssloption"> ssl:ssl_option()</seealso> </d>
+      <v>conf_opt() = {cert, der_encoded()} | {key, PrivateKey} |{cacerts, [der_encoded()]}</v>
+      <d>
+	This is a subset of the type
+	<seealso marker="ssl:ssl#type-ssloption"> ssl:ssl_option()</seealso>.
+	<c>PrivateKey</c> is what
+	<seealso marker="#generate_key-1">generate_key/1</seealso>
+	returns.
+      </d>
     </type>
     
     <desc>
-      <p>Creates certificate test data to facilitate automated testing
-      of applications using X509-certificates often through
-      SSL/TLS. The test data can be used when you have control
-      over both the client and the server in a test scenario.
+      <p>
+	Creates certificate configuration(s) consisting of certificate
+	and its private key plus CA certificate bundle, for a client
+	and a server, intended to facilitate automated testing
+	of applications using X509-certificates,
+	often through SSL/TLS. The test data can be used
+	when you have control over both the client and the server
+	in a test scenario.
+      </p>
+      <p>
+	When this function is called with a map containing
+	client and server chain specifications;
+	it generates both a client and a server certificate chain
+	where the <c>cacerts</c>
+	returned for the server contains the root cert the server
+	should trust and the intermediate certificates the server
+	should present to connecting clients.
+	The root cert the server should trust is the one used
+	as root of the client certificate chain.
+	Vice versa applies to the <c>cacerts</c> returned for the client.
+	The root cert(s) can either be pre-generated with
+	<seealso marker="#pkix_test_root_cert-2">
+	  pkix_test_root_cert/2
+	</seealso>, or if options are specified; it is (they are)
+	 generated.
+      </p>
+      <p>
+	When this function is called with a list of certificate options;
+	it generates a configuration with just one node certificate
+	where <c>cacerts</c> contains the root cert
+	and the intermediate certs that should be presented to a peer.
+	In this case the same root cert must be used for all peers.
+	This is useful in for example an Erlang distributed cluster
+	where any node,	towards another node, acts either
+	as a server or as a client depending on who connects to whom.
+	The generated certificate contains a subject altname,
+	which is not needed in a client certificate,
+	but makes the certificate useful for both roles.
+      </p>
+      <p>
+	The <marker id="cert_opt"/><c>cert_opt()</c>
+	type consists of the following options:
       </p>
-      
-      <p> The <marker id="cert_opt"/> cert_opt() type consists of the following options: </p>
       <taglist>
 	<tag> {digest, digest_type()}</tag>
 	<item><p>Hash algorithm to be used for
@@ -851,6 +905,36 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
     </desc>
   </func>
   
+  <func>
+    <name>pkix_test_root_cert(Name, Options) -> RootCert</name>
+    <fsummary>Generates a test data root cert.</fsummary>
+    <type>
+      <v>Name = string()</v>
+      <d>The root certificate name.</d>
+      <v>Options = [cert_opt()]</v>
+      <d>
+	For available options see
+	<seealso marker="#cert_opt">cert_opt()</seealso>
+	under
+	<seealso marker="#pkix_test_data-1">pkix_test_data/1</seealso>.
+      </d>
+      <v>RootCert = #{cert := der_encoded(), key := Key}</v>
+      <d>
+	A root certificate and key.  The <c>Key</c> is generated by
+	<seealso marker="#generate_key-1">generate_key/1</seealso>.
+      </d>
+    </type>
+    <desc>
+      <p>
+	Generates a root certificate that can be used
+	in multiple calls to
+	<seealso marker="#pkix_test_data-1">pkix_test_data/1</seealso>
+	when you want the same root certificate for
+	several generated certificates.
+      </p>
+    </desc>
+  </func>
+
   <func>  
     <name>pkix_verify(Cert, Key) -> boolean()</name>
     <fsummary>Verifies PKIX x.509 certificate signature.</fsummary>
diff --git a/lib/public_key/src/pubkey_cert.erl b/lib/public_key/src/pubkey_cert.erl
index 76fd0f8133..c433a96585 100644
--- a/lib/public_key/src/pubkey_cert.erl
+++ b/lib/public_key/src/pubkey_cert.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2016. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2017. All Rights Reserved.
 %%
 %% Licensed under the Apache License, Version 2.0 (the "License");
 %% you may not use this file except in compliance with the License.
@@ -33,11 +33,12 @@
 	 is_fixed_dh_cert/1, verify_data/1, verify_fun/4, 
 	 select_extension/2, match_name/3,
 	 extensions_list/1, cert_auth_key_id/1, time_str_2_gregorian_sec/1,
-         gen_test_certs/1]).
+         gen_test_certs/1, root_cert/2]).
 
 -define(NULL, 0).
 
--export_type([chain_opts/0, test_config/0]).
+-export_type([cert_opt/0, chain_opts/0, conf_opt/0,
+              test_config/0, test_root_cert/0]).
 
 -type cert_opt()  :: {digest, public_key:digest_type()} | 
                      {key, public_key:key_params() | public_key:private_key()} | 
@@ -46,9 +47,12 @@
 -type chain_end()   :: root | peer.
 -type chain_opts()  :: #{chain_end() := [cert_opt()],  intermediates =>  [[cert_opt()]]}.
 -type conf_opt()    :: {cert, public_key:der_encoded()} | 
-                       {key,  public_key:der_encoded()} |
+                       {key,  public_key:private_key()} |
                        {cacerts, [public_key:der_encoded()]}.
--type test_config() :: #{server_config := [conf_opt()],  client_config :=  [conf_opt()]}.
+-type test_config() ::
+        #{server_config := [conf_opt()],  client_config :=  [conf_opt()]}.
+-type test_root_cert() ::
+        #{cert := binary(), key := public_key:private_key()}.
 %%====================================================================
 %% Internal application APIu
 %%====================================================================
@@ -430,31 +434,94 @@ match_name(Fun, Name, PermittedName, [Head | Tail]) ->
 	false ->
 	    match_name(Fun, Name, Head, Tail)
     end.
+
 %%%
--spec gen_test_certs(#{server_chain:= chain_opts(), client_chain:= chain_opts()}) -> test_config().
- 
-%% Generates server and and client configuration for testing 
+-spec gen_test_certs(#{server_chain:= chain_opts(),
+                       client_chain:= chain_opts()} |
+                     chain_opts()) ->
+                            test_config() |
+                            [conf_opt()].
+%%
+%% Generates server and and client configuration for testing
 %% purposes. All certificate options have default values
-gen_test_certs(#{client_chain := #{root := ClientRootConf,
-                                   intermediates := ClientCAs,
-                                   peer := ClientPeer}, 
-                 server_chain := 
-                     #{root := ServerRootConf,
-                       intermediates := ServerCAs,
-                       peer := ServerPeer}}) ->
-    SRootKey = gen_key(proplists:get_value(key, ServerRootConf, default_key_gen())),
-    CRootKey = gen_key(proplists:get_value(key, ClientRootConf, default_key_gen())),
-    ServerRoot = root_cert("server", SRootKey, ClientRootConf),
-    ClientRoot = root_cert("client", CRootKey, ServerRootConf),
-    
-    [{ServerDERCert, ServerDERKey} | ServerCAsKeys] = config(server, ServerRoot, 
-                                                       SRootKey, lists:reverse([ServerPeer | lists:reverse(ServerCAs)])),
-    [{ClientDERCert, ClientDERKey} | ClientCAsKeys] = config(client, ClientRoot, 
-                                                       CRootKey, lists:reverse([ClientPeer | lists:reverse(ClientCAs)])),
-    ServerDERCA = ca_config(ClientRoot, ServerCAsKeys),
-    ClientDERCA = ca_config(ServerRoot, ClientCAsKeys),
-    #{server_config => [{cert, ServerDERCert}, {key, ServerDERKey}, {cacerts, ServerDERCA}], 
-      client_config => [{cert, ClientDERCert}, {key, ClientDERKey}, {cacerts, ClientDERCA}]}.
+gen_test_certs(
+  #{client_chain :=
+        #{root := ClientRoot,
+          intermediates := ClientCAs,
+          peer := ClientPeer},
+    server_chain :=
+        #{root := ServerRoot,
+          intermediates := ServerCAs,
+          peer := ServerPeer}}) ->
+    #{cert := ServerRootCert, key := ServerRootKey} =
+        case ServerRoot of
+            #{} ->
+                ServerRoot;
+            ServerRootConf when is_list(ServerRootConf) ->
+                root_cert("SERVER ROOT CA", ServerRootConf)
+        end,
+    #{cert := ClientRootCert, key := ClientRootKey} =
+        case ClientRoot of
+            #{} ->
+                ClientRoot;
+            ClientRootConf when is_list(ClientRootConf) ->
+                root_cert("CLIENT ROOT CA", ClientRootConf)
+        end,
+    [{ServerDERCert, ServerDERKey} | ServerCAsKeys] =
+        config(
+          server, ServerRootCert, ServerRootKey,
+          lists:reverse([ServerPeer | lists:reverse(ServerCAs)])),
+    [{ClientDERCert, ClientDERKey} | ClientCAsKeys] =
+        config(
+          client, ClientRootCert, ClientRootKey,
+          lists:reverse([ClientPeer | lists:reverse(ClientCAs)])),
+    ServerDERCA = ca_config(ClientRootCert, ServerCAsKeys),
+    ClientDERCA = ca_config(ServerRootCert, ClientCAsKeys),
+    #{server_config =>
+          [{cert, ServerDERCert}, {key, ServerDERKey},
+           {cacerts, ServerDERCA}],
+      client_config =>
+          [{cert, ClientDERCert}, {key, ClientDERKey},
+           {cacerts, ClientDERCA}]};
+%%
+%% Generates a node configuration for testing purposes,
+%% when using the node server cert also for the client.
+%% All certificate options have default values
+gen_test_certs(
+  #{root := Root, intermediates := CAs, peer := Peer}) ->
+    #{cert := RootCert, key := RootKey} =
+        case Root of
+            #{} ->
+                Root;
+            RootConf when is_list(RootConf) ->
+                root_cert("SERVER ROOT CA", RootConf)
+        end,
+    [{DERCert, DERKey} | CAsKeys] =
+        config(
+          server, RootCert, RootKey,
+          lists:reverse([Peer | lists:reverse(CAs)])),
+    DERCAs = ca_config(RootCert, CAsKeys),
+    [{cert, DERCert}, {key, DERKey}, {cacerts, DERCAs}].
+
+%%%
+-spec root_cert(string(), [cert_opt()]) -> test_root_cert().
+%%
+%% Generate a self-signed root cert
+root_cert(Name, Opts) ->
+    PrivKey = gen_key(proplists:get_value(key, Opts, default_key_gen())),
+    TBS = cert_template(),
+    Issuer = subject("root", Name),
+    OTPTBS =
+        TBS#'OTPTBSCertificate'{
+          signature = sign_algorithm(PrivKey, Opts),
+          issuer = Issuer,
+          validity = validity(Opts),
+          subject = Issuer,
+          subjectPublicKeyInfo = public_key(PrivKey),
+          extensions = extensions(undefined, ca, Opts)
+         },
+    #{cert => public_key:pkix_sign(OTPTBS, PrivKey),
+      key => PrivKey}.
 
 %%--------------------------------------------------------------------
 %%% Internal functions
@@ -1103,7 +1170,7 @@ missing_basic_constraints(OtpCert, SelfSigned, ValidationState, VerifyFun, UserS
 	     UserState}
     end.
 
- gen_key(KeyGen) ->
+gen_key(KeyGen) ->
      case is_key(KeyGen) of
          true ->
              KeyGen;
@@ -1120,28 +1187,14 @@ is_key(#'ECPrivateKey'{}) ->
 is_key(_) ->
     false.
 
-root_cert(Role, PrivKey, Opts) ->
-     TBS = cert_template(),
-     Issuer = issuer("root", Role, " ROOT CA"),
-     OTPTBS = TBS#'OTPTBSCertificate'{
-                signature = sign_algorithm(PrivKey, Opts),
-                issuer = Issuer,
-                validity = validity(Opts),  
-                subject = Issuer,
-                subjectPublicKeyInfo = public_key(PrivKey),
-                extensions = extensions(Role, ca, Opts)
-               },
-     public_key:pkix_sign(OTPTBS, PrivKey).
 
 cert_template() ->
     #'OTPTBSCertificate'{
        version = v3,              
-       serialNumber = trunc(rand:uniform()*100000000)*10000 + 1,
+       serialNumber = erlang:unique_integer([positive, monotonic]),
        issuerUniqueID = asn1_NOVALUE,       
        subjectUniqueID = asn1_NOVALUE
       }.
-issuer(Contact, Role, Name) ->
-  subject(Contact, Role ++ Name).
 
 subject(Contact, Name) ->
     Opts = [{email, Contact ++ "@example.org"},
@@ -1176,9 +1229,11 @@ validity(Opts) ->
     DefFrom0 = calendar:gregorian_days_to_date(calendar:date_to_gregorian_days(date())-1),
     DefTo0   = calendar:gregorian_days_to_date(calendar:date_to_gregorian_days(date())+7),
     {DefFrom, DefTo} = proplists:get_value(validity, Opts, {DefFrom0, DefTo0}),
-    Format = fun({Y,M,D}) -> 
-                     lists:flatten(io_lib:format("~w~2..0w~2..0w000000Z",[Y,M,D])) 
-             end,
+    Format =
+        fun({Y,M,D}) ->
+                lists:flatten(
+                  io_lib:format("~4..0w~2..0w~2..0w000000Z",[Y,M,D]))
+        end,
     #'Validity'{notBefore={generalTime, Format(DefFrom)},
 		notAfter ={generalTime, Format(DefTo)}}.
 
@@ -1240,7 +1295,6 @@ cert(Role, #'OTPCertificate'{tbsCertificate = #'OTPTBSCertificate'{subject = Iss
                subject = subject(Contact, atom_to_list(Role) ++ Name),
                subjectPublicKeyInfo = public_key(Key),
                extensions = extensions(Role, Type, Opts)
-               
               },
     public_key:pkix_sign(OTPTBS, PrivKey).
 
@@ -1297,7 +1351,7 @@ add_default_extensions(server, peer, Exts) ->
               ],
     add_default_extensions(Default, Exts);
     
-add_default_extensions(_, peer, Exts) ->
+add_default_extensions(client, peer, Exts) ->
     Exts.
 
 add_default_extensions(Defaults0, Exts) ->
diff --git a/lib/public_key/src/public_key.erl b/lib/public_key/src/public_key.erl
index 6788c1ee92..034126655c 100644
--- a/lib/public_key/src/public_key.erl
+++ b/lib/public_key/src/public_key.erl
@@ -59,7 +59,8 @@
 	 pkix_crl_verify/2,
 	 pkix_crl_issuer/1,
 	 short_name_hash/1,
-         pkix_test_data/1
+         pkix_test_data/1,
+         pkix_test_root_cert/2
 	]).
 
 -export_type([public_key/0, private_key/0, pem_entry/0,
@@ -1033,10 +1034,12 @@ short_name_hash({rdnSequence, _Attributes} = Name) ->
 
 
 %%--------------------------------------------------------------------
--spec pkix_test_data(#{chain_type() := pubkey_cert:chain_opts()}) ->
-                            pubkey_cert:test_config().
+-spec pkix_test_data(#{chain_type() := pubkey_cert:chain_opts()} |
+                     pubkey_cert:chain_opts()) ->
+                            pubkey_cert:test_config() |
+                            [pubkey_cert:conf_opt()].
 
-%% Description: Generates OpenSSL-style hash of a name.
+%% Description: Generates cert(s) and ssl configuration
 %%--------------------------------------------------------------------
 
 pkix_test_data(#{client_chain := ClientChain0,
@@ -1045,7 +1048,21 @@ pkix_test_data(#{client_chain := ClientChain0,
     ClientChain = maps:merge(Default, ClientChain0),
     ServerChain = maps:merge(Default, ServerChain0),
     pubkey_cert:gen_test_certs(#{client_chain => ClientChain,
-                                 server_chain => ServerChain}).
+                                 server_chain => ServerChain});
+pkix_test_data(#{} = Chain) ->
+    Default = #{intermediates => []},
+    pubkey_cert:gen_test_certs(maps:merge(Default, Chain)).
+
+%%--------------------------------------------------------------------
+-spec pkix_test_root_cert(
+        Name :: string(), Opts :: [pubkey_cert:cert_opt()]) ->
+                                 pubkey_cert:test_root_cert().
+
+%% Description: Generates a root cert suitable for pkix_test_data/1
+%%--------------------------------------------------------------------
+
+pkix_test_root_cert(Name, Opts) ->
+    pubkey_cert:root_cert(Name, Opts).
 
 %%--------------------------------------------------------------------
 %%% Internal functions
diff --git a/lib/ssl/doc/src/ssl_distribution.xml b/lib/ssl/doc/src/ssl_distribution.xml
index 61f88e3860..7f8a08f704 100644
--- a/lib/ssl/doc/src/ssl_distribution.xml
+++ b/lib/ssl/doc/src/ssl_distribution.xml
@@ -4,7 +4,7 @@
 <chapter>
   <header>
     <copyright>
-      <year>2000</year><year>2016</year>
+      <year>2000</year><year>2017</year>
       <holder>Ericsson AB. All Rights Reserved.</holder>
     </copyright>
     <legalnotice>
@@ -180,10 +180,96 @@ Eshell V5.0  (abort with ^G)
 
   <section>
     <title>Specifying SSL Options</title>
-    <p>For SSL to work, at least
-    a public key and a certificate must be specified for the server
-    side. In the following example, the PEM-files consist of two
-    entries, the server certificate and its private key.</p>
+
+    <p>
+      The SSL distribution options can be written into a file
+      that is consulted when the node is started.  This file name
+      is then specified with the command line argument
+      <c>-ssl_dist_optfile</c>.
+    </p>
+    <p>
+      Any available SSL option can be specified in an options file,
+      but note that options that take a <c>fun()</c> has to use
+      the syntax <c>fun Mod:Func/Arity</c> since a function
+      body can not be compiled when consulting a file.
+    </p>
+    <p>
+      Do not tamper with the socket options
+      <c>list</c>, <c>binary</c>, <c>active</c>, <c>packet</c>,
+      <c>nodelay</c> and <c>deliver</c> since they are used
+      by the distribution protocol handler itself.
+      Other raw socket options such as <c>packet_size</c> may
+      interfere severely, so beware!
+    </p>
+    <p>
+      For SSL to work, at least a public key and a certificate
+      must be specified for the server side.
+      In the following example, the PEM file
+      <c>"/home/me/ssl/erlserver.pem"</c> contains both
+      the server certificate and its private key.
+    </p>
+    <p>
+      Create a file named for example
+      <c>"/home/me/ssl/[email protected]"</c>:
+    </p>
+    <code type="none"><![CDATA[
+[{server,
+  [{certfile, "/home/me/ssl/erlserver.pem"},
+   {secure_renegotiate, true}]},
+ {client,
+  [{secure_renegotiate, true}]}].]]>
+    </code>
+    <p>
+      And then start the node like this
+      (line breaks in the command are for readability,
+      and shall not be there when typed):
+    </p>
+    <code type="none"><![CDATA[
+$ erl -boot /home/me/ssl/start_ssl -proto_dist inet_tls
+  -ssl_dist_optfile "/home/me/ssl/[email protected]"
+  -sname ssl_test]]>
+    </code>
+    <p>
+      The options in the <c>{server, Opts}</c> tuple are used
+      when calling <c>ssl:ssl_accept/3</c>, and the options in the
+      <c>{client, Opts}</c> tuple are used when calling
+      <c>ssl:connect/4</c>.
+    </p>
+    <p>
+      For the client, the option
+      <c>{server_name_indication, atom_to_list(TargetNode)}</c>
+      is added when connecting.
+      This makes it possible to use the client option
+      <c>{verify, verify_peer}</c>,
+      and the client will verify that the certificate matches
+      the node name you are connecting to.
+      This only works if the the server certificate is issued
+      to the name <c>atom_to_list(TargetNode)</c>.
+    </p>
+    <p>
+      For the server it is also possible to use the option
+      <c>{verify, verify_peer}</c> and the server will only accept
+      client connections with certificates that are trusted by
+      a root certificate that the server knows.
+      A client that presents an untrusted certificate will be rejected.
+      This option is preferably combined with
+      <c>{fail_if_no_peer_cert, true}</c> or a client will
+      still be accepted if it does not present any certificate.
+    </p>
+    <p>
+      A node started in this way is fully functional, using SSL
+      as the distribution protocol.
+    </p>
+  </section>
+
+  <section>
+    <title>Specifying SSL Options (Legacy)</title>
+
+    <p>
+      As in the previous section the PEM file
+      <c>"/home/me/ssl/erlserver.pem"</c> contains both
+      the server certificate and its private key.
+    </p>
 
     <p>On the <c>erl</c> command line you can specify options that the
     SSL distribution adds when creating a socket.</p>
@@ -226,24 +312,26 @@ Eshell V5.0  (abort with ^G)
     SSL options and their values. Argument <c>-ssl_dist_opt</c> can
     be repeated any number of times.</p>
 
-      <p>An example command line can now look as follows
+    <p>
+      An example command line doing the same as the example
+      in the previous section can now look as follows
       (line breaks in the command are for readability, 
-      and are not be there when typed):</p>
-    <code type="none">
+      and shall not be there when typed):
+    </p>
+    <code type="none"><![CDATA[
 $ erl -boot /home/me/ssl/start_ssl -proto_dist inet_tls
-  -ssl_dist_opt server_certfile "/home/me/ssl/erlserver.pem" 
+  -ssl_dist_opt server_certfile "/home/me/ssl/erlserver.pem"
   -ssl_dist_opt server_secure_renegotiate true client_secure_renegotiate true
   -sname ssl_test
 Erlang (BEAM) emulator version 5.0 [source]
- 
+
 Eshell V5.0  (abort with ^G)
-(ssl_test@myhost)1>     </code>
-    <p>A node started in this way is fully functional, using SSL
-      as the distribution protocol.</p>
+(ssl_test@myhost)1>]]>
+    </code>
   </section>
 
   <section>
-    <title>Setting up Environment to Always Use SSL</title>
+    <title>Setting up Environment to Always Use SSL (Legacy)</title>
     <p>A convenient way to specify arguments to Erlang is to use environment 
       variable <c>ERL_FLAGS</c>. All the flags needed to
       use the SSL distribution can be specified in that variable and are
@@ -285,15 +373,11 @@ Eshell V5.0  (abort with ^G)
     variable.</p>
 
     <p>An example command line with this option would look like this:</p>
-    <code type="none">
+    <code type="none"><![CDATA[
 $ erl -boot /home/me/ssl/start_ssl -proto_dist inet6_tls
-  -ssl_dist_opt server_certfile "/home/me/ssl/erlserver.pem"
-  -ssl_dist_opt server_secure_renegotiate true client_secure_renegotiate true
-  -sname ssl_test
-Erlang (BEAM) emulator version 5.0 [source]
-
-Eshell V5.0  (abort with ^G)
-(ssl_test@myhost)1>     </code>
+  -ssl_dist_optfile "/home/me/ssl/[email protected]"
+  -sname ssl_test]]>
+    </code>
 
     <p>A node started in this way will only be able to communicate with
     other nodes using SSL distribution over IPv6.</p>
diff --git a/lib/ssl/src/dtls_connection.erl b/lib/ssl/src/dtls_connection.erl
index 073cb4009b..e5760e7951 100644
--- a/lib/ssl/src/dtls_connection.erl
+++ b/lib/ssl/src/dtls_connection.erl
@@ -467,7 +467,8 @@ init(Type, Event, State) ->
 error(enter, _, State) ->
     {keep_state, State};     
 error({call, From}, {start, _Timeout}, {Error, State}) ->
-    {stop_and_reply, normal, {reply, From, {error, Error}}, State};
+    ssl_connection:stop_and_reply(
+      normal, {reply, From, {error, Error}}, State);
 error({call, _} = Call, Msg, State) ->
     gen_handshake(?FUNCTION_NAME, Call, Msg, State);
 error(_, _, _) ->
@@ -821,7 +822,7 @@ handle_info({Protocol, _, _, _, Data}, StateName,
 	    next_event(StateName, Record, State);
 	#alert{} = Alert ->
 	    ssl_connection:handle_normal_shutdown(Alert, StateName, State0), 
-	    {stop, {shutdown, own_alert}}
+	    ssl_connection:stop({shutdown, own_alert}, State0)
     end;
 handle_info({CloseTag, Socket}, StateName,
 	    #state{socket = Socket, 
@@ -846,7 +847,7 @@ handle_info({CloseTag, Socket}, StateName,
                     ok
             end,
             ssl_connection:handle_normal_shutdown(?ALERT_REC(?FATAL, ?CLOSE_NOTIFY), StateName, State),
-            {stop, {shutdown, transport_closed}};
+            ssl_connection:stop({shutdown, transport_closed}, State);
         true ->
             %% Fixes non-delivery of final DTLS record in {active, once}.
             %% Basically allows the application the opportunity to set {active, once} again
@@ -872,7 +873,7 @@ handle_state_timeout(flight_retransmission_timeout, StateName,
 
 handle_alerts([], Result) ->
     Result;
-handle_alerts(_, {stop,_} = Stop) ->
+handle_alerts(_, {stop, _, _} = Stop) ->
     Stop;
 handle_alerts([Alert | Alerts], {next_state, StateName, State}) ->
      handle_alerts(Alerts, ssl_connection:handle_alert(Alert, StateName, State));
diff --git a/lib/ssl/src/inet_tls_dist.erl b/lib/ssl/src/inet_tls_dist.erl
index 96782dcfc0..8e605bec65 100644
--- a/lib/ssl/src/inet_tls_dist.erl
+++ b/lib/ssl/src/inet_tls_dist.erl
@@ -324,12 +324,13 @@ do_accept(Driver, Kernel, AcceptPid, DistCtrl, MyNode, Allowed, SetupTime) ->
                           timer = Timer,
                           this_flags = 0,
                           allowed = Allowed},
+                    link(DistCtrl),
 		    dist_util:handshake_other_started(trace(HSData));
 		{false,IP} ->
 		    error_logger:error_msg(
                       "** Connection attempt from "
                       "disallowed IP ~w ** ~n", [IP]),
-		    ?shutdown(trace(no_node))
+		    ?shutdown2(no_node, trace({disallowed, IP}))
 	    end
     end.
 
@@ -357,7 +358,11 @@ do_setup(Driver, Kernel, Node, Type, MyNode, LongOrShortNames, SetupTime) ->
 	    ErlEpmd = net_kernel:epmd_module(),
 	    case ErlEpmd:port_please(Name, Ip) of
 		{port, TcpPort, Version} ->
-                    Opts = trace(connect_options(get_ssl_options(client))),
+                    Opts =
+                        trace(
+                          connect_options(
+                            [{server_name_indication, atom_to_list(Node)}
+                             |get_ssl_options(client)])),
 		    dist_util:reset_timer(Timer),
                     case ssl:connect(
                            Address, TcpPort,
@@ -378,21 +383,26 @@ do_setup(Driver, Kernel, Node, Type, MyNode, LongOrShortNames, SetupTime) ->
                                   this_flags = 0,
                                   other_version = Version,
                                   request_type = Type},
+                            link(DistCtrl),
 			    dist_util:handshake_we_started(trace(HSData));
 			Other ->
 			    %% Other Node may have closed since 
 			    %% port_please !
 			    ?shutdown2(
                                Node,
-                               trace({shutdown, {connect_failed, Other}}))
+                               trace(
+                                 {ssl_connect_failed, Ip, TcpPort, Other}))
 		    end;
 		Other ->
 		    ?shutdown2(
                        Node,
-                       trace({shutdown, {port_please_failed, Other}}))
+                       trace(
+                         {port_please_failed, ErlEpmd, Name, Ip, Other}))
 	    end;
 	Other ->
-	    ?shutdown2(Node, trace({shutdown, {getaddr_failed, Other}}))
+	    ?shutdown2(
+               Node,
+               trace({getaddr_failed, Driver, Address, Other}))
     end.
 
 close(Socket) ->
@@ -411,8 +421,9 @@ check_ip(Driver, SslSocket) ->
 	    case get_ifs(SslSocket) of
 		{ok, IFs, IP} ->
 		    check_ip(Driver, IFs, IP);
-		_ ->
-		    ?shutdown(no_node)
+		Other ->
+		    ?shutdown2(
+                       no_node, trace({check_ip_failed, SslSocket, Other}))
 	    end;
 	_ ->
 	    true
@@ -441,23 +452,22 @@ get_ifs(#sslsocket{fd = {gen_tcp, Socket, _}}) ->
 
 %% If Node is illegal terminate the connection setup!!
 splitnode(Driver, Node, LongOrShortNames) ->
-    case split_node(atom_to_list(Node), $@, []) of
-	[Name|Tail] when Tail =/= [] ->
-	    Host = lists:append(Tail),
+    case string:split(atom_to_list(Node), "@") of
+	[Name, Host] when Host =/= [] ->
 	    check_node(Driver, Name, Node, Host, LongOrShortNames);
 	[_] ->
 	    error_logger:error_msg(
               "** Nodename ~p illegal, no '@' character **~n",
               [Node]),
-	    ?shutdown(Node);
+	    ?shutdown2(Node, trace({illegal_node_n@me, Node}));
 	_ ->
 	    error_logger:error_msg(
               "** Nodename ~p illegal **~n", [Node]),
-	    ?shutdown(Node)
+	    ?shutdown2(Node, trace({illegal_node_name, Node}))
     end.
 
 check_node(Driver, Name, Node, Host, LongOrShortNames) ->
-    case split_node(Host, $., []) of
+    case string:split(Host, ".") of
 	[_] when LongOrShortNames == longnames ->
 	    case Driver:parse_address(Host) of
 		{ok, _} ->
@@ -468,35 +478,28 @@ check_node(Driver, Name, Node, Host, LongOrShortNames) ->
                       "fully qualified hostnames **~n"
                       "** Hostname ~s is illegal **~n",
                       [Host]),
-		    ?shutdown(Node)
+		    ?shutdown2(Node, trace({not_longnames, Host}))
 	    end;
-	[_, _ | _] when LongOrShortNames == shortnames ->
+	[_, _] when LongOrShortNames == shortnames ->
 	    error_logger:error_msg(
               "** System NOT running to use "
               "fully qualified hostnames **~n"
               "** Hostname ~s is illegal **~n",
               [Host]),
-	    ?shutdown(Node);
+	    ?shutdown2(Node, trace({not_shortnames, Host}));
 	_ ->
 	    [Name, Host]
     end.
 
 split_node(Node) when is_atom(Node) ->
-    case split_node(atom_to_list(Node), $@, []) of
-        [_, Host] ->
+    case string:split(atom_to_list(Node), "@") of
+        [Name, Host] when Name =/= [], Host =/= [] ->
             Host;
         _ ->
             false
     end;
 split_node(_) ->
     false.
-%%
-split_node([Chr|T], Chr, Ack) -> 
-    [lists:reverse(Ack)|split_node(T, Chr, [])];
-split_node([H|T], Chr, Ack) -> 
-    split_node(T, Chr, [H|Ack]);
-split_node([], _, Ack) -> 
-    [lists:reverse(Ack)].
 
 %% -------------------------------------------------------------------------
 
@@ -524,6 +527,17 @@ nodelay() ->
 
 
 get_ssl_options(Type) ->
+    try ets:lookup(ssl_dist_opts, Type) of
+        [{Type, Opts}] ->
+            [{erl_dist, true} | Opts];
+        _ ->
+            get_ssl_dist_arguments(Type)
+    catch
+        error:badarg ->
+            get_ssl_dist_arguments(Type)
+    end.
+
+get_ssl_dist_arguments(Type) ->
     case init:get_argument(ssl_dist_opt) of
 	{ok, Args} ->
 	    [{erl_dist, true} | ssl_options(Type, lists:append(Args))];
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 4007e44a83..4bff9fdf39 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -992,17 +992,21 @@ validate_option(next_protocols_advertised, Value) when is_list(Value) ->
     Value;
 validate_option(next_protocols_advertised, undefined) ->
     undefined;
-validate_option(server_name_indication = Opt, Value) when is_list(Value) ->
+validate_option(server_name_indication, Value) when is_list(Value) ->
     %% RFC 6066, Section 3: Currently, the only server names supported are
     %% DNS hostnames
-     case inet_parse:domain(Value) of
-        false -> 
-           throw({error, {options, {{Opt, Value}}}});
-        true -> 
-            Value
-     end;
-validate_option(server_name_indication, undefined = Value) ->
+    %% case inet_parse:domain(Value) of
+    %%     false ->
+    %%         throw({error, {options, {{Opt, Value}}}});
+    %%     true ->
+    %%         Value
+    %% end;
+    %%
+    %% But the definition seems very diffuse, so let all strings through
+    %% and leave it up to public_key to decide...
     Value;
+validate_option(server_name_indication, undefined) ->
+    undefined;
 validate_option(server_name_indication, disable) ->
     disable;
 
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index 5d6428a4e0..b9b463eeb6 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -49,7 +49,7 @@
 
 %% Alert and close handling
 -export([handle_own_alert/4, handle_alert/3, 
-	 handle_normal_shutdown/3 
+	 handle_normal_shutdown/3, stop/2, stop_and_reply/3
 	]).
 
 %% Data handling
@@ -316,7 +316,7 @@ handle_own_alert(Alert, Version, StateName,
     catch _:_ ->
 	    ok
     end,
-    {stop, {shutdown, own_alert}}.
+    stop({shutdown, own_alert}, State).
 
 handle_normal_shutdown(Alert, _, #state{socket = Socket,
 					transport_cb = Transport,
@@ -340,24 +340,24 @@ handle_alert(#alert{level = ?FATAL} = Alert, StateName,
 		    protocol_cb = Connection,
 		    ssl_options = SslOpts, start_or_recv_from = From, host = Host,
 		    port = Port, session = Session, user_application = {_Mon, Pid},
-		    role = Role, socket_options = Opts, tracker = Tracker}) ->
+		    role = Role, socket_options = Opts, tracker = Tracker} = State) ->
     invalidate_session(Role, Host, Port, Session),
     log_alert(SslOpts#ssl_options.log_alert, Role, Connection:protocol_name(), 
               StateName, Alert#alert{role = opposite_role(Role)}),
     alert_user(Transport, Tracker, Socket, StateName, Opts, Pid, From, Alert, Role, Connection),
-    {stop, normal};
+    stop(normal, State);
 
 handle_alert(#alert{level = ?WARNING, description = ?CLOSE_NOTIFY} = Alert, 
 	     StateName, State) -> 
     handle_normal_shutdown(Alert, StateName, State),
-    {stop, {shutdown, peer_close}};
+    stop({shutdown, peer_close}, State);
 
 handle_alert(#alert{level = ?WARNING, description = ?NO_RENEGOTIATION} = Alert, StateName, 
 	     #state{role = Role, ssl_options = SslOpts, protocol_cb = Connection, renegotiation = {true, internal}} = State) ->
     log_alert(SslOpts#ssl_options.log_alert, Role, 
               Connection:protocol_name(), StateName, Alert#alert{role = opposite_role(Role)}),
     handle_normal_shutdown(Alert, StateName, State),
-    {stop, {shutdown, peer_close}};
+    stop({shutdown, peer_close}, State);
 
 handle_alert(#alert{level = ?WARNING, description = ?NO_RENEGOTIATION} = Alert, StateName, 
 	     #state{role = Role,
@@ -404,7 +404,7 @@ write_application_data(Data0, {FromPid, _} = From,
                 ok when FromPid =:= self() ->
                     hibernate_after(connection, NewState, []);
                 Error when FromPid =:= self() ->
-                    {stop, {shutdown, Error}, NewState};
+                    stop({shutdown, Error}, NewState);
                 ok ->
                     hibernate_after(connection, NewState, [{reply, From, ok}]);
                 Result ->
@@ -446,8 +446,8 @@ read_application_data(Data, #state{user_application = {_Mon, Pid},
                             Connection:next_record_if_active(State);
                         _ -> %% We have more data
                             read_application_data(<<>>, State)
-                    catch _:Reason ->
-                            death_row(State, Reason)
+                    catch error:_ ->
+                            death_row(State, disconnect)
                     end;
                 _ ->
                     SocketOpt =
@@ -479,7 +479,7 @@ read_application_data(Data, #state{user_application = {_Mon, Pid},
 	    Connection:next_record_if_active(State0#state{user_data_buffer = Buffer});
 	{error,_Reason} -> %% Invalid packet in packet mode
 	    deliver_packet_error(Transport, Socket, SOpts, Buffer1, Pid, RecvFrom, Tracker, Connection),
-            stop_normal(State0)
+            stop(normal, State0)
     end.
 %%====================================================================
 %% Help functions for tls|dtls_connection.erl
@@ -581,7 +581,7 @@ init({call, From}, {start, {Opts, EmOpts}, Timeout},
 	init({call, From}, {start, Timeout}, 
 	     State#state{ssl_options = SslOpts, socket_options = new_emulated(EmOpts, SockOpts)}, Connection)
     catch throw:Error ->
-	    {stop_and_reply, normal, {reply, From, {error, Error}}}
+	    stop_and_reply(normal, {reply, From, {error, Error}}, State0)
     end;
 init({call, From}, Msg, State, Connection) ->
     handle_call(Msg, From, ?FUNCTION_NAME, State, Connection);
@@ -966,7 +966,7 @@ connection({call, {FromPid, _} = From}, {application_data, Data},
      catch throw:Error ->
              case self() of
                  FromPid ->
-                     {stop, {shutdown, Error}};
+                     stop({shutdown, Error}, State);
                  _ ->
                      hibernate_after(
                        ?FUNCTION_NAME, State, [{reply, From, Error}])
@@ -1017,8 +1017,8 @@ connection(
                       ProtocolSpecific#{d_handle => DHandle}},
             {Record, NewerState} = Connection:next_record_if_active(NewState),
             Connection:next_event(connection, Record, NewerState, [{reply, From, ok}])
-    catch _:Reason ->
-            death_row(State, Reason)
+    catch error:_ ->
+            death_row(State, disconnect)
     end;
 connection({call, From}, Msg, State, Connection) ->
     handle_call(Msg, From, ?FUNCTION_NAME, State, Connection);
@@ -1030,10 +1030,24 @@ connection(
   _) ->
     eat_msgs(Msg),
     try send_dist_data(?FUNCTION_NAME, State, DHandle, [])
-    catch _:Reason ->
-            death_row(State, Reason)
+    catch error:_ ->
+            death_row(State, disconnect)
     end;
 connection(
+  info, {send, From, Ref, Data},
+  #state{
+     ssl_options = #ssl_options{erl_dist = true},
+     protocol_specific = #{d_handle := _}},
+  _) ->
+    %% This is for testing only!
+    %%
+    %% Needed by some OTP distribution
+    %% test suites...
+    From ! {Ref, ok},
+    {keep_state_and_data,
+     [{next_event, {call, {self(), undefined}},
+       {application_data, iolist_to_binary(Data)}}]};
+connection(
   info, tick = Msg,
   #state{
      ssl_options = #ssl_options{erl_dist = true},
@@ -1058,20 +1072,22 @@ connection(Type, Msg, State, Connection) ->
 %% or the socket may die too
 death_row(
   info, {'DOWN', MonitorRef, _, _, Reason},
-  #state{user_application={MonitorRef,_Pid} = State},
+  #state{user_application={MonitorRef,_Pid}},
   _) ->
-    {stop, {shutdown, Reason}, State};
+    {stop, {shutdown, Reason}};
 death_row(
-  info, {'EXIT', Socket, Reason}, #state{socket = Socket} = State, _) ->
-    {stop, {shutdown, Reason}, State};
+  info, {'EXIT', Socket, Reason}, #state{socket = Socket}, _) ->
+    {stop, {shutdown, Reason}};
 death_row(state_timeout, Reason, _State, _Connection) ->
     {stop, {shutdown,Reason}};
-death_row(_Type, _Msg, State, _Connection) ->
-    {keep_state, State, [postpone]}.
+death_row(_Type, _Msg, _State, _Connection) ->
+    %% Waste all other events
+    keep_state_and_data.
 
 %% State entry function
 death_row(State, Reason) ->
-    {next_state, death_row, State, [{state_timeout, 5000, Reason}]}.
+    {next_state, death_row, State,
+     [{state_timeout, 5000, Reason}]}.
 
 %%--------------------------------------------------------------------
 -spec downgrade(gen_statem:event_type(), term(), 
@@ -1084,10 +1100,10 @@ downgrade(internal, #alert{description = ?CLOSE_NOTIFY},
     tls_socket:setopts(Transport, Socket, [{active, false}, {packet, 0}, {mode, binary}]),
     Transport:controlling_process(Socket, Pid),
     gen_statem:reply(From, {ok, Socket}),
-    stop_normal(State);
+    stop(normal, State);
 downgrade(timeout, downgrade, #state{downgrade = {_, From}} = State, _) ->
     gen_statem:reply(From, {error, timeout}),
-    stop_normal(State);
+    stop(normal, State);
 downgrade(Type, Event, State, Connection) ->
     handle_common_event(Type, Event, ?FUNCTION_NAME, State, Connection).
 
@@ -1102,7 +1118,7 @@ handle_common_event(internal, {handshake, {#hello_request{} = Handshake, _}}, co
 handle_common_event(internal, {handshake, {#hello_request{}, _}}, StateName, #state{role = client}, _) 
   when StateName =/= connection ->
     {keep_state_and_data};
-handle_common_event(internal, {handshake, {Handshake, Raw}}, StateName, 
+handle_common_event(internal, {handshake, {Handshake, Raw}}, StateName,
 		    #state{tls_handshake_history = Hs0,
 			   ssl_options = #ssl_options{v2_hello_compatible = V2HComp}} = State0, 
 		    Connection) ->
@@ -1121,8 +1137,8 @@ handle_common_event(timeout, hibernate, _, _, _) ->
     {keep_state_and_data, [hibernate]};
 handle_common_event(internal, {application_data, Data}, StateName, State0, Connection) ->
     case read_application_data(Data, State0) of
-	{stop, Reason, State} ->
-   	    {stop, Reason, State};
+	{stop, _, _} = Stop->
+            Stop;
 	{Record, State} ->
    	    Connection:next_event(StateName, Record, State)
     end;
@@ -1151,8 +1167,9 @@ handle_call({close, _} = Close, From, StateName, State, Connection) ->
     %% Run terminate before returning so that the reuseaddr
     %% inet-option works properly
     Result = Connection:terminate(Close, StateName, State#state{terminated = true}),
-    {stop_and_reply, {shutdown, normal},  
-     {reply, From, Result}, State};
+    stop_and_reply(
+      {shutdown, normal},
+      {reply, From, Result}, State);
 handle_call({shutdown, How0}, From, _,
 	    #state{transport_cb = Transport,
 		   negotiated_version = Version,
@@ -1173,7 +1190,7 @@ handle_call({shutdown, How0}, From, _,
 	    {keep_state_and_data, [{reply, From, ok}]};
 	Error ->
 	    gen_statem:reply(From, {error, Error}),
-            stop_normal(State)
+            stop(normal, State)
     end;
 handle_call({recv, _N, _Timeout}, From, _,  
 		  #state{socket_options = 
@@ -1253,33 +1270,50 @@ handle_info({ErrorTag, Socket, econnaborted}, StateName,
 		   tracker = Tracker} = State)  when StateName =/= connection ->
     alert_user(Transport, Tracker,Socket, 
 	       StartFrom, ?ALERT_REC(?FATAL, ?CLOSE_NOTIFY), Role, Connection),
-    stop_normal(State);
+    stop(normal, State);
 
 handle_info({ErrorTag, Socket, Reason}, StateName, #state{socket = Socket,
 							  error_tag = ErrorTag} = State)  ->
     Report = io_lib:format("SSL: Socket error: ~p ~n", [Reason]),
     error_logger:error_report(Report),
     handle_normal_shutdown(?ALERT_REC(?FATAL, ?CLOSE_NOTIFY), StateName, State),
-    stop_normal(State);
+    stop(normal, State);
 
 handle_info(
+  {'DOWN', MonitorRef, _, _, Reason}, _,
+  #state{
+     user_application = {MonitorRef, _Pid},
+     ssl_options = #ssl_options{erl_dist = true}}) ->
+    {stop, {shutdown, Reason}};
+handle_info(
   {'DOWN', MonitorRef, _, _, _}, _,
-  #state{user_application={MonitorRef,_Pid}} = State) ->
-    stop_normal(State);
+  #state{user_application = {MonitorRef, _Pid}}) ->
+    {stop, normal};
+handle_info(
+  {'EXIT', Pid, _Reason}, StateName,
+  #state{user_application = {_MonitorRef, Pid}} = State) ->
+    %% It seems the user application has linked to us
+    %% - ignore that and let the monitor handle this
+    {next_state, StateName, State};
+
 %%% So that terminate will be run when supervisor issues shutdown
 handle_info({'EXIT', _Sup, shutdown}, _StateName, State) ->
-    {stop, shutdown, State};
+    stop(shutdown, State);
 handle_info({'EXIT', Socket, normal}, _StateName, #state{socket = Socket} = State) ->
     %% Handle as transport close"
-    {stop, {shutdown, transport_closed}, State};
+    stop({shutdown, transport_closed}, State);
 handle_info({'EXIT', Socket, Reason}, _StateName, #state{socket = Socket} = State) ->
-    {stop, {shutdown, Reason}, State};
+    stop({shutdown, Reason}, State);
+
 handle_info(allow_renegotiate, StateName, State) ->
     {next_state, StateName, State#state{allow_renegotiate = true}};
+
 handle_info({cancel_start_or_recv, StartFrom}, StateName,
 	    #state{renegotiation = {false, first}} = State) when StateName =/= connection ->
-    {stop_and_reply, {shutdown, user_timeout},  
-     {reply, StartFrom, {error, timeout}}, State#state{timer = undefined}};
+    stop_and_reply(
+      {shutdown, user_timeout},
+      {reply, StartFrom, {error, timeout}},
+      State#state{timer = undefined});
 handle_info({cancel_start_or_recv, RecvFrom}, StateName, 
 	    #state{start_or_recv_from = RecvFrom} = State) when RecvFrom =/= undefined ->
     {next_state, StateName, State#state{start_or_recv_from = undefined,
@@ -2423,8 +2457,8 @@ handle_active_option(_, connection = StateName0, To, Reply, #state{protocol_cb =
 	    hibernate_after(StateName, State, [{reply, To, Reply}]);
 	{next_state, StateName, State, Actions} -> 
 	    hibernate_after(StateName, State, [{reply, To, Reply} | Actions]);
-	{stop, Reason, State} ->
-	    {stop, Reason, State}
+	{stop, _, _} = Stop ->
+	    Stop
     end;
 handle_active_option(_, StateName, To, Reply, #state{user_data_buffer = <<>>} = State) ->
     %% Active once already set 
@@ -2433,8 +2467,8 @@ handle_active_option(_, StateName, To, Reply, #state{user_data_buffer = <<>>} =
 %% user_data_buffer =/= <<>>
 handle_active_option(_, StateName0, To, Reply, #state{protocol_cb = Connection} = State0) -> 
     case read_application_data(<<>>, State0) of
-	{stop, Reason, State} ->
-	    {stop, Reason, State};
+	{stop, _, _} = Stop ->
+	    Stop;
 	{Record, State1} ->
 	    %% Note: Renogotiation may cause StateName0 =/= StateName
 	    case Connection:next_event(StateName0, Record, State1) of
@@ -2592,7 +2626,8 @@ send_or_reply(_, Pid, _From, Data) ->
     send_user(Pid, Data).
 
 send_user(Pid, Msg) ->
-    Pid ! Msg.
+    Pid ! Msg,
+    ok.
 
 alert_user(Transport, Tracker, Socket, connection, Opts, Pid, From, Alert, Role, Connection) ->
     alert_user(Transport, Tracker, Socket, Opts#socket_options.active, Pid, From, Alert, Role, Connection);
@@ -2705,14 +2740,22 @@ eat_msgs(Msg) ->
     after 0 -> ok
     end.
 
-%% When running with erl_dist the stop reason 'normal'
-%% would be too silent and prevent cleanup
-stop_normal(State) ->
-    Reason =
-        case State of
-            #state{ssl_options = #ssl_options{erl_dist = true}} ->
-                {shutdown, normal};
-            _ ->
-                normal
-        end,
-    {stop, Reason, State}.
+%% When acting as distribution controller map the exit reason
+%% to follow the documented nodedown_reason for net_kernel
+stop(Reason, State) ->
+    {stop, erl_dist_stop_reason(Reason, State), State}.
+
+stop_and_reply(Reason, Replies, State) ->
+    {stop_and_reply, erl_dist_stop_reason(Reason, State), Replies, State}.
+
+erl_dist_stop_reason(
+  Reason, #state{ssl_options = #ssl_options{erl_dist = true}}) ->
+    case Reason of
+        normal ->
+            %% We can not exit with normal since that will not bring
+            %% down the rest of the distribution processes
+            {shutdown, normal};
+        _ -> Reason
+    end;
+erl_dist_stop_reason(Reason, _State) ->
+    Reason.
diff --git a/lib/ssl/src/ssl_dist_sup.erl b/lib/ssl/src/ssl_dist_sup.erl
index c241a9bced..bea67935d8 100644
--- a/lib/ssl/src/ssl_dist_sup.erl
+++ b/lib/ssl/src/ssl_dist_sup.erl
@@ -30,6 +30,9 @@
 %% Supervisor callback
 -export([init/1]).
 
+%% Debug
+-export([consult/1]).
+
 %%%=========================================================================
 %%%  API
 %%%=========================================================================
@@ -37,7 +40,18 @@
 -spec start_link() -> {ok, pid()} | ignore | {error, term()}.
 			
 start_link() ->
-    supervisor:start_link({local, ?MODULE}, ?MODULE, []).
+    case init:get_argument(ssl_dist_optfile) of
+        {ok, [File]} ->
+            DistOpts = consult(File),
+            TabOpts = [set, protected, named_table],
+            Tab = ets:new(ssl_dist_opts, TabOpts),
+            true = ets:insert(Tab, DistOpts),
+            supervisor:start_link({local, ?MODULE}, ?MODULE, []);
+        {ok, BadArg} ->
+            error({bad_ssl_dist_optfile, BadArg});
+        error ->
+            supervisor:start_link({local, ?MODULE}, ?MODULE, [])
+    end.
 
 %%%=========================================================================
 %%%  Supervisor callback
@@ -68,3 +82,52 @@ ssl_connection_sup() ->
     Modules = [ssl_connection_sup],
     Type = supervisor,
     {Name, StartFunc, Restart, Shutdown, Type, Modules}.
+
+consult(File) ->
+    case erl_prim_loader:get_file(File) of
+        {ok, Binary, _FullName} ->
+            Encoding =
+                case epp:read_encoding_from_binary(Binary) of
+                    none -> latin1;
+                    Enc -> Enc
+                end,
+            case unicode:characters_to_list(Binary, Encoding) of
+                {error, _String, Rest} ->
+                    error(
+                      {bad_ssl_dist_optfile, {encoding_error, Rest}});
+                {incomplete, _String, Rest} ->
+                    error(
+                      {bad_ssl_dist_optfile, {encoding_incomplete, Rest}});
+                String when is_list(String) ->
+                    consult_string(String)
+            end;
+        error ->
+            error({bad_ssl_dist_optfile, File})
+    end.
+
+consult_string(String) ->
+    case erl_scan:string(String) of
+        {error, Info, Location} ->
+            error({bad_ssl_dist_optfile, {scan_error, Info, Location}});
+        {ok, Tokens, _EndLocation} ->
+            consult_tokens(Tokens)
+    end.
+
+consult_tokens(Tokens) ->
+    case erl_parse:parse_exprs(Tokens) of
+        {error, Info} ->
+            error({bad_ssl_dist_optfile, {parse_error, Info}});
+        {ok, [Expr]} ->
+            consult_expr(Expr);
+        {ok, Other} ->
+            error({bad_ssl_dist_optfile, {parse_error, Other}})
+    end.
+
+consult_expr(Expr) ->
+    {value, Value, Bs} = erl_eval:expr(Expr, erl_eval:new_bindings()),
+    case erl_eval:bindings(Bs) of
+        [] ->
+            Value;
+        Other ->
+            error({bad_ssl_dist_optfile, {bindings, Other}})
+    end.
diff --git a/lib/ssl/src/tls_connection.erl b/lib/ssl/src/tls_connection.erl
index f1db75d5e9..406a095d2e 100644
--- a/lib/ssl/src/tls_connection.erl
+++ b/lib/ssl/src/tls_connection.erl
@@ -437,7 +437,8 @@ init(Type, Event, State) ->
 %%--------------------------------------------------------------------
 
 error({call, From}, {start, _Timeout}, {Error, State}) ->
-    {stop_and_reply, normal, {reply, From, {error, Error}}, State};
+    ssl_connection:stop_and_reply(
+      normal, {reply, From, {error, Error}}, State);
 error({call, _} = Call, Msg, State) ->
     gen_handshake(?FUNCTION_NAME, Call, Msg, State);
 error(_, _, _) ->
@@ -659,7 +660,7 @@ handle_info({Protocol, _, Data}, StateName,
 	    next_event(StateName, Record, State);
 	#alert{} = Alert ->
 	    ssl_connection:handle_normal_shutdown(Alert, StateName, State0), 
-	    {stop, {shutdown, own_alert}}
+	    ssl_connection:stop({shutdown, own_alert}, State0)
     end;
 handle_info({CloseTag, Socket}, StateName,
             #state{socket = Socket, close_tag = CloseTag,
@@ -686,7 +687,7 @@ handle_info({CloseTag, Socket}, StateName,
             end,
 
             ssl_connection:handle_normal_shutdown(?ALERT_REC(?FATAL, ?CLOSE_NOTIFY), StateName, State),
-            {stop, {shutdown, transport_closed}};
+            ssl_connection:stop({shutdown, transport_closed}, State);
         true ->
             %% Fixes non-delivery of final TLS record in {active, once}.
             %% Basically allows the application the opportunity to set {active, once} again
@@ -698,7 +699,7 @@ handle_info(Msg, StateName, State) ->
 
 handle_alerts([], Result) ->
     Result;
-handle_alerts(_, {stop,_} = Stop) ->
+handle_alerts(_, {stop, _, _} = Stop) ->
     Stop;
 handle_alerts([Alert | Alerts], {next_state, StateName, State}) ->
      handle_alerts(Alerts, ssl_connection:handle_alert(Alert, StateName, State));
diff --git a/lib/ssl/test/Makefile b/lib/ssl/test/Makefile
index aa01552c39..9347b56f39 100644
--- a/lib/ssl/test/Makefile
+++ b/lib/ssl/test/Makefile
@@ -37,6 +37,8 @@ VSN=$(GS_VSN)
 
 MODULES = \
 	ssl_test_lib \
+	ssl_bench_test_lib \
+	ssl_dist_test_lib \
 	ssl_alpn_handshake_SUITE \
 	ssl_basic_SUITE \
 	ssl_bench_SUITE \
@@ -44,6 +46,7 @@ MODULES = \
 	ssl_certificate_verify_SUITE\
 	ssl_crl_SUITE\
 	ssl_dist_SUITE \
+	ssl_dist_bench_SUITE \
 	ssl_engine_SUITE\
 	ssl_handshake_SUITE \
 	ssl_npn_hello_SUITE \
@@ -62,7 +65,8 @@ MODULES = \
 
 ERL_FILES = $(MODULES:%=%.erl)
 
-HRL_FILES =
+HRL_FILES = \
+	ssl_dist_test_lib.hrl
 
 HRL_FILES_SRC = \
 	ssl_api.hrl\
diff --git a/lib/ssl/test/ssl.spec b/lib/ssl/test/ssl.spec
index 0ad94e22bc..17b66aef40 100644
--- a/lib/ssl/test/ssl.spec
+++ b/lib/ssl/test/ssl.spec
@@ -3,3 +3,6 @@
     ssl_bench_SUITE, [setup_sequential, setup_concurrent, payload_simple,
 	use_pem_cache, bypass_pem_cache],
     "Benchmarks run separately"}.
+{skip_suites, "../ssl_test",
+     [ssl_dist_bench_SUITE],
+     "Benchmarks run separately"}.
diff --git a/lib/ssl/test/ssl_bench.spec b/lib/ssl/test/ssl_bench.spec
index d2f75b4203..8b746c5ca9 100644
--- a/lib/ssl/test/ssl_bench.spec
+++ b/lib/ssl/test/ssl_bench.spec
@@ -1 +1 @@
-{suites,"../ssl_test",[ssl_bench_SUITE]}.
+{suites,"../ssl_test",[ssl_bench_SUITE, ssl_dist_bench_SUITE]}.
diff --git a/lib/ssl/test/ssl_bench_SUITE.erl b/lib/ssl/test/ssl_bench_SUITE.erl
index ae2928b1c3..3fe6338d69 100644
--- a/lib/ssl/test/ssl_bench_SUITE.erl
+++ b/lib/ssl/test/ssl_bench_SUITE.erl
@@ -40,11 +40,11 @@ end_per_group(_GroupName, _Config) ->
     ok.
 
 init_per_suite(Config) ->
-    try
-	Server = setup(ssl, node()),
-	[{server_node, Server}|Config]
-    catch _:_ ->
-	    {skipped, "Benchmark machines only"}
+    case node() of
+        nonode@nohost ->
+            {skipped, "Node not distributed"};
+        _ ->
+            [{server_node, ssl_bench_test_lib:setup(perf_server)}|Config]
     end.
 
 end_per_suite(_Config) ->
@@ -132,10 +132,10 @@ bypass_pem_cache(_Config) ->
 
 
 ssl() ->
-    test(ssl, ?COUNT, node()).
+    test(ssl, ?COUNT).
 
-test(Type, Count, Host) ->
-    Server = setup(Type, Host),
+test(Type, Count) ->
+    Server = ssl_bench_test_lib:setup(perf_server),
     (do_test(Type, setup_connection, Count * 20, 1, Server)),
     (do_test(Type, setup_connection, Count, 100, Server)),
     (do_test(Type, payload, Count*300, 10, Server)),
@@ -294,47 +294,6 @@ msg() ->
       "asdlkjsafsdfoierwlejsdlkfjsdf">>.
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-setup(_Type, nonode@nohost) ->
-    exit(dist_not_enabled);
-setup(Type, _This) ->
-    Host = case os:getenv(?remote_host) of
-	       false ->
-		   {ok, This} = inet:gethostname(),
-		   This;
-	       RemHost ->
-		   RemHost
-	   end,
-    Node = list_to_atom("perf_server@" ++ Host),
-    SlaveArgs = case init:get_argument(pa) of
-	       {ok, PaPaths} ->
-		   lists:append([" -pa " ++ P || [P] <- PaPaths]);
-	       _ -> []
-	   end,
-    %% io:format("Slave args: ~p~n",[SlaveArgs]),
-    Prog =
-	case os:find_executable("erl") of
-	    false -> "erl";
-	    P -> P
-	end,
-    io:format("Prog = ~p~n", [Prog]),
-
-    case net_adm:ping(Node) of
-	pong -> ok;
-	pang ->
-	    {ok, Node} = slave:start(Host, perf_server, SlaveArgs, no_link, Prog)
-    end,
-    Path = code:get_path(),
-    true = rpc:call(Node, code, set_path, [Path]),
-    ok = rpc:call(Node, ?MODULE, setup_server, [Type, node()]),
-    io:format("Client (~p) using ~s~n",[node(), code:which(ssl)]),
-    (Node =:= node()) andalso restrict_schedulers(client),
-    Node.
-
-setup_server(_Type, ClientNode) ->
-    (ClientNode =:= node()) andalso restrict_schedulers(server),
-    io:format("Server (~p) using ~s~n",[node(), code:which(ssl)]),
-    ok.
-
 
 ensure_all_started(App, Ack) ->
     case application:start(App) of
@@ -358,13 +317,6 @@ setup_server_init(Type, Tc, Loop, PC) ->
     unlink(Pid),
     Res.
 
-restrict_schedulers(Type) ->
-    %% We expect this to run on 8 core machine
-    Extra0 = 1,
-    Extra =  if (Type =:= server) -> -Extra0; true -> Extra0 end,
-    Scheds = erlang:system_info(schedulers),
-    erlang:system_flag(schedulers_online, (Scheds div 2) + Extra).
-
 tc(Fun, Mod, Line) ->
     case timer:tc(Fun) of
 	{_,{'EXIT',Reason}} ->
diff --git a/lib/ssl/test/ssl_bench_test_lib.erl b/lib/ssl/test/ssl_bench_test_lib.erl
new file mode 100644
index 0000000000..e5cbb911bd
--- /dev/null
+++ b/lib/ssl/test/ssl_bench_test_lib.erl
@@ -0,0 +1,75 @@
+%%%-------------------------------------------------------------------
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2017. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%%
+%% %CopyrightEnd%
+%%
+-module(ssl_bench_test_lib).
+
+%% API
+-export([setup/1]).
+
+%% Internal exports
+-export([setup_server/1]).
+
+-define(remote_host, "NETMARKS_REMOTE_HOST").
+
+setup(Name) ->
+    Host = case os:getenv(?remote_host) of
+	       false ->
+		   {ok, This} = inet:gethostname(),
+		   This;
+	       RemHost ->
+		   RemHost
+	   end,
+    Node = list_to_atom(atom_to_list(Name) ++ "@" ++ Host),
+    SlaveArgs = case init:get_argument(pa) of
+	       {ok, PaPaths} ->
+		   lists:append([" -pa " ++ P || [P] <- PaPaths]);
+	       _ -> []
+	   end,
+    %% io:format("Slave args: ~p~n",[SlaveArgs]),
+    Prog =
+	case os:find_executable("erl") of
+	    false -> "erl";
+	    P -> P
+	end,
+    io:format("Prog = ~p~n", [Prog]),
+
+    case net_adm:ping(Node) of
+	pong -> ok;
+	pang ->
+	    {ok, Node} =
+                slave:start(Host, Name, SlaveArgs, no_link, Prog)
+    end,
+    Path = code:get_path(),
+    true = rpc:call(Node, code, set_path, [Path]),
+    ok = rpc:call(Node, ?MODULE, setup_server, [node()]),
+    io:format("Client (~p) using ~s~n",[node(), code:which(ssl)]),
+    (Node =:= node()) andalso restrict_schedulers(client),
+    Node.
+
+setup_server(ClientNode) ->
+    (ClientNode =:= node()) andalso restrict_schedulers(server),
+    io:format("Server (~p) using ~s~n",[node(), code:which(ssl)]),
+    ok.
+
+restrict_schedulers(Type) ->
+    %% We expect this to run on 8 core machine
+    Extra0 = 1,
+    Extra =  if (Type =:= server) -> -Extra0; true -> Extra0 end,
+    Scheds = erlang:system_info(schedulers),
+    erlang:system_flag(schedulers_online, (Scheds div 2) + Extra).
diff --git a/lib/ssl/test/ssl_dist_SUITE.erl b/lib/ssl/test/ssl_dist_SUITE.erl
index 8740e8c8f0..c822a52d1f 100644
--- a/lib/ssl/test/ssl_dist_SUITE.erl
+++ b/lib/ssl/test/ssl_dist_SUITE.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2007-2016. All Rights Reserved.
+%% Copyright Ericsson AB 2007-2017. All Rights Reserved.
 %%
 %% Licensed under the Apache License, Version 2.0 (the "License");
 %% you may not use this file except in compliance with the License.
@@ -22,6 +22,7 @@
 
 -include_lib("common_test/include/ct.hrl").
 -include_lib("public_key/include/public_key.hrl").
+-include("ssl_dist_test_lib.hrl").
 
 %% Note: This directive should only be used in test suites.
 -compile(export_all).
@@ -30,12 +31,12 @@
 
 -define(AWAIT_SSL_NODE_UP_TIMEOUT, 30000).
 
--record(node_handle,
-	{connection_handler,
-	 socket,
-	 name,
-	 nodename}
-       ).
+-import(ssl_dist_test_lib,
+        [tstsrvr_format/2, send_to_tstcntrl/1,
+         apply_on_ssl_node/4, apply_on_ssl_node/2,
+         stop_ssl_node/1]).
+start_ssl_node_name(Name, Args) ->
+    ssl_dist_test_lib:start_ssl_node(Name, Args).
 
 %%--------------------------------------------------------------------
 %% Common Test interface functions -----------------------------------
@@ -140,11 +141,14 @@ basic_test(NH1, NH2, _) ->
 		  apply_on_ssl_node(
 		    NH1,
 		    fun () ->
-			    tstsrvr_format("Hi from ~p!~n", [node()]),
-			    send_to_tstcntrl({Ref, self()}),
+			    tstsrvr_format(
+                              "Hi from ~p!~n", [node()]),
+			    send_to_tstcntrl(
+                              {Ref, self()}),
 			    receive
 				{From, ping} ->
-				    tstsrvr_format("Received ping ~p!~n", [node()]),
+				    tstsrvr_format(
+                                      "Received ping ~p!~n", [node()]),
 				    From ! {self(), pong}
 			    end
 		    end)
@@ -154,7 +158,8 @@ basic_test(NH1, NH2, _) ->
 	     ok = apply_on_ssl_node(
 		    NH2,
 		    fun () ->
-			    tstsrvr_format("Hi from ~p!~n", [node()]),
+			    tstsrvr_format(
+                              "Hi from ~p!~n", [node()]),
 			    SslPid ! {self(), ping},
 			    receive
 				{SslPid, pong} ->
@@ -183,7 +188,8 @@ payload_test(NH1, NH2, _) ->
 		  apply_on_ssl_node(
 		    NH1,
 		    fun () ->
-			    send_to_tstcntrl({Ref, self()}),
+			    send_to_tstcntrl(
+                              {Ref, self()}),
 			    receive
 				{From, Msg} ->
 				    From ! {self(), Msg}
@@ -616,12 +622,6 @@ gen_dist_test(Test, Config) ->
 %% ssl_node side api
 %%
 
-tstsrvr_format(Fmt, ArgList) ->
-    send_to_tstsrvr({format, Fmt, ArgList}).
-
-send_to_tstcntrl(Message) ->
-    send_to_tstsrvr({message, Message}).
-
 try_setting_priority(TestFun, Config) ->
     Prio = 1,
     case gen_udp:open(0, [{priority,Prio}]) of
@@ -653,44 +653,6 @@ inet_ports() ->
 %% test_server side api
 %%
 
-apply_on_ssl_node(Node, M, F, A) when is_atom(M), is_atom(F), is_list(A) ->
-    Ref = make_ref(),
-    send_to_ssl_node(Node, {apply, self(), Ref, M, F, A}),
-    receive
-	{Ref, Result} ->
-	    Result
-    end.
-
-apply_on_ssl_node(Node, Fun) when is_function(Fun, 0) ->
-    Ref = make_ref(),
-    send_to_ssl_node(Node, {apply, self(), Ref, Fun}),
-    receive
-	{Ref, Result} ->
-	    Result
-    end.
-
-stop_ssl_node(#node_handle{connection_handler = Handler,
-			   socket = Socket,
-			   name = Name}) ->
-    ?t:format("Trying to stop ssl node ~s.~n", [Name]),
-    Mon = erlang:monitor(process, Handler),
-    unlink(Handler),
-    case gen_tcp:send(Socket, term_to_binary(stop)) of
-	ok ->
-	    receive
-		{'DOWN', Mon, process, Handler, Reason} ->
-		    case Reason of
-			normal ->
-			    ok;
-			_ -> 
-			    ct:pal("Down  ~p ~n", [Reason])
-		    end
-	    end;
-	Error ->
-	    erlang:demonitor(Mon, [flush]),
-	    ct:pal("Warning  ~p ~n", [Error])
-    end.
-
 start_ssl_node(Config) ->
     start_ssl_node(Config, "").
 
@@ -698,29 +660,8 @@ start_ssl_node(Config, XArgs) ->
     Name = mk_node_name(Config),
     SSL = proplists:get_value(ssl_opts, Config),
     SSLDistOpts = setup_dist_opts(Config),
-    start_ssl_node_raw(Name, SSL ++ " " ++ SSLDistOpts ++ XArgs).
-
-start_ssl_node_raw(Name, Args) ->
-    {ok, LSock} = gen_tcp:listen(0,
-				 [binary, {packet, 4}, {active, false}]),
-    {ok, ListenPort} = inet:port(LSock),
-    CmdLine = mk_node_cmdline(ListenPort, Name, Args),
-    ?t:format("Attempting to start ssl node ~ts: ~ts~n", [Name, CmdLine]),
-    case open_port({spawn, CmdLine}, []) of
-	Port when is_port(Port) ->
-	    unlink(Port),
-	    erlang:port_close(Port),
-	    case await_ssl_node_up(Name, LSock) of
-		#node_handle{} = NodeHandle ->
-		    ?t:format("Ssl node ~s started.~n", [Name]),
-		    NodeName = list_to_atom(Name ++ "@" ++ host_name()),
-		    NodeHandle#node_handle{nodename = NodeName};
-		Error ->
-		    exit({failed_to_start_node, Name, Error})
-	    end;
-	Error ->
-	    exit({failed_to_start_node, Name, Error})
-    end.
+    start_ssl_node_name(
+      Name, SSL ++ " " ++ SSLDistOpts ++ XArgs).
 
 cache_crls_on_ssl_nodes(PrivDir, CANames, NHs) ->
     [begin
@@ -739,11 +680,6 @@ cache_crls_on_ssl_nodes(PrivDir, CANames, NHs) ->
 %% command line creation
 %%
 
-host_name() ->
-    [$@ | Host] = lists:dropwhile(fun ($@) -> false; (_) -> true end,
-				  atom_to_list(node())),
-    Host.
-
 mk_node_name(Config) ->
     N = erlang:unique_integer([positive]),
     Case = proplists:get_value(testcase, Config),
@@ -753,225 +689,6 @@ mk_node_name(Config) ->
 	++ "_"
 	++ integer_to_list(N).
 
-mk_node_cmdline(ListenPort, Name, Args) ->
-    Static = "-detached -noinput",
-    Pa = filename:dirname(code:which(?MODULE)),
-    Prog = case catch init:get_argument(progname) of
-	       {ok,[[P]]} -> P;
-	       _ -> exit(no_progname_argument_found)
-	   end,
-    NameSw = case net_kernel:longnames() of
-		 false -> "-sname ";
-		 _ -> "-name "
-	     end,
-    {ok, Pwd} = file:get_cwd(),
-    "\"" ++ Prog ++ "\" "
-	++ Static ++ " "
-	++ NameSw ++ " " ++ Name ++ " "
-	++ "-pa " ++ Pa ++ " "
-	++ "-run application start crypto -run application start public_key "
-	++ "-eval 'net_kernel:verbose(1)' "
-	++ "-run " ++ atom_to_list(?MODULE) ++ " cnct2tstsrvr "
-	++ host_name() ++ " "
-	++ integer_to_list(ListenPort) ++ " "
-	++ Args ++ " "
-	++ "-env ERL_CRASH_DUMP " ++ Pwd ++ "/erl_crash_dump." ++ Name ++ " "
-	++ "-kernel error_logger \"{file,\\\"" ++ Pwd ++ "/error_log." ++ Name ++ "\\\"}\" "
-	++ "-setcookie " ++ atom_to_list(erlang:get_cookie()).
-
-%%
-%% Connection handler test_server side
-%%
-
-await_ssl_node_up(Name, LSock) ->
-    case gen_tcp:accept(LSock, ?AWAIT_SSL_NODE_UP_TIMEOUT) of
-	timeout ->
-	    gen_tcp:close(LSock),
-	    ?t:format("Timeout waiting for ssl node ~s to come up~n",
-		      [Name]),
-	    timeout;
-	{ok, Socket} ->
-	    gen_tcp:close(LSock),
-	    case gen_tcp:recv(Socket, 0) of
-		{ok, Bin} ->
-		    check_ssl_node_up(Socket, Name, Bin);
-		{error, closed} ->
-		    gen_tcp:close(Socket),
-		    exit({lost_connection_with_ssl_node_before_up, Name})
-	    end;
-	{error, Error} ->
-	    gen_tcp:close(LSock),
-	    exit({accept_failed, Error})
-    end.
-
-check_ssl_node_up(Socket, Name, Bin) ->
-    case catch binary_to_term(Bin) of
-	{'EXIT', _} ->
-	    gen_tcp:close(Socket),
-	    exit({bad_data_received_from_ssl_node, Name, Bin});
-	{ssl_node_up, NodeName} ->
-	    case list_to_atom(Name++"@"++host_name()) of
-		NodeName ->
-		    Parent = self(),
-		    Go = make_ref(),
-		    %% Spawn connection handler on test server side
-		    Pid = spawn_link(
-			    fun () ->
-				    receive Go -> ok end,
-				    tstsrvr_con_loop(Name, Socket, Parent)
-			    end),
-		    ok = gen_tcp:controlling_process(Socket, Pid),
-		    Pid ! Go,
-		    #node_handle{connection_handler = Pid,
-				 socket = Socket,
-				 name = Name};
-		_ ->
-		    exit({unexpected_ssl_node_connected, NodeName})
-	    end;
-	Msg ->
-	    exit({unexpected_msg_instead_of_ssl_node_up, Name, Msg})
-    end.
-
-send_to_ssl_node(#node_handle{connection_handler = Hndlr}, Term) ->
-    Hndlr ! {relay_to_ssl_node, term_to_binary(Term)},
-    ok.
-
-tstsrvr_con_loop(Name, Socket, Parent) ->
-    inet:setopts(Socket,[{active,once}]),
-    receive
-	{relay_to_ssl_node, Data} when is_binary(Data) ->
-	    case gen_tcp:send(Socket, Data) of
-		ok ->
-		    ok;
-		_Error ->
-		    gen_tcp:close(Socket),
-		    exit({failed_to_relay_data_to_ssl_node, Name, Data})
-	    end;
-	{tcp, Socket, Bin} ->
-	    case catch binary_to_term(Bin) of
-		{'EXIT', _} ->
-		    gen_tcp:close(Socket),
-		    exit({bad_data_received_from_ssl_node, Name, Bin});
-		{format, FmtStr, ArgList} ->
-		    ?t:format(FmtStr, ArgList);
-		{message, Msg} ->
-		    ?t:format("Got message ~p", [Msg]),
-		    Parent ! Msg;
-		{apply_res, To, Ref, Res} ->
-		    To ! {Ref, Res};
-		bye ->
-		    ?t:format("Ssl node ~s stopped.~n", [Name]),
-		    gen_tcp:close(Socket),
-		    exit(normal);
-		Unknown ->
-		    exit({unexpected_message_from_ssl_node, Name, Unknown})
-	    end;
-	{tcp_closed, Socket} ->
-	    gen_tcp:close(Socket),
-	    exit({lost_connection_with_ssl_node, Name})
-    end,
-    tstsrvr_con_loop(Name, Socket, Parent).
-
-%%
-%% Connection handler ssl_node side
-%%
-
-% cnct2tstsrvr() is called via command line arg -run ...
-cnct2tstsrvr([Host, Port]) when is_list(Host), is_list(Port) ->
-    %% Spawn connection handler on ssl node side
-    ConnHandler
-	= spawn(fun () ->
-			case catch gen_tcp:connect(Host,
-						   list_to_integer(Port),
-						   [binary,
-						    {packet, 4},
-						    {active, false}]) of
-			    {ok, Socket} ->
-				notify_ssl_node_up(Socket),
-				ets:new(test_server_info,
-					[set,
-					 public,
-					 named_table,
-					 {keypos, 1}]),
-				ets:insert(test_server_info,
-					   {test_server_handler, self()}),
-				ssl_node_con_loop(Socket);
-			    Error ->
-				halt("Failed to connect to test server " ++
-					 lists:flatten(io_lib:format("Host:~p ~n Port:~p~n Error:~p~n",
-								     [Host, Port, Error])))
-			end
-		end),
-    spawn(fun () ->
-		  Mon = erlang:monitor(process, ConnHandler),
-		  receive
-		      {'DOWN', Mon, process, ConnHandler, Reason} ->
-			  receive after 1000 -> ok end,
-			  halt("test server connection handler terminated: " ++
-				   lists:flatten(io_lib:format("~p", [Reason])))
-		  end
-	  end).
-
-notify_ssl_node_up(Socket) ->
-    case catch gen_tcp:send(Socket,
-			    term_to_binary({ssl_node_up, node()})) of
-	ok -> ok;
-	_ -> halt("Failed to notify test server that I'm up")
-    end.
-
-send_to_tstsrvr(Term) ->
-    case catch ets:lookup_element(test_server_info, test_server_handler, 2) of
-	Hndlr when is_pid(Hndlr) ->
-	    Hndlr ! {relay_to_test_server, term_to_binary(Term)}, ok;
-	_ ->
-	    receive after 200 -> ok end,
-	    send_to_tstsrvr(Term)
-    end.
-
-ssl_node_con_loop(Socket) ->
-    inet:setopts(Socket,[{active,once}]),
-    receive
-	{relay_to_test_server, Data} when is_binary(Data) ->
-	    case gen_tcp:send(Socket, Data) of
-		ok ->
-		    ok;
-		_Error ->
-		    gen_tcp:close(Socket),
-		    halt("Failed to relay data to test server")
-	    end;
-	{tcp, Socket, Bin} ->
-	    case catch binary_to_term(Bin) of
-		{'EXIT', _} ->
-		    gen_tcp:close(Socket),
-		    halt("test server sent me bad data");
-		{apply, From, Ref, M, F, A} ->
-		    spawn_link(
-		      fun () ->
-			      send_to_tstsrvr({apply_res,
-					       From,
-					       Ref,
-					       (catch apply(M, F, A))})
-			  end);
-		{apply, From, Ref, Fun} ->
-		    spawn_link(fun () ->
-				       send_to_tstsrvr({apply_res,
-							From,
-							Ref,
-							(catch Fun())})
-			       end);
-		stop ->
-		    gen_tcp:send(Socket, term_to_binary(bye)),
-		    gen_tcp:close(Socket),
-		    init:stop(),
-		    receive after infinity -> ok end;
-		_Unknown ->
-		    halt("test server sent me an unexpected message")
-	    end;
-	{tcp_closed, Socket} ->
-	    halt("Lost connection to test server")
-    end,
-    ssl_node_con_loop(Socket).
-
 %%
 %% Setup ssl dist info
 %%
diff --git a/lib/ssl/test/ssl_dist_bench_SUITE.erl b/lib/ssl/test/ssl_dist_bench_SUITE.erl
new file mode 100644
index 0000000000..4d27564319
--- /dev/null
+++ b/lib/ssl/test/ssl_dist_bench_SUITE.erl
@@ -0,0 +1,481 @@
+%%%-------------------------------------------------------------------
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2017. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%%
+%% %CopyrightEnd%
+%%
+-module(ssl_dist_bench_SUITE).
+
+-include_lib("common_test/include/ct_event.hrl").
+-include_lib("public_key/include/public_key.hrl").
+
+%% CT meta
+-export([suite/0, all/0, groups/0,
+         init_per_suite/1, end_per_suite/1,
+         init_per_group/2, end_per_group/2,
+         init_per_testcase/2, end_per_testcase/2]).
+
+%% Test cases
+-export(
+   [setup/1,
+    roundtrip/1,
+    throughput_1024/1,
+    throughput_4096/1,
+    throughput_16384/1,
+    throughput_65536/1,
+    throughput_262144/1,
+    throughput_1048576/1]).
+
+%% Debug
+-export([payload/1]).
+
+%%%-------------------------------------------------------------------
+
+suite() -> [{ct_hooks, [{ts_install_cth, [{nodenames, 2}]}]}].
+
+all() -> [{group, ssl}, {group, plain}].
+
+groups() ->
+    [{ssl, all_groups()},
+     {plain, all_groups()},
+     %%
+     {setup, [{repeat, 1}], [setup]},
+     {roundtrip, [{repeat, 1}], [roundtrip]},
+     {throughput, [{repeat, 1}],
+      [throughput_1024,
+       throughput_4096,
+       throughput_16384,
+       throughput_65536,
+       throughput_262144,
+       throughput_1048576]}].
+
+all_groups() ->
+    [{group, setup},
+     {group, roundtrip},
+     {group, throughput}].
+
+init_per_suite(Config) ->
+    Digest = sha1,
+    ECCurve = secp521r1,
+    TLSVersion = 'tlsv1.2',
+    TLSCipher = {ecdhe_ecdsa,aes_128_cbc,sha256,sha256},
+    %%
+    Node = node(),
+    try
+        Node =/= nonode@nohost orelse
+            throw({skipped,"Node not distributed"}),
+        {supported, SSLVersions} =
+            lists:keyfind(supported, 1, ssl:versions()),
+        lists:member(TLSVersion, SSLVersions) orelse
+            throw(
+              {skipped,
+               "SSL does not support " ++ term_to_string(TLSVersion)}),
+        lists:member(ECCurve, ssl:eccs(TLSVersion)) orelse
+            throw(
+              {skipped,
+               "SSL does not support " ++ term_to_string(ECCurve)}),
+        lists:member(TLSCipher, ssl:cipher_suites()) orelse
+            throw(
+              {skipped,
+               "SSL does not support " ++ term_to_string(TLSCipher)})
+    of
+        _ ->
+            PrivDir = proplists:get_value(priv_dir, Config),
+            %%
+            [_, HostA] = string:split(atom_to_list(Node), "@"),
+            NodeAName = ?MODULE_STRING ++ "_node_a",
+            NodeAString = NodeAName ++ "@" ++ HostA,
+            NodeAConfFile = filename:join(PrivDir, NodeAString ++ ".conf"),
+            NodeA = list_to_atom(NodeAString),
+            %%
+            ServerNode = ssl_bench_test_lib:setup(dist_server),
+            [_, HostB] = string:split(atom_to_list(ServerNode), "@"),
+            NodeBName = ?MODULE_STRING ++ "_node_b",
+            NodeBString = NodeBName ++ "@" ++ HostB,
+            NodeBConfFile = filename:join(PrivDir, NodeBString ++ ".conf"),
+            NodeB = list_to_atom(NodeBString),
+            %%
+            CertOptions =
+                [{digest, Digest},
+                 {key, {namedCurve, ECCurve}}],
+            RootCert =
+                public_key:pkix_test_root_cert(
+                  ?MODULE_STRING ++ " ROOT CA", CertOptions),
+            SSLConf =
+                [{verify, verify_peer},
+                 {versions, [TLSVersion]},
+                 {ciphers, [TLSCipher]}],
+            %%
+            write_node_conf(
+              NodeAConfFile, NodeA,
+              [{fail_if_no_peer_cert, true} | SSLConf], SSLConf,
+              CertOptions, RootCert),
+            write_node_conf(
+              NodeBConfFile, NodeB,
+              [{fail_if_no_peer_cert, true} | SSLConf], SSLConf,
+              CertOptions, RootCert),
+            %%
+            [{node_a_name, NodeAName},
+             {node_a, NodeA},
+             {node_a_dist_args,
+              "-proto_dist inet_tls "
+              "-ssl_dist_optfile " ++ NodeAConfFile ++ " "},
+             {node_b_name, NodeBName},
+             {node_b, NodeB},
+             {node_b_dist_args,
+              "-proto_dist inet_tls "
+              "-ssl_dist_optfile " ++ NodeBConfFile ++ " "},
+             {server_node, ServerNode}
+             |Config]
+    catch
+        throw:Result ->
+            Result
+    end.
+
+end_per_suite(Config) ->
+    ServerNode = proplists:get_value(server_node, Config),
+    slave:stop(ServerNode).
+
+init_per_group(ssl, Config) ->
+    [{ssl_dist, true}, {ssl_dist_prefix, "SSL"}|Config];
+init_per_group(plain, Config) ->
+    [{ssl_dist, false}, {ssl_dist_prefix, "Plain"}|Config];
+init_per_group(_GroupName, Config) ->
+    Config.
+
+end_per_group(_GroupName, _Config) ->
+    ok.
+
+init_per_testcase(_Func, Conf) ->
+    Conf.
+
+end_per_testcase(_Func, _Conf) ->
+    ok.
+
+-define(COUNT, 400).
+
+%%%-------------------------------------------------------------------
+%%% CommonTest API helpers
+
+write_node_conf(
+  ConfFile, Node, ServerConf, ClientConf, CertOptions, RootCert) ->
+    Conf =
+        public_key:pkix_test_data(
+          #{root => RootCert,
+            peer =>
+                [{extensions,
+                  [#'Extension'{
+                      extnID = ?'id-ce-subjectAltName',
+                      extnValue = [{dNSName, atom_to_list(Node)}],
+                      critical = false}]} | CertOptions]}),
+    NodeConf =
+        [{server, ServerConf ++ Conf}, {client, ClientConf ++ Conf}],
+    {ok, Fd} = file:open(ConfFile, [write]),
+    ok = file:change_mode(ConfFile, 8#400),
+    io:format(Fd, "~p.~n", [NodeConf]),
+    ok = file:close(Fd).
+
+
+%%%-------------------------------------------------------------------
+%%% Test cases
+
+%%-----------------------
+%% Connection setup speed
+
+setup(Config) ->
+    run_nodepair_test(fun setup/5, Config).
+
+setup(A, B, Prefix, HA, HB) ->
+    Rounds = 10,
+    [] = ssl_apply(HA, erlang, nodes, []),
+    [] = ssl_apply(HB, erlang, nodes, []),
+    {SetupTime, CycleTime} =
+        ssl_apply(HA, fun () -> setup_runner(A, B, Rounds) end),
+    [] = ssl_apply(HA, erlang, nodes, []),
+    [] = ssl_apply(HB, erlang, nodes, []),
+    SetupSpeed = round((Rounds*1000000*1000) / SetupTime),
+    CycleSpeed = round((Rounds*1000000*1000) / CycleTime),
+    _ = report(Prefix++" Setup", SetupSpeed, "setups/1000s"),
+    report(Prefix++" Setup Cycle", CycleSpeed, "cycles/1000s").
+
+%% Runs on node A against rex in node B
+setup_runner(A, B, Rounds) ->
+    StartTime = start_time(),
+    SetupTime = setup_loop(A, B, 0, Rounds),
+    {microseconds(SetupTime), microseconds(elapsed_time(StartTime))}.
+
+setup_loop(_A, _B, T, 0) ->
+    T;
+setup_loop(A, B, T, N) ->
+    StartTime = start_time(),
+    [A] = rpc:block_call(B, erlang, nodes, []),
+    Time = elapsed_time(StartTime),
+    [B] = erlang:nodes(),
+    Mref = erlang:monitor(process, {rex,B}),
+    true = net_kernel:disconnect(B),
+    receive
+        {'DOWN',Mref,process,_,_} ->
+            [] = erlang:nodes(),
+            setup_loop(A, B, Time + T, N - 1)
+    end.
+
+
+%%----------------
+%% Roundtrip speed
+
+roundtrip(Config) ->
+    run_nodepair_test(fun roundtrip/5, Config).
+
+roundtrip(A, B, Prefix, HA, HB) ->
+    Rounds = 40000,
+    [] = ssl_apply(HA, erlang, nodes, []),
+    [] = ssl_apply(HB, erlang, nodes, []),
+    Time = ssl_apply(HA, fun () -> roundtrip_runner(A, B, Rounds) end),
+    [B] = ssl_apply(HA, erlang, nodes, []),
+    [A] = ssl_apply(HB, erlang, nodes, []),
+    Speed = round((Rounds*1000000) / Time),
+    report(Prefix++" Roundtrip", Speed, "pings/s").
+
+%% Runs on node A and spawns a server on node B
+roundtrip_runner(A, B, Rounds) ->
+    ClientPid = self(),
+    [A] = rpc:call(B, erlang, nodes, []),
+    ServerPid =
+        erlang:spawn(
+          B,
+          fun () -> roundtrip_server(ClientPid, Rounds) end),
+    ServerMon = erlang:monitor(process, ServerPid),
+    microseconds(
+      roundtrip_client(ServerPid, ServerMon, start_time(), Rounds)).
+
+roundtrip_server(_Pid, 0) ->
+    ok;
+roundtrip_server(Pid, N) ->
+    receive
+        N ->
+            Pid ! N,
+            roundtrip_server(Pid, N-1)
+    end.
+
+roundtrip_client(_Pid, Mon, StartTime, 0) ->
+    Time = elapsed_time(StartTime),
+    receive
+        {'DOWN', Mon, _, _, normal} ->
+            Time;
+        {'DOWN', Mon, _, _, Other} ->
+            exit(Other)
+    end;
+roundtrip_client(Pid, Mon, StartTime, N) ->
+    Pid ! N,
+    receive
+        N ->
+            roundtrip_client(Pid, Mon, StartTime, N - 1)
+    end.
+
+
+%%-----------------
+%% Throughput speed
+
+throughput_1024(Config) ->
+    run_nodepair_test(
+      fun (A, B, Prefix, HA, HB) ->
+              throughput(A, B, Prefix, HA, HB, 100000, 1024)
+      end, Config).
+
+throughput_4096(Config) ->
+    run_nodepair_test(
+      fun (A, B, Prefix, HA, HB) ->
+              throughput(A, B, Prefix, HA, HB, 50000, 4096)
+      end, Config).
+
+throughput_16384(Config) ->
+    run_nodepair_test(
+      fun (A, B, Prefix, HA, HB) ->
+              throughput(A, B, Prefix, HA, HB, 10000, 16384)
+      end, Config).
+
+throughput_65536(Config) ->
+    run_nodepair_test(
+      fun (A, B, Prefix, HA, HB) ->
+              throughput(A, B, Prefix, HA, HB, 2000, 65536)
+      end, Config).
+
+throughput_262144(Config) ->
+    run_nodepair_test(
+      fun (A, B, Prefix, HA, HB) ->
+              throughput(A, B, Prefix, HA, HB, 500, 262144)
+      end, Config).
+
+throughput_1048576(Config) ->
+    run_nodepair_test(
+      fun (A, B, Prefix, HA, HB) ->
+              throughput(A, B, Prefix, HA, HB, 200, 1048576)
+      end, Config).
+
+throughput(A, B, Prefix, HA, HB, Packets, Size) ->
+    [] = ssl_apply(HA, erlang, nodes, []),
+    [] = ssl_apply(HB, erlang, nodes, []),
+    Time =
+        ssl_apply(HA, fun () -> throughput_runner(A, B, Packets, Size) end),
+    [B] = ssl_apply(HA, erlang, nodes, []),
+    [A] = ssl_apply(HB, erlang, nodes, []),
+    Speed = round((Packets*Size*1000000) / (1024*Time)),
+    report(Prefix++" Throughput_"++integer_to_list(Size), Speed, "kB/s").
+
+%% Runs on node A and spawns a server on node B
+throughput_runner(A, B, Rounds, Size) ->
+    Payload = payload(Size),
+    ClientPid = self(),
+    [A] = rpc:call(B, erlang, nodes, []),
+    ServerPid =
+        erlang:spawn(
+          B,
+          fun () -> throughput_server(ClientPid, Rounds) end),
+    ServerMon = erlang:monitor(process, ServerPid),
+    microseconds(
+      throughput_client(
+        ServerPid, ServerMon, Payload, start_time(), Rounds)).
+
+throughput_server(_Pid, 0) ->
+    ok;
+throughput_server(Pid, N) ->
+    receive
+        [N|_] ->
+            throughput_server(Pid, N-1)
+    end.
+
+throughput_client(_Pid, Mon, _Payload, StartTime, 0) ->
+    receive
+        {'DOWN', Mon, _, _, normal} ->
+            elapsed_time(StartTime);
+        {'DOWN', Mon, _, _, Other} ->
+            exit(Other)
+    end;
+throughput_client(Pid, Mon, Payload, StartTime, N) ->
+    Pid ! [N|Payload],
+    throughput_client(Pid, Mon, Payload, StartTime, N - 1).
+
+%%%-------------------------------------------------------------------
+%%% Test cases helpers
+
+run_nodepair_test(TestFun, Config) ->
+    A = proplists:get_value(node_a, Config),
+    B = proplists:get_value(node_b, Config),
+    Prefix = proplists:get_value(ssl_dist_prefix, Config),
+    HA = start_ssl_node_a(Config),
+    HB = start_ssl_node_b(Config),
+    try TestFun(A, B, Prefix, HA, HB)
+    after
+        stop_ssl_node_a(HA),
+        stop_ssl_node_b(HB, Config),
+        ok
+    end.
+
+ssl_apply(Handle, M, F, Args) ->
+    case ssl_dist_test_lib:apply_on_ssl_node(Handle, M, F, Args) of
+        {'EXIT',Reason} ->
+            error(Reason);
+        Result ->
+            Result
+    end.
+
+ssl_apply(Handle, Fun) ->
+    case ssl_dist_test_lib:apply_on_ssl_node(Handle, Fun) of
+        {'EXIT',Reason} ->
+            error(Reason);
+        Result ->
+            Result
+    end.
+
+start_ssl_node_a(Config) ->
+    Name = proplists:get_value(node_a_name, Config),
+    Args = get_node_args(node_a_dist_args, Config),
+    ssl_dist_test_lib:start_ssl_node(Name, Args).
+
+start_ssl_node_b(Config) ->
+    Name = proplists:get_value(node_b_name, Config),
+    Args = get_node_args(node_b_dist_args, Config),
+    ServerNode = proplists:get_value(server_node, Config),
+    rpc:call(
+      ServerNode, ssl_dist_test_lib, start_ssl_node, [Name, Args]).
+
+stop_ssl_node_a(HA) ->
+    ssl_dist_test_lib:stop_ssl_node(HA).
+
+stop_ssl_node_b(HB, Config) ->
+    ServerNode = proplists:get_value(server_node, Config),
+    rpc:call(ServerNode, ssl_dist_test_lib, stop_ssl_node, [HB]).
+
+get_node_args(Tag, Config) ->
+    case proplists:get_value(ssl_dist, Config) of
+        true ->
+            proplists:get_value(Tag, Config);
+        false ->
+            ""
+    end.
+
+
+
+payload(Size) ->
+    iolist_to_binary(
+      [case Size bsr 8 of
+           0 ->
+               [];
+           Blocks ->
+               payload(Blocks, create_binary(256))
+       end | create_binary(Size band 255)]).
+%%
+payload(0, _) ->
+    [];
+payload(Blocks, Block) ->
+    Half = payload(Blocks bsr 1, Block),
+    [Half, Half |
+     if
+         Blocks band 1 =:= 1 ->
+             Block;
+         true ->
+             []
+     end].
+
+create_binary(Size) ->
+    create_binary(Size, <<>>).
+%%
+create_binary(0, Bin) ->
+    Bin;
+create_binary(Size, Bin) ->
+    NextSize = Size - 1,
+    create_binary(NextSize, <<Bin/binary, NextSize>>).
+
+start_time() ->
+    erlang:system_time().
+
+elapsed_time(StartTime) ->
+    erlang:system_time() - StartTime.
+
+microseconds(Time) ->
+    erlang:convert_time_unit(Time, native, microsecond).
+
+report(Name, Value, Unit) ->
+    ct:pal("~s: ~w ~s", [Name, Value, Unit]),
+    ct_event:notify(
+      #event{
+         name = benchmark_data,
+         data = [{value, Value}, {suite, "ssl_dist"}, {name, Name}]}),
+    {comment, term_to_string(Value) ++ " " ++ Unit}.
+
+term_to_string(Term) ->
+    unicode:characters_to_list(
+      io_lib:write(Term, [{encoding, unicode}])).
diff --git a/lib/ssl/test/ssl_dist_test_lib.erl b/lib/ssl/test/ssl_dist_test_lib.erl
new file mode 100644
index 0000000000..1b9c853fc4
--- /dev/null
+++ b/lib/ssl/test/ssl_dist_test_lib.erl
@@ -0,0 +1,343 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2017. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+-module(ssl_dist_test_lib).
+
+-include_lib("common_test/include/ct.hrl").
+-include_lib("public_key/include/public_key.hrl").
+-include("ssl_dist_test_lib.hrl").
+
+-export([tstsrvr_format/2, send_to_tstcntrl/1]).
+-export([apply_on_ssl_node/4, apply_on_ssl_node/2]).
+-export([stop_ssl_node/1, start_ssl_node/2]).
+%%
+-export([cnct2tstsrvr/1]).
+
+-define(AWAIT_SSL_NODE_UP_TIMEOUT, 30000).
+
+
+
+%% ssl_node side api
+%%
+
+tstsrvr_format(Fmt, ArgList) ->
+    send_to_tstsrvr({format, Fmt, ArgList}).
+
+send_to_tstcntrl(Message) ->
+    send_to_tstsrvr({message, Message}).
+
+
+%%
+%% test_server side api
+%%
+
+apply_on_ssl_node(
+  #node_handle{connection_handler = Hndlr} = Node,
+  M, F, A) when is_atom(M), is_atom(F), is_list(A) ->
+    Ref = erlang:monitor(process, Hndlr),
+    apply_on_ssl_node(Node, Ref, {apply, self(), Ref, M, F, A}).
+
+apply_on_ssl_node(
+  #node_handle{connection_handler = Hndlr} = Node,
+  Fun) when is_function(Fun, 0) ->
+    Ref = erlang:monitor(process, Hndlr),
+    apply_on_ssl_node(Node, Ref, {apply, self(), Ref, Fun}).
+
+apply_on_ssl_node(Node, Ref, Msg) ->
+    send_to_ssl_node(Node, Msg),
+    receive
+        {'DOWN', Ref, process, Hndlr, Reason} ->
+            exit({handler_died, Hndlr, Reason});
+	{Ref, Result} ->
+	    Result
+    end.
+
+stop_ssl_node(#node_handle{connection_handler = Handler,
+			   socket = Socket,
+			   name = Name}) ->
+    ?t:format("Trying to stop ssl node ~s.~n", [Name]),
+    Mon = erlang:monitor(process, Handler),
+    unlink(Handler),
+    case gen_tcp:send(Socket, term_to_binary(stop)) of
+	ok ->
+	    receive
+		{'DOWN', Mon, process, Handler, Reason} ->
+		    case Reason of
+			normal ->
+			    ok;
+			_ ->
+			    ct:pal(
+                              "stop_ssl_node/1 ~s Down  ~p ~n",
+                              [Name,Reason])
+		    end
+	    end;
+	Error ->
+	    erlang:demonitor(Mon, [flush]),
+	    ct:pal("stop_ssl_node/1 ~s Warning ~p ~n", [Name,Error])
+    end.
+
+start_ssl_node(Name, Args) ->
+    {ok, LSock} = gen_tcp:listen(0,
+				 [binary, {packet, 4}, {active, false}]),
+    {ok, ListenPort} = inet:port(LSock),
+    CmdLine = mk_node_cmdline(ListenPort, Name, Args),
+    ?t:format("Attempting to start ssl node ~ts: ~ts~n", [Name, CmdLine]),
+    case open_port({spawn, CmdLine}, []) of
+	Port when is_port(Port) ->
+	    unlink(Port),
+	    erlang:port_close(Port),
+	    case await_ssl_node_up(Name, LSock) of
+		#node_handle{} = NodeHandle ->
+		    ?t:format("Ssl node ~s started.~n", [Name]),
+		    NodeName = list_to_atom(Name ++ "@" ++ host_name()),
+		    NodeHandle#node_handle{nodename = NodeName};
+		Error ->
+		    exit({failed_to_start_node, Name, Error})
+	    end;
+	Error ->
+	    exit({failed_to_start_node, Name, Error})
+    end.
+
+host_name() ->
+    [_, Host] = string:split(atom_to_list(node()), "@"),
+    %% [$@ | Host] = lists:dropwhile(fun ($@) -> false; (_) -> true end,
+    %%     			  atom_to_list(node())),
+    Host.
+
+mk_node_cmdline(ListenPort, Name, Args) ->
+    Static = "-detached -noinput",
+    Pa = filename:dirname(code:which(?MODULE)),
+    Prog = case catch init:get_argument(progname) of
+	       {ok,[[P]]} -> P;
+	       _ -> exit(no_progname_argument_found)
+	   end,
+    NameSw = case net_kernel:longnames() of
+		 false -> "-sname ";
+		 _ -> "-name "
+	     end,
+    {ok, Pwd} = file:get_cwd(),
+    "\"" ++ Prog ++ "\" "
+	++ Static ++ " "
+	++ NameSw ++ " " ++ Name ++ " "
+	++ "-pa " ++ Pa ++ " "
+	++ "-run application start crypto -run application start public_key "
+	++ "-eval 'net_kernel:verbose(1)' "
+	++ "-run " ++ atom_to_list(?MODULE) ++ " cnct2tstsrvr "
+	++ host_name() ++ " "
+	++ integer_to_list(ListenPort) ++ " "
+	++ Args ++ " "
+	++ "-env ERL_CRASH_DUMP " ++ Pwd ++ "/erl_crash_dump." ++ Name ++ " "
+	++ "-kernel error_logger \"{file,\\\"" ++ Pwd ++ "/error_log." ++ Name ++ "\\\"}\" "
+	++ "-setcookie " ++ atom_to_list(erlang:get_cookie()).
+
+%%
+%% Connection handler test_server side
+%%
+
+await_ssl_node_up(Name, LSock) ->
+    case gen_tcp:accept(LSock, ?AWAIT_SSL_NODE_UP_TIMEOUT) of
+	{ok, Socket} ->
+	    gen_tcp:close(LSock),
+	    case gen_tcp:recv(Socket, 0) of
+		{ok, Bin} ->
+		    check_ssl_node_up(Socket, Name, Bin);
+		{error, closed} ->
+		    gen_tcp:close(Socket),
+		    exit({lost_connection_with_ssl_node_before_up, Name})
+	    end;
+	{error, Error} ->
+	    gen_tcp:close(LSock),
+            ?t:format("Accept failed for ssl node ~s: ~p~n", [Name,Error]),
+	    exit({accept_failed, Error})
+    end.
+
+check_ssl_node_up(Socket, Name, Bin) ->
+    case catch binary_to_term(Bin) of
+	{'EXIT', _} ->
+	    gen_tcp:close(Socket),
+	    exit({bad_data_received_from_ssl_node, Name, Bin});
+	{ssl_node_up, NodeName} ->
+	    case list_to_atom(Name++"@"++host_name()) of
+		NodeName ->
+		    Parent = self(),
+		    Go = make_ref(),
+		    %% Spawn connection handler on test server side
+		    Pid = spawn_link(
+			    fun () ->
+				    receive Go -> ok end,
+                                    process_flag(trap_exit, true),
+				    tstsrvr_con_loop(Name, Socket, Parent)
+			    end),
+		    ok = gen_tcp:controlling_process(Socket, Pid),
+		    Pid ! Go,
+		    #node_handle{connection_handler = Pid,
+				 socket = Socket,
+				 name = Name};
+		_ ->
+		    exit({unexpected_ssl_node_connected, NodeName})
+	    end;
+	Msg ->
+	    exit({unexpected_msg_instead_of_ssl_node_up, Name, Msg})
+    end.
+
+send_to_ssl_node(#node_handle{connection_handler = Hndlr}, Term) ->
+    Hndlr ! {relay_to_ssl_node, term_to_binary(Term)},
+    ok.
+
+tstsrvr_con_loop(Name, Socket, Parent) ->
+    ok = inet:setopts(Socket,[{active,once}]),
+    receive
+	{relay_to_ssl_node, Data} when is_binary(Data) ->
+	    case gen_tcp:send(Socket, Data) of
+		ok ->
+		    ok;
+		_Error ->
+		    gen_tcp:close(Socket),
+		    exit({failed_to_relay_data_to_ssl_node, Name, Data})
+	    end;
+	{tcp, Socket, Bin} ->
+	    try binary_to_term(Bin) of
+		{format, FmtStr, ArgList} ->
+		    ?t:format(FmtStr, ArgList);
+		{message, Msg} ->
+		    ?t:format("Got message ~p", [Msg]),
+		    Parent ! Msg;
+		{apply_res, To, Ref, Res} ->
+		    To ! {Ref, Res};
+		bye ->
+                    {error, closed} = gen_tcp:recv(Socket, 0),
+		    ?t:format("Ssl node ~s stopped.~n", [Name]),
+		    gen_tcp:close(Socket),
+		    exit(normal);
+		Unknown ->
+		    exit({unexpected_message_from_ssl_node, Name, Unknown})
+            catch
+                error : _ ->
+		    gen_tcp:close(Socket),
+		    exit({bad_data_received_from_ssl_node, Name, Bin})
+	    end;
+	{tcp_closed, Socket} ->
+	    gen_tcp:close(Socket),
+	    exit({lost_connection_with_ssl_node, Name});
+        {'EXIT', Parent, Reason} ->
+            exit({'EXIT', parent, Reason});
+        Unknown ->
+            exit({unknown, Unknown})
+    end,
+    tstsrvr_con_loop(Name, Socket, Parent).
+
+%%
+%% Connection handler ssl_node side
+%%
+
+% cnct2tstsrvr() is called via command line arg -run ...
+cnct2tstsrvr([Host, Port]) when is_list(Host), is_list(Port) ->
+    %% Spawn connection handler on ssl node side
+    ConnHandler
+	= spawn(fun () ->
+			case catch gen_tcp:connect(Host,
+						   list_to_integer(Port),
+						   [binary,
+						    {packet, 4},
+						    {active, false}]) of
+			    {ok, Socket} ->
+				notify_ssl_node_up(Socket),
+				ets:new(test_server_info,
+					[set,
+					 public,
+					 named_table,
+					 {keypos, 1}]),
+				ets:insert(test_server_info,
+					   {test_server_handler, self()}),
+				ssl_node_con_loop(Socket);
+			    Error ->
+				halt("Failed to connect to test server " ++
+					 lists:flatten(io_lib:format("Host:~p ~n Port:~p~n Error:~p~n",
+								     [Host, Port, Error])))
+			end
+		end),
+    spawn(fun () ->
+		  Mon = erlang:monitor(process, ConnHandler),
+		  receive
+		      {'DOWN', Mon, process, ConnHandler, Reason} ->
+			  receive after 1000 -> ok end,
+			  halt("test server connection handler terminated: " ++
+				   lists:flatten(io_lib:format("~p", [Reason])))
+		  end
+	  end).
+
+notify_ssl_node_up(Socket) ->
+    case catch gen_tcp:send(Socket,
+			    term_to_binary({ssl_node_up, node()})) of
+	ok -> ok;
+	_ -> halt("Failed to notify test server that I'm up")
+    end.
+
+send_to_tstsrvr(Term) ->
+    case catch ets:lookup_element(test_server_info, test_server_handler, 2) of
+	Hndlr when is_pid(Hndlr) ->
+	    Hndlr ! {relay_to_test_server, term_to_binary(Term)}, ok;
+	_ ->
+	    receive after 200 -> ok end,
+	    send_to_tstsrvr(Term)
+    end.
+
+ssl_node_con_loop(Socket) ->
+    inet:setopts(Socket,[{active,once}]),
+    receive
+	{relay_to_test_server, Data} when is_binary(Data) ->
+	    case gen_tcp:send(Socket, Data) of
+		ok ->
+		    ok;
+		_Error ->
+		    gen_tcp:close(Socket),
+		    halt("Failed to relay data to test server")
+	    end;
+	{tcp, Socket, Bin} ->
+	    case catch binary_to_term(Bin) of
+		{'EXIT', _} ->
+		    gen_tcp:close(Socket),
+		    halt("test server sent me bad data");
+		{apply, From, Ref, M, F, A} ->
+		    spawn_link(
+		      fun () ->
+			      send_to_tstsrvr({apply_res,
+					       From,
+					       Ref,
+					       (catch apply(M, F, A))})
+			  end);
+		{apply, From, Ref, Fun} ->
+		    spawn_link(fun () ->
+				       send_to_tstsrvr({apply_res,
+							From,
+							Ref,
+							(catch Fun())})
+			       end);
+		stop ->
+		    gen_tcp:send(Socket, term_to_binary(bye)),
+		    init:stop(),
+		    receive after infinity -> ok end;
+		_Unknown ->
+		    halt("test server sent me an unexpected message")
+	    end;
+	{tcp_closed, Socket} ->
+	    halt("Lost connection to test server")
+    end,
+    ssl_node_con_loop(Socket).
diff --git a/lib/ssl/test/ssl_dist_test_lib.hrl b/lib/ssl/test/ssl_dist_test_lib.hrl
new file mode 100644
index 0000000000..86b9b37026
--- /dev/null
+++ b/lib/ssl/test/ssl_dist_test_lib.hrl
@@ -0,0 +1,26 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2017. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+-record(node_handle,
+	{connection_handler,
+	 socket,
+	 name,
+	 nodename}
+       ).