Merge branch 'ingela/ssl/no-sslv2-hello-support/OTP-14824'

* ingela/ssl/no-sslv2-hello-support/OTP-14824:
  ssl: Remove interoperability option v2_hello_compatible

17 files changed, 330 insertions, 518 deletions

diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml
index 7267083e32..8c1b1541c7 100644
--- a/lib/ssl/doc/src/ssl.xml
+++ b/lib/ssl/doc/src/ssl.xml
@@ -821,12 +821,6 @@ fun(srp, Username :: string(), UserState :: term()) ->
       client certificate is requested. For more details see the <seealso marker="#client_signature_algs">corresponding client option</seealso>.
       </p> </item>
 
-      <tag><c>{v2_hello_compatible, boolean()}</c></tag>
-      <item>If true, the server accepts clients that send hello messages on SSL-2.0 format but offers 
-      supported SSL/TLS versions. Defaults to false, that is the server will not interoperate with clients that
-      offers SSL-2.0.
-      </item>
-     
     </taglist>
   </section>
   
diff --git a/lib/ssl/doc/src/ssl_app.xml b/lib/ssl/doc/src/ssl_app.xml
index 51070bb083..e22d43db0e 100644
--- a/lib/ssl/doc/src/ssl_app.xml
+++ b/lib/ssl/doc/src/ssl_app.xml
@@ -40,7 +40,8 @@
     <list type="bulleted">
       <item>Supported SSL/TLS/DTLS-versions are SSL-3.0, TLS-1.0,
       TLS-1.1, TLS-1.2, DTLS-1.0 (based on TLS-1.1), DTLS-1.2 (based on TLS-1.2)</item>
-      <item>For security reasons SSL-2.0 is not supported.</item>
+      <item>For security reasons SSL-2.0 is not supported.
+      Interoperability with SSL-2.0 enabled clients dropped. (OTP 21) </item>
       <item>For security reasons SSL-3.0 is no longer supported by default,
       but can be configured. (OTP 19) </item>
       <item>For security reasons RSA key exchange cipher suites are no longer supported by default,
diff --git a/lib/ssl/src/Makefile b/lib/ssl/src/Makefile
index 8eba5cf347..11b3e65912 100644
--- a/lib/ssl/src/Makefile
+++ b/lib/ssl/src/Makefile
@@ -84,7 +84,6 @@ MODULES= \
 	tls_record \
 	dtls_record \
 	ssl_record \
-	ssl_v2 \
 	ssl_v3 \
 	tls_v1 \
 	dtls_v1
diff --git a/lib/ssl/src/dtls_connection.erl b/lib/ssl/src/dtls_connection.erl
index fb12a729b1..7bc7fc3fc6 100644
--- a/lib/ssl/src/dtls_connection.erl
+++ b/lib/ssl/src/dtls_connection.erl
@@ -970,8 +970,7 @@ unprocessed_events(Events) ->
 update_handshake_history(#hello_verify_request{}, _, Hist) ->
     Hist;
 update_handshake_history(_, Handshake, Hist) ->
-    %% DTLS never needs option "v2_hello_compatible" to be true
-    ssl_handshake:update_handshake_history(Hist, iolist_to_binary(Handshake), false).
+    ssl_handshake:update_handshake_history(Hist, iolist_to_binary(Handshake)).
 prepare_flight(#state{flight_buffer = Flight,
 		      connection_states = ConnectionStates0,
 		      protocol_buffers = 
diff --git a/lib/ssl/src/dtls_record.erl b/lib/ssl/src/dtls_record.erl
index 316de05532..2938fd460f 100644
--- a/lib/ssl/src/dtls_record.erl
+++ b/lib/ssl/src/dtls_record.erl
@@ -440,7 +440,6 @@ get_dtls_records_aux(<<?BYTE(?CHANGE_CIPHER_SPEC),?BYTE(MajVer),?BYTE(MinVer),
 					 version = {MajVer, MinVer},
 					 epoch = Epoch, sequence_number = SequenceNumber,
 					 fragment = Data} | Acc]);
-
 get_dtls_records_aux(<<?BYTE(_), ?BYTE(_MajVer), ?BYTE(_MinVer),
 		       ?UINT16(Length), _/binary>>,
 		     _Acc) when Length > ?MAX_CIPHER_TEXT_LENGTH ->
diff --git a/lib/ssl/src/ssl.app.src b/lib/ssl/src/ssl.app.src
index 3962d1fc2c..2aecb6836e 100644
--- a/lib/ssl/src/ssl.app.src
+++ b/lib/ssl/src/ssl.app.src
@@ -9,7 +9,6 @@
 	       tls_socket,
 	       tls_v1,
 	       ssl_v3,
-	       ssl_v2,
 	       tls_connection_sup,
 	       %% DTLS
 	       dtls_connection,
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 82f62b51b9..4efd13a6fa 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -881,7 +881,6 @@ handle_options(Opts0, Role, Host) ->
 					     client, Role),
 		    crl_check = handle_option(crl_check, Opts, false),
 		    crl_cache = handle_option(crl_cache, Opts, {ssl_crl_cache, {internal, []}}),
-		    v2_hello_compatible = handle_option(v2_hello_compatible, Opts, false),
                     max_handshake_size = handle_option(max_handshake_size, Opts, ?DEFAULT_MAX_HANDSHAKE_SIZE)
 		   },
 
@@ -897,7 +896,7 @@ handle_options(Opts0, Role, Host) ->
 		  alpn_preferred_protocols, next_protocols_advertised,
 		  client_preferred_next_protocols, log_alert,
 		  server_name_indication, honor_cipher_order, padding_check, crl_check, crl_cache,
-		  fallback, signature_algs, eccs, honor_ecc_order, beast_mitigation, v2_hello_compatible,
+		  fallback, signature_algs, eccs, honor_ecc_order, beast_mitigation,
                   max_handshake_size],
 
     SockOpts = lists:foldl(fun(Key, PropList) ->
@@ -1134,8 +1133,6 @@ validate_option(beast_mitigation, Value) when Value == one_n_minus_one orelse
                                               Value == zero_n orelse
                                               Value == disabled ->
   Value;
-validate_option(v2_hello_compatible, Value) when is_boolean(Value)  ->
-    Value;
 validate_option(max_handshake_size, Value) when is_integer(Value)  andalso Value =< ?MAX_UNIT24 ->
     Value;
 validate_option(protocol, Value = tls) ->
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index 2031735a71..f493c93726 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -1119,8 +1119,7 @@ handle_common_event(internal, {handshake, {#hello_request{}, _}}, StateName, #st
   when StateName =/= connection ->
     {keep_state_and_data};
 handle_common_event(internal, {handshake, {Handshake, Raw}}, StateName,
-		    #state{tls_handshake_history = Hs0,
-			   ssl_options = #ssl_options{v2_hello_compatible = V2HComp}} = State0, 
+		    #state{tls_handshake_history = Hs0} = State0,
 		    Connection) ->
    
     PossibleSNI = Connection:select_sni_extension(Handshake),
@@ -1128,7 +1127,7 @@ handle_common_event(internal, {handshake, {Handshake, Raw}}, StateName,
     %% a client_hello, which needs to be determined by the connection callback.
     %% In other cases this is a noop
     State = handle_sni_extension(PossibleSNI, State0),
-    HsHist = ssl_handshake:update_handshake_history(Hs0, iolist_to_binary(Raw), V2HComp),
+    HsHist = ssl_handshake:update_handshake_history(Hs0, iolist_to_binary(Raw)),
     {next_state, StateName, State#state{tls_handshake_history = HsHist}, 
      [{next_event, internal, Handshake}]};
 handle_common_event(internal, {protocol_record, TLSorDTLSRecord}, StateName, State, Connection) -> 
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index 9e2b12b186..e1f813ea95 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -52,7 +52,7 @@
 %% Handle handshake messages
 -export([certify/7, certificate_verify/6, verify_signature/5,
 	 master_secret/4, server_key_exchange_hash/2, verify_connection/6,
-	 init_handshake_history/0, update_handshake_history/3, verify_server_key/5,
+	 init_handshake_history/0, update_handshake_history/2, verify_server_key/5,
          select_version/3
 	]).
 
@@ -479,24 +479,12 @@ init_handshake_history() ->
     {[], []}.
 
 %%--------------------------------------------------------------------
--spec update_handshake_history(ssl_handshake:ssl_handshake_history(), Data ::term(), boolean()) ->
+-spec update_handshake_history(ssl_handshake:ssl_handshake_history(), Data ::term()) ->
 				      ssl_handshake:ssl_handshake_history().
 %%
 %% Description: Update the handshake history buffer with Data.
 %%--------------------------------------------------------------------
-update_handshake_history(Handshake, % special-case SSL2 client hello
-			 <<?CLIENT_HELLO, ?UINT24(_), ?BYTE(Major), ?BYTE(Minor),
-			   ?UINT16(CSLength), ?UINT16(0),
-			   ?UINT16(CDLength),
-			   CipherSuites:CSLength/binary,
-			   ChallengeData:CDLength/binary>>, true) ->
-    update_handshake_history(Handshake,
-			     <<?CLIENT_HELLO, ?BYTE(Major), ?BYTE(Minor),
-			       ?UINT16(CSLength), ?UINT16(0),
-			       ?UINT16(CDLength),
-			       CipherSuites:CSLength/binary,
-			       ChallengeData:CDLength/binary>>, true);
-update_handshake_history({Handshake0, _Prev}, Data, _) ->
+update_handshake_history({Handshake0, _Prev}, Data) ->
     {[Data|Handshake0], Handshake0}.
 
 verify_server_key(#server_key_params{params_bin = EncParams,
diff --git a/lib/ssl/src/ssl_internal.hrl b/lib/ssl/src/ssl_internal.hrl
index bbe1374fec..d354910f33 100644
--- a/lib/ssl/src/ssl_internal.hrl
+++ b/lib/ssl/src/ssl_internal.hrl
@@ -144,7 +144,6 @@
 	  signature_algs,
 	  eccs,
 	  honor_ecc_order            :: boolean(),
-	  v2_hello_compatible        :: boolean(),
           max_handshake_size         :: integer()
          }).
 
diff --git a/lib/ssl/src/ssl_v2.erl b/lib/ssl/src/ssl_v2.erl
deleted file mode 100644
index 37134cbe5d..0000000000
--- a/lib/ssl/src/ssl_v2.erl
+++ /dev/null
@@ -1,38 +0,0 @@
-%%
-%% %CopyrightBegin%
-%%
-%% Copyright Ericsson AB 2007-2016. All Rights Reserved.
-%%
-%% Licensed under the Apache License, Version 2.0 (the "License");
-%% you may not use this file except in compliance with the License.
-%% You may obtain a copy of the License at
-%%
-%%     http://www.apache.org/licenses/LICENSE-2.0
-%%
-%% Unless required by applicable law or agreed to in writing, software
-%% distributed under the License is distributed on an "AS IS" BASIS,
-%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-%% See the License for the specific language governing permissions and
-%% limitations under the License.
-%%
-%% %CopyrightEnd%
-%%
-
-%%
-%%----------------------------------------------------------------------
-%% Purpose: Handles sslv2 hello as clients supporting sslv2 and higher
-%% will send an sslv2 hello.
-%%----------------------------------------------------------------------
-
--module(ssl_v2).
-
--export([client_random/2]).
-
-client_random(ChallengeData, 32) ->
-    ChallengeData;
-client_random(ChallengeData, N) when N > 32 ->
-    <<NewChallengeData:32/binary, _/binary>> = ChallengeData,
-    NewChallengeData;
-client_random(ChallengeData, N) ->
-    Pad = list_to_binary(lists:duplicate(N, 0)),
-    <<Pad/binary, ChallengeData/binary>>.
diff --git a/lib/ssl/src/tls_connection.erl b/lib/ssl/src/tls_connection.erl
index 2872ca9fe5..c35378f18f 100644
--- a/lib/ssl/src/tls_connection.erl
+++ b/lib/ssl/src/tls_connection.erl
@@ -266,10 +266,9 @@ send_handshake(Handshake, State) ->
 queue_handshake(Handshake, #state{negotiated_version = Version,
 				  tls_handshake_history = Hist0,
 				  flight_buffer = Flight0,
-				  ssl_options = #ssl_options{v2_hello_compatible = V2HComp},				  
 				  connection_states = ConnectionStates0} = State0) ->
     {BinHandshake, ConnectionStates, Hist} =
-	encode_handshake(Handshake, Version, ConnectionStates0, Hist0, V2HComp),
+	encode_handshake(Handshake, Version, ConnectionStates0, Hist0),
     State0#state{connection_states = ConnectionStates,
 		 tls_handshake_history = Hist,
 		 flight_buffer = Flight0 ++ [BinHandshake]}.
@@ -400,7 +399,7 @@ getopts(Transport, Socket, Tag) ->
 
 init({call, From}, {start, Timeout}, 
      #state{host = Host, port = Port, role = client,
-	    ssl_options = #ssl_options{v2_hello_compatible = V2HComp} = SslOpts,
+	    ssl_options = SslOpts,
 	    session = #session{own_certificate = Cert} = Session0,
 	    transport_cb = Transport, socket = Socket,
 	    connection_states = ConnectionStates0,
@@ -416,7 +415,7 @@ init({call, From}, {start, Timeout},
     HelloVersion = tls_record:hello_version(Version, SslOpts#ssl_options.versions),
     Handshake0 = ssl_handshake:init_handshake_history(),
     {BinMsg, ConnectionStates, Handshake} =
-        encode_handshake(Hello,  HelloVersion, ConnectionStates0, Handshake0, V2HComp),
+        encode_handshake(Hello,  HelloVersion, ConnectionStates0, Handshake0),
     send(Transport, Socket, BinMsg),
     State1 = State0#state{connection_states = ConnectionStates,
 			  negotiated_version = Version, %% Requested version
@@ -656,15 +655,11 @@ next_tls_record(Data, StateName, #state{protocol_buffers =
 	    handle_record_alert(Alert, State0)
     end.
 
-acceptable_record_versions(hello, #state{ssl_options = #ssl_options{v2_hello_compatible = true}}) ->
-    [tls_record:protocol_version(Vsn) || Vsn <- ?ALL_AVAILABLE_VERSIONS ++ ['sslv2']];
+
 acceptable_record_versions(hello, _) ->
     [tls_record:protocol_version(Vsn) || Vsn <- ?ALL_AVAILABLE_VERSIONS];
 acceptable_record_versions(_, #state{negotiated_version = Version}) ->
     [Version].
-handle_record_alert(#alert{description = ?BAD_RECORD_MAC}, 
-                    #state{ssl_options = #ssl_options{v2_hello_compatible = true}}) ->
-    ?ALERT_REC(?FATAL, ?PROTOCOL_VERSION);
 handle_record_alert(Alert, _) ->
     Alert.
 
@@ -727,9 +722,9 @@ handle_alerts([Alert | Alerts], {next_state, StateName, State}) ->
 handle_alerts([Alert | Alerts], {next_state, StateName, State, _Actions}) ->
      handle_alerts(Alerts, ssl_connection:handle_alert(Alert, StateName, State)).
 
-encode_handshake(Handshake, Version, ConnectionStates0, Hist0, V2HComp) ->
+encode_handshake(Handshake, Version, ConnectionStates0, Hist0) ->
     Frag = tls_handshake:encode_handshake(Handshake, Version),
-    Hist = ssl_handshake:update_handshake_history(Hist0, Frag, V2HComp),
+    Hist = ssl_handshake:update_handshake_history(Hist0, Frag),
     {Encoded, ConnectionStates} =
         tls_record:encode_handshake(Frag, Version, ConnectionStates0),
     {Encoded, ConnectionStates, Hist}.
diff --git a/lib/ssl/src/tls_handshake.erl b/lib/ssl/src/tls_handshake.erl
index 8817418fb0..0058b9c8ae 100644
--- a/lib/ssl/src/tls_handshake.erl
+++ b/lib/ssl/src/tls_handshake.erl
@@ -39,7 +39,7 @@
 -export([encode_handshake/2]).
 
 %% Handshake decodeing
--export([get_tls_handshake/4, decode_handshake/4]).
+-export([get_tls_handshake/4, decode_handshake/3]).
 
 -type tls_handshake() :: #client_hello{} | ssl_handshake:ssl_handshake().
 
@@ -268,9 +268,9 @@ enc_handshake(HandshakeMsg, Version) ->
 %%--------------------------------------------------------------------
 get_tls_handshake_aux(Version, <<?BYTE(Type), ?UINT24(Length),
 				 Body:Length/binary,Rest/binary>>, 
-                      #ssl_options{v2_hello_compatible = V2Hello} = Opts,  Acc) ->
+                      Opts,  Acc) ->
     Raw = <<?BYTE(Type), ?UINT24(Length), Body/binary>>,
-    try decode_handshake(Version, Type, Body, V2Hello) of
+    try decode_handshake(Version, Type, Body) of
 	Handshake ->
 	    get_tls_handshake_aux(Version, Rest, Opts, [{Handshake,Raw} | Acc])
     catch
@@ -280,29 +280,15 @@ get_tls_handshake_aux(Version, <<?BYTE(Type), ?UINT24(Length),
 get_tls_handshake_aux(_Version, Data, _, Acc) ->
     {lists:reverse(Acc), Data}.
 
-decode_handshake(_, ?HELLO_REQUEST, <<>>, _) ->
+decode_handshake(_, ?HELLO_REQUEST, <<>>) ->
     #hello_request{};
-
-decode_handshake(_Version, ?CLIENT_HELLO, Bin, true) ->
-    try decode_hello(Bin) of
-        Hello ->
-            Hello
-    catch
-        _:_ ->
-            decode_v2_hello(Bin)
-    end;
-decode_handshake(_Version, ?CLIENT_HELLO, Bin, false) ->
-    decode_hello(Bin);
-
 decode_handshake(_Version, ?CLIENT_HELLO, 
                  <<?BYTE(Major), ?BYTE(Minor), Random:32/binary,
                    ?BYTE(SID_length), Session_ID:SID_length/binary,
                    ?UINT16(Cs_length), CipherSuites:Cs_length/binary,
                    ?BYTE(Cm_length), Comp_methods:Cm_length/binary,
-                   Extensions/binary>>, _) ->
-    
+                   Extensions/binary>>) ->
     DecodedExtensions = ssl_handshake:decode_hello_extensions({client, Extensions}),
-
     #client_hello{
        client_version = {Major,Minor},
        random = Random,
@@ -311,36 +297,7 @@ decode_handshake(_Version, ?CLIENT_HELLO,
        compression_methods = Comp_methods,
        extensions = DecodedExtensions
       };
-decode_handshake(Version, Tag, Msg, _) ->
+decode_handshake(Version, Tag, Msg) ->
     ssl_handshake:decode_handshake(Version, Tag, Msg).
 
 
-decode_hello(<<?BYTE(Major), ?BYTE(Minor), Random:32/binary,
-               ?BYTE(SID_length), Session_ID:SID_length/binary,
-               ?UINT16(Cs_length), CipherSuites:Cs_length/binary,
-               ?BYTE(Cm_length), Comp_methods:Cm_length/binary,
-               Extensions/binary>>) ->
-    DecodedExtensions = ssl_handshake:decode_hello_extensions({client, Extensions}),
-    
-    #client_hello{
-       client_version = {Major,Minor},
-       random = Random,
-       session_id = Session_ID,
-       cipher_suites = ssl_handshake:decode_suites('2_bytes', CipherSuites),
-       compression_methods = Comp_methods,
-       extensions = DecodedExtensions
-      }.
-%% The server must be able to receive such messages, from clients that
-%% are willing to use ssl v3 or higher, but have ssl v2 compatibility.
-decode_v2_hello(<<?BYTE(Major), ?BYTE(Minor),
-                  ?UINT16(CSLength), ?UINT16(0),
-                  ?UINT16(CDLength),
-                  CipherSuites:CSLength/binary,
-                  ChallengeData:CDLength/binary>>) ->
-    #client_hello{client_version = {Major, Minor},
-		  random = ssl_v2:client_random(ChallengeData, CDLength),
-		  session_id = 0,
-		  cipher_suites =  ssl_handshake:decode_suites('3_bytes', CipherSuites),
-		  compression_methods = [?NULL],
-		  extensions = #hello_extensions{}
-		 }.
diff --git a/lib/ssl/src/tls_record.erl b/lib/ssl/src/tls_record.erl
index 188ec6809d..aa70508f1e 100644
--- a/lib/ssl/src/tls_record.erl
+++ b/lib/ssl/src/tls_record.erl
@@ -394,16 +394,6 @@ initial_connection_state(ConnectionEnd, BeastMitigation) ->
       server_verify_data => undefined
      }.
 
-assert_version(<<1:1, Length0:15, Data0:Length0/binary, _/binary>>, Versions) ->
-    case Data0 of
-        <<?BYTE(?CLIENT_HELLO), ?BYTE(Major), ?BYTE(Minor), _/binary>> ->
-            %% First check v2_hello_compatible mode is active 
-            lists:member({2,0}, Versions) andalso
-            %% andalso we want to negotiate higher version
-                lists:member({Major, Minor}, Versions -- [{2,0}]); 
-        _ ->
-            false
-    end;
 assert_version(<<?BYTE(_), ?BYTE(MajVer), ?BYTE(MinVer), _/binary>>, Versions) ->
     is_acceptable_version({MajVer, MinVer}, Versions).
                    
@@ -431,32 +421,10 @@ get_tls_records_aux(<<?BYTE(?CHANGE_CIPHER_SPEC),?BYTE(MajVer),?BYTE(MinVer),
     get_tls_records_aux(Rest, [#ssl_tls{type = ?CHANGE_CIPHER_SPEC,
 					version = {MajVer, MinVer},
 					fragment = Data} | Acc]);
-%% Matches an ssl v2 client hello message.
-%% The server must be able to receive such messages, from clients that
-%% are willing to use ssl v3 or higher, but have ssl v2 compatibility.
-get_tls_records_aux(<<1:1, Length0:15, Data0:Length0/binary, Rest/binary>>,
-		    Acc) ->
-    case Data0 of
-	<<?BYTE(?CLIENT_HELLO), ?BYTE(MajVer), ?BYTE(MinVer), _/binary>> ->
-	    Length = Length0-1,
-	    <<?BYTE(_), Data1:Length/binary>> = Data0,
-	    Data = <<?BYTE(?CLIENT_HELLO), ?UINT24(Length), Data1/binary>>,
-	    get_tls_records_aux(Rest, [#ssl_tls{type = ?HANDSHAKE,
-						version = {MajVer, MinVer},
-						fragment = Data} | Acc]);
-	_ ->
-	    ?ALERT_REC(?FATAL, ?HANDSHAKE_FAILURE)
-	    
-    end;
-
 get_tls_records_aux(<<0:1, _CT:7, ?BYTE(_MajVer), ?BYTE(_MinVer),
                       ?UINT16(Length), _/binary>>,
                     _Acc) when Length > ?MAX_CIPHER_TEXT_LENGTH ->
     ?ALERT_REC(?FATAL, ?RECORD_OVERFLOW);
-get_tls_records_aux(<<1:1, Length0:15, _/binary>>,_Acc) 
-  when Length0 > ?MAX_CIPHER_TEXT_LENGTH ->
-    ?ALERT_REC(?FATAL, ?RECORD_OVERFLOW);
-
 get_tls_records_aux(Data, Acc) ->
     case size(Data) =< ?MAX_CIPHER_TEXT_LENGTH + ?INITIAL_BYTES of
 	true ->
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index 05979d3cfd..a9901007db 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -3431,7 +3431,7 @@ tls_ciphersuite_vs_version(Config) when is_list(Config) ->
 		      >>),
     {ok, <<22, RecMajor:8, RecMinor:8, _RecLen:16, 2, HelloLen:24>>} = gen_tcp:recv(Socket, 9, 10000),
     {ok, <<HelloBin:HelloLen/binary>>} = gen_tcp:recv(Socket, HelloLen, 5000),
-    ServerHello = tls_handshake:decode_handshake({RecMajor, RecMinor}, 2, HelloBin, false),
+    ServerHello = tls_handshake:decode_handshake({RecMajor, RecMinor}, 2, HelloBin),
     case ServerHello of
 	#server_hello{server_version = {3,0}, cipher_suite = <<0,57>>} -> 
 	    ok;
diff --git a/lib/ssl/test/ssl_handshake_SUITE.erl b/lib/ssl/test/ssl_handshake_SUITE.erl
index 9658cb5f56..cd3d972c07 100644
--- a/lib/ssl/test/ssl_handshake_SUITE.erl
+++ b/lib/ssl/test/ssl_handshake_SUITE.erl
@@ -33,7 +33,6 @@
 %% Common Test interface functions -----------------------------------
 %%--------------------------------------------------------------------
 all() -> [decode_hello_handshake,
-          decode_hello_handshake_version_confusion,
 	  decode_single_hello_extension_correctly,
 	  decode_supported_elliptic_curves_hello_extension_correctly,
 	  decode_unknown_hello_extension_correctly,
@@ -101,20 +100,13 @@ decode_hello_handshake(_Config) ->
 	
     Version = {3, 0},
     {Records, _Buffer} = tls_handshake:get_tls_handshake(Version, HelloPacket, <<>>, 
-							 #ssl_options{v2_hello_compatible = false}),
+							 #ssl_options{}),
 
     {Hello, _Data} = hd(Records),
     #renegotiation_info{renegotiated_connection = <<0>>}
 	= (Hello#server_hello.extensions)#hello_extensions.renegotiation_info.
 
 
-decode_hello_handshake_version_confusion(_) -> 
-    HelloPacket = <<3,3,0,0,0,0,0,63,210,235,149,6,244,140,108,13,177,74,16,218,33,108,219,41,73,228,3,82,132,123,73,144,118,100,0,0,32,192,4,0,10,192,45,192,38,0,47,192,18,0,163,0,22,0,165,192,29,192,18,192,30,0,103,0,57,192,48,0,47,1,0>>,
-    Version = {3,3},
-    ClientHello = 1, 
-    Hello = tls_handshake:decode_handshake({3,3}, ClientHello, HelloPacket, false),
-    Hello = tls_handshake:decode_handshake({3,3}, ClientHello, HelloPacket, true).
-
 decode_single_hello_extension_correctly(_Config) -> 
     Renegotiation = <<?UINT16(?RENEGOTIATION_EXT), ?UINT16(1), 0>>,
     Extensions = ssl_handshake:decode_hello_extensions(Renegotiation),
diff --git a/lib/ssl/test/ssl_to_openssl_SUITE.erl b/lib/ssl/test/ssl_to_openssl_SUITE.erl
index dcdea6beb5..e8cbf857ef 100644
--- a/lib/ssl/test/ssl_to_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_to_openssl_SUITE.erl
@@ -51,17 +51,16 @@ groups() ->
     [{basic, [], basic_tests()},
      {'tlsv1.2', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
      {'tlsv1.1', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
-     {'tlsv1', [], all_versions_tests()++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
-     {'sslv3', [], all_versions_tests()},
-     {'dtlsv1.2', [], dtls_all_versions_tests()},
-     {'dtlsv1', [], dtls_all_versions_tests()}
-    ].
+      {'tlsv1', [], all_versions_tests()++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
+      {'sslv3', [], all_versions_tests()},
+      {'dtlsv1.2', [], dtls_all_versions_tests()},
+      {'dtlsv1', [], dtls_all_versions_tests()}
+     ].
 
 basic_tests() ->
     [basic_erlang_client_openssl_server,
      basic_erlang_server_openssl_client,
-     expired_session,
-     ssl2_erlang_server_openssl_client_comp
+     expired_session
     ].
 
 all_versions_tests() ->
@@ -141,13 +140,13 @@ sni_server_tests() ->
 
 init_per_suite(Config0) ->
     case os:find_executable("openssl") of
-	false ->
-	    {skip, "Openssl not found"};
-	_ ->
-	    ct:pal("Version: ~p", [os:cmd("openssl version")]),
-	    catch crypto:stop(),
-	    try crypto:start() of
-		ok ->
+        false ->
+            {skip, "Openssl not found"};
+        _ ->
+            ct:pal("Version: ~p", [os:cmd("openssl version")]),
+            catch crypto:stop(),
+            try crypto:start() of
+                ok ->
                     ssl_test_lib:clean_start(),
                     Config = 
                         case ssl_test_lib:openssl_dsa_support() of
@@ -158,9 +157,9 @@ init_per_suite(Config0) ->
                                 ssl_test_lib:make_rsa_cert(Config0)
                         end,
                     ssl_test_lib:cipher_restriction(Config)
-		catch _:_  ->
-		    {skip, "Crypto did not start"}
-	    end
+            catch _:_  ->
+                    {skip, "Crypto did not start"}
+            end
     end.
 
 end_per_suite(_Config) ->
@@ -168,39 +167,34 @@ end_per_suite(_Config) ->
     application:stop(crypto).
 
 init_per_group(basic, Config0) ->
-    Config = ssl_test_lib:clean_tls_version(Config0),
-    case ssl_test_lib:supports_ssl_tls_version(sslv2) of
-	true ->
-	    [{v2_hello_compatible, true} | Config];
-	false ->
-	    [{v2_hello_compatible, false} | Config]
-    end;
+    ssl_test_lib:clean_tls_version(Config0);
+
 init_per_group(GroupName, Config) ->
     case ssl_test_lib:is_tls_version(GroupName) of
-	true ->
+        true ->
             case ssl_test_lib:supports_ssl_tls_version(GroupName) of
-                true ->
+                 true ->
                     case ssl_test_lib:check_sane_openssl_version(GroupName) of
-                        true ->
+                         true ->
                             ssl_test_lib:init_tls_version(GroupName, Config);
-                        false ->
+                         false ->
                             {skip, openssl_does_not_support_version}
                     end;
                 false ->
                     {skip, openssl_does_not_support_version}
             end; 
-        _ ->
-	    ssl:start(),
-	    Config
+         _ ->
+            ssl:start(),
+            Config
     end.
 
 end_per_group(GroupName, Config) ->
-  case ssl_test_lib:is_tls_version(GroupName) of
-      true ->
-          ssl_test_lib:clean_tls_version(Config);
-      false ->
-          Config
-  end.
+    case ssl_test_lib:is_tls_version(GroupName) of
+        true ->
+            ssl_test_lib:clean_tls_version(Config);
+       false ->
+            Config
+    end.
 
 init_per_testcase(expired_session, Config) ->
     ct:timetrap(?EXPIRE * 1000 * 5),
@@ -208,19 +202,19 @@ init_per_testcase(expired_session, Config) ->
     application:load(ssl),
     application:set_env(ssl, session_lifetime, ?EXPIRE),
     ssl:start(),
-    Config;
+     Config;
 
 init_per_testcase(TestCase, Config) when 
       TestCase == ciphers_dsa_signed_certs;
       TestCase ==  erlang_client_openssl_server_dsa_cert;
       TestCase == erlang_server_openssl_client_dsa_cert;
-      TestCase == erlang_client_openssl_server_dsa_cert;
+       TestCase == erlang_client_openssl_server_dsa_cert;
       TestCase ==  erlang_server_openssl_client_dsa_cert ->
     case ssl_test_lib:openssl_dsa_support() of
         true ->
             special_init(TestCase, Config);
         false ->
-           {skip, "DSA not supported by OpenSSL"}
+            {skip, "DSA not supported by OpenSSL"}
     end; 
 init_per_testcase(TestCase, Config) ->
     ct:timetrap({seconds, 35}),
@@ -233,70 +227,69 @@ special_init(TestCase, Config) when
     Config;
 special_init(TestCase, Config)
   when TestCase == erlang_client_openssl_server_renegotiate;
-       TestCase == erlang_client_openssl_server_nowrap_seqnum;
+        TestCase == erlang_client_openssl_server_nowrap_seqnum;
        TestCase == erlang_server_openssl_client_nowrap_seqnum
-       ->
+        ->
     {ok, Version} = application:get_env(ssl, protocol_version),
     check_sane_openssl_renegotaite(Config, Version);
 
-special_init(Case, Config) when Case == ssl2_erlang_server_openssl_client;
-				Case == ssl2_erlang_server_openssl_client_comp ->
+special_init(ssl2_erlang_server_openssl_client, Config) ->
     case ssl_test_lib:supports_ssl_tls_version(sslv2) of
-	true ->
-	     Config;
-	false ->
-	     {skip, "sslv2 not supported by openssl"}
-    end;
+        true ->
+            Config;
+        false ->
+            {skip, "sslv2 not supported by openssl"}
+     end;
 
 special_init(TestCase, Config)
-    when TestCase == erlang_client_alpn_openssl_server_alpn;
-         TestCase == erlang_server_alpn_openssl_client_alpn;
-         TestCase == erlang_client_alpn_openssl_server;
-         TestCase == erlang_client_openssl_server_alpn;
-         TestCase == erlang_server_alpn_openssl_client;
-         TestCase == erlang_server_openssl_client_alpn ->
+     when TestCase == erlang_client_alpn_openssl_server_alpn;
+          TestCase == erlang_server_alpn_openssl_client_alpn;
+          TestCase == erlang_client_alpn_openssl_server;
+          TestCase == erlang_client_openssl_server_alpn;
+          TestCase == erlang_server_alpn_openssl_client;
+          TestCase == erlang_server_openssl_client_alpn ->
     check_openssl_alpn_support(Config);
 
 special_init(TestCase, Config)
-    when TestCase == erlang_client_alpn_openssl_server_alpn_renegotiate;
-         TestCase == erlang_server_alpn_openssl_client_alpn_renegotiate ->
-    {ok, Version} = application:get_env(ssl, protocol_version),
-    case check_sane_openssl_renegotaite(Config, Version) of
-	{skip, _} = Skip ->
-	    Skip;
-	_ ->
-	    check_openssl_alpn_support(Config)
-    end;
+     when TestCase == erlang_client_alpn_openssl_server_alpn_renegotiate;
+          TestCase == erlang_server_alpn_openssl_client_alpn_renegotiate ->
+     {ok, Version} = application:get_env(ssl, protocol_version),
+     case check_sane_openssl_renegotaite(Config, Version) of
+         {skip, _} = Skip ->
+             Skip;
+         _ ->
+             check_openssl_alpn_support(Config)
+     end;
 
 special_init(TestCase, Config)
-    when TestCase == erlang_client_alpn_npn_openssl_server_alpn_npn;
-         TestCase == erlang_server_alpn_npn_openssl_client_alpn_npn ->
+  when TestCase == erlang_client_alpn_npn_openssl_server_alpn_npn;
+       TestCase == erlang_server_alpn_npn_openssl_client_alpn_npn ->
     case check_openssl_alpn_support(Config) of
         {skip, _} = Skip ->
             Skip;
         _ ->
-            check_openssl_npn_support(Config)
+             check_openssl_npn_support(Config)
     end;
 
 special_init(TestCase, Config)
-    when TestCase == erlang_client_openssl_server_npn;
-         TestCase == erlang_server_openssl_client_npn;        
-         TestCase == erlang_server_openssl_client_npn_only_server;
-         TestCase == erlang_server_openssl_client_npn_only_client;
-         TestCase == erlang_client_openssl_server_npn_only_client;
-         TestCase == erlang_client_openssl_server_npn_only_server ->
+  when TestCase == erlang_client_openssl_server_npn;
+       TestCase == erlang_server_openssl_client_npn;
+       TestCase == erlang_server_openssl_client_npn_only_server;
+       TestCase == erlang_server_openssl_client_npn_only_client;
+       TestCase == erlang_client_openssl_server_npn_only_client;
+       TestCase == erlang_client_openssl_server_npn_only_server ->
     check_openssl_npn_support(Config);
 
 special_init(TestCase, Config)
   when TestCase == erlang_server_openssl_client_npn_renegotiate;
        TestCase == erlang_client_openssl_server_npn_renegotiate ->
     {ok, Version} = application:get_env(ssl, protocol_version),
-    case check_sane_openssl_renegotaite(Config, Version) of
-	{skip, _} = Skip ->
-	    Skip;
-	_ -> 
-	    check_openssl_npn_support(Config)
-    end;
+     case check_sane_openssl_renegotaite(Config, Version) of
+         {skip, _} = Skip ->
+             Skip;
+         _ ->
+             check_openssl_npn_support(Config)
+     end;
 
 special_init(TestCase, Config0)
   when TestCase == erlang_server_openssl_client_sni_match;
@@ -305,25 +298,25 @@ special_init(TestCase, Config0)
        TestCase == erlang_server_openssl_client_sni_match_fun;
        TestCase == erlang_server_openssl_client_sni_no_match_fun;
        TestCase == erlang_server_openssl_client_sni_no_header_fun ->
-    RsaOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config0),
+     RsaOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config0),
     Config = [{sni_server_opts, [{sni_hosts,
                                   [{"a.server", [
                                                  {certfile, proplists:get_value(certfile, RsaOpts)},
                                                  {keyfile,  proplists:get_value(keyfile, RsaOpts)}
                                                 ]},
                                    {"b.server", [
-                                                 {certfile, proplists:get_value(certfile, RsaOpts)},
+                                                  {certfile, proplists:get_value(certfile, RsaOpts)},
                                                  {keyfile, proplists:get_value(keyfile, RsaOpts)}
                                                 ]}
                                   ]}]} | Config0], 
     check_openssl_sni_support(Config);
 
 special_init(_, Config) ->
-    Config.
+     Config.
 
 end_per_testcase(reuse_session_expired, Config) ->
     application:unset_env(ssl, session_lifetime),
-    Config;
+     Config;
 end_per_testcase(_, Config) ->
     Config.
 
@@ -346,8 +339,8 @@ basic_erlang_client_openssl_server(Config) when is_list(Config) ->
     KeyFile = proplists:get_value(keyfile, ServerOpts),
 
     Exe = "openssl",
-    Args = ["s_server", "-accept", integer_to_list(Port), 
-	    "-cert", CertFile, "-key", KeyFile], 
+     Args = ["s_server", "-accept", integer_to_list(Port),
+             "-cert", CertFile, "-key", KeyFile],
 
     OpensslPort = ssl_test_lib:portable_open_port(Exe, Args), 
 
@@ -355,15 +348,15 @@ basic_erlang_client_openssl_server(Config) when is_list(Config) ->
     ssl_test_lib:wait_for_openssl_server(Port, tls),
 
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {?MODULE, 
-					       erlang_ssl_receive, [Data]}},
-					{options, ClientOpts}]),
+                                         {host, Hostname},
+                                        {from, self()},
+                                        {mfa, {?MODULE,
+                                               erlang_ssl_receive, [Data]}},
+                                         {options, ClientOpts}]),
     true = port_command(OpensslPort, Data),
     
     ssl_test_lib:check_result(Client, ok),
-  
+
     %% Clean close down!   Server needs to be closed first !!
     ssl_test_lib:close_port(OpensslPort),
     ssl_test_lib:close(Client),
@@ -375,23 +368,20 @@ basic_erlang_server_openssl_client() ->
 basic_erlang_server_openssl_client(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
-    V2Compat = proplists:get_value(v2_hello_compatible, Config), 
 
     {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     
     Data = "From openssl to erlang",
-    ct:pal("v2_hello_compatible: ~p", [V2Compat]),
-
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-					{mfa, {?MODULE, erlang_ssl_receive, [Data]}},
-					{options,[{v2_hello_compatible, V2Compat} | ServerOpts]}]),
+                                        {from, self()},
+                                        {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
+                                        {options,ServerOpts}]),
 
     Port = ssl_test_lib:inet_port(Server),
     
     Exe = "openssl",
     Args = ["s_client", "-connect", hostname_format(Hostname) ++
-                ":" ++ integer_to_list(Port) | workaround_openssl_s_clinent()],
+                ":" ++ integer_to_list(Port) ++ no_v2_flag() | workaround_openssl_s_clinent()],
     
     OpenSslPort = ssl_test_lib:portable_open_port(Exe, Args), 
     true = port_command(OpenSslPort, Data),
@@ -421,19 +411,19 @@ erlang_client_openssl_server(Config) when is_list(Config) ->
     Version = ssl_test_lib:protocol_version(Config),
     Exe = "openssl",
     Args = ["s_server", "-accept", integer_to_list(Port),
-	    ssl_test_lib:version_flag(Version), 
-	    "-cert", CertFile, "-key", KeyFile],
-	
+            ssl_test_lib:version_flag(Version),
+            "-cert", CertFile, "-key", KeyFile],
+
     OpensslPort =  ssl_test_lib:portable_open_port(Exe, Args), 
 
     ssl_test_lib:wait_for_openssl_server(Port, proplists:get_value(protocol, Config)),
 
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {?MODULE, 
-					       erlang_ssl_receive, [Data]}},
-					{options, ClientOpts}]),
+                                        {host, Hostname},
+                                        {from, self()},
+                                        {mfa, {?MODULE,
+                                                erlang_ssl_receive, [Data]}},
+                                        {options, ClientOpts}]),
     true = port_command(OpensslPort, Data),
     
     ssl_test_lib:check_result(Client, ok),
@@ -449,24 +439,24 @@ erlang_server_openssl_client() ->
 erlang_server_openssl_client(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
-
-    {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     
+    {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+
     Data = "From openssl to erlang",
 
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-			   {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
-			   {options, ServerOpts}]),
+                                         {from, self()},
+                                        {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
+                                        {options, ServerOpts}]),
     Port = ssl_test_lib:inet_port(Server),
     Version = ssl_test_lib:protocol_version(Config),
 
     Exe = "openssl",
     Args = ["s_client", "-connect", hostname_format(Hostname) ++":" ++ integer_to_list(Port), 
-	    ssl_test_lib:version_flag(Version)],
-
-    OpenSslPort =  ssl_test_lib:portable_open_port(Exe, Args), 
+             ssl_test_lib:version_flag(Version)],
     
+    OpenSslPort =  ssl_test_lib:portable_open_port(Exe, Args),
+
     true = port_command(OpenSslPort, Data),
     
     ssl_test_lib:check_result(Server, ok),
@@ -483,8 +473,8 @@ erlang_client_openssl_server_dsa_cert(Config) when is_list(Config) ->
     ClientOpts = ssl_test_lib:ssl_options(client_dsa_opts, Config),
     ServerOpts = ssl_test_lib:ssl_options(server_dsa_verify_opts, Config),
 
-    {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
-  
+     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
+
     Data = "From openssl to erlang",
 
     Port = ssl_test_lib:inet_port(node()),
@@ -494,27 +484,27 @@ erlang_client_openssl_server_dsa_cert(Config) when is_list(Config) ->
     Version = ssl_test_lib:protocol_version(Config),
     Exe = "openssl",
     Args = ["s_server", "-accept", integer_to_list(Port),
-	    ssl_test_lib:version_flag(Version),
-	    "-cert", CertFile, "-CAfile", CaCertFile,  
-	    "-key", KeyFile, "-Verify", "2", "-msg"],
+            ssl_test_lib:version_flag(Version),
+            "-cert", CertFile, "-CAfile", CaCertFile,
+             "-key", KeyFile, "-Verify", "2", "-msg"],
 
     OpensslPort =  ssl_test_lib:portable_open_port(Exe, Args), 
 
     ssl_test_lib:wait_for_openssl_server(Port, proplists:get_value(protocol, Config)),
 
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {?MODULE, 
-					       erlang_ssl_receive, [Data]}},
-					{options, ClientOpts}]),
+                                        {host, Hostname},
+                                        {from, self()},
+                                        {mfa, {?MODULE,
+                                               erlang_ssl_receive, [Data]}},
+                                        {options, ClientOpts}]),
 
     true = port_command(OpensslPort, Data),
     
-    ssl_test_lib:check_result(Client, ok), 
-   
+     ssl_test_lib:check_result(Client, ok),
+
     %% Clean close down!   Server needs to be closed first !!
-    ssl_test_lib:close_port(OpensslPort),
+     ssl_test_lib:close_port(OpensslPort),
     ssl_test_lib:close(Client),
     process_flag(trap_exit, false),
     ok.
@@ -534,17 +524,17 @@ erlang_server_openssl_client_dsa_cert(Config) when is_list(Config) ->
     KeyFile = proplists:get_value(keyfile, ClientOpts),
 
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
-                                       {from, self()},
-                          {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
-                          {options, ServerOpts}]),
+                                        {from, self()},
+                                        {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
+                                        {options, ServerOpts}]),
     Port = ssl_test_lib:inet_port(Server),
     Version = ssl_test_lib:protocol_version(Config),
     Exe = "openssl",
     Args = ["s_client", "-connect", hostname_format(Hostname) ++ ":" ++ integer_to_list(Port),
-	    ssl_test_lib:version_flag(Version),
-	    "-cert", CertFile,
-	    "-CAfile", CaCertFile,
-	    "-key", KeyFile, "-msg"],
+            ssl_test_lib:version_flag(Version),
+            "-cert", CertFile,
+            "-CAfile", CaCertFile,
+            "-key", KeyFile, "-msg"],
 
     OpenSslPort = ssl_test_lib:portable_open_port(Exe, Args), 
     true = port_command(OpenSslPort, Data),
@@ -556,11 +546,11 @@ erlang_server_openssl_client_dsa_cert(Config) when is_list(Config) ->
     ssl_test_lib:close_port(OpenSslPort),
     process_flag(trap_exit, false).
 
-%%--------------------------------------------------------------------
+ %%--------------------------------------------------------------------
 erlang_client_openssl_server_anon() ->
-    [{doc,"Test erlang client with openssl server, anonymous"}].
+     [{doc,"Test erlang client with openssl server, anonymous"}].
 erlang_client_openssl_server_anon(Config) when is_list(Config) ->
-    process_flag(trap_exit, true),
+     process_flag(trap_exit, true),
     %% OpenSSL expects a certificate and key, even if the cipher spec
     %% is restructed to aNULL, so we use 'server_rsa_opts' here
     ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
@@ -578,27 +568,27 @@ erlang_client_openssl_server_anon(Config) when is_list(Config) ->
     Version = ssl_test_lib:protocol_version(Config),
     Exe = "openssl",
     Args = ["s_server", "-accept", integer_to_list(Port),
-	    ssl_test_lib:version_flag(Version),
+            ssl_test_lib:version_flag(Version),
             "-cert", CertFile, "-key", KeyFile,
-	    "-cipher", "aNULL", "-msg"],
+            "-cipher", "aNULL", "-msg"],
 
     OpensslPort =  ssl_test_lib:portable_open_port(Exe, Args),
 
     ssl_test_lib:wait_for_openssl_server(Port, proplists:get_value(protocol, Config)),
 
-    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
-					{host, Hostname},
-					{from, self()},
-					{mfa, {?MODULE,
-					       erlang_ssl_receive, [Data]}},
-					{options, [{ciphers, Ciphers} | ClientOpts]}]),
+     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+                                         {host, Hostname},
+                                         {from, self()},
+                                         {mfa, {?MODULE,
+                                                erlang_ssl_receive, [Data]}},
+                                         {options, [{ciphers, Ciphers} | ClientOpts]}]),
 
     true = port_command(OpensslPort, Data),
 
     ssl_test_lib:check_result(Client, ok),
 
     %% Clean close down!   Server needs to be closed first !!
-    ssl_test_lib:close_port(OpensslPort),
+     ssl_test_lib:close_port(OpensslPort),
     ssl_test_lib:close(Client),
     process_flag(trap_exit, false),
     ok.
@@ -616,30 +606,30 @@ erlang_server_openssl_client_anon(Config) when is_list(Config) ->
     Data = "From openssl to erlang",
 
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
-                                       {from, self()},
-                                       {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
-                                       {options, [{ciphers, Ciphers} | ServerOpts]}]),
+                                        {from, self()},
+                                        {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
+                                        {options, [{ciphers, Ciphers} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
     Version = ssl_test_lib:protocol_version(Config),
     Exe = "openssl",
     Args = ["s_client", "-connect", hostname_format(Hostname) ++ ":" ++ integer_to_list(Port),
-	    ssl_test_lib:version_flag(Version),
-	    "-cipher", "aNULL", "-msg"],
+             ssl_test_lib:version_flag(Version),
+            "-cipher", "aNULL", "-msg"],
 
     OpenSslPort = ssl_test_lib:portable_open_port(Exe, Args),
     true = port_command(OpenSslPort, Data),
 
-    ssl_test_lib:check_result(Server, ok),
+     ssl_test_lib:check_result(Server, ok),
 
     %% Clean close down!   Server needs to be closed first !!
-    ssl_test_lib:close(Server),
+     ssl_test_lib:close(Server),
     ssl_test_lib:close_port(OpenSslPort),
     process_flag(trap_exit, false).
 
-  %%--------------------------------------------------------------------
-  erlang_server_openssl_client_anon_with_cert() ->
-    [{doc,"Test erlang server with openssl client, anonymous (with cert)"}].
-  erlang_server_openssl_client_anon_with_cert(Config) when is_list(Config) ->
+%%--------------------------------------------------------------------
+erlang_server_openssl_client_anon_with_cert() ->
+     [{doc,"Test erlang server with openssl client, anonymous (with cert)"}].
+erlang_server_openssl_client_anon_with_cert(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
     VersionTuple = ssl_test_lib:protocol_version(Config, tuple),
@@ -650,15 +640,15 @@ erlang_server_openssl_client_anon(Config) when is_list(Config) ->
     Data = "From openssl to erlang",
 
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
-                                       {from, self()},
-                                       {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
-                                       {options, [{ciphers, Ciphers} | ServerOpts]}]),
+                                        {from, self()},
+                                        {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
+                                        {options, [{ciphers, Ciphers} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
     Version = ssl_test_lib:protocol_version(Config),
     Exe = "openssl",
     Args = ["s_client", "-connect", hostname_format(Hostname) ++ ":" ++ integer_to_list(Port),
-  	    ssl_test_lib:version_flag(Version),
-  	    "-cipher", "aNULL", "-msg"],
+            ssl_test_lib:version_flag(Version),
+            "-cipher", "aNULL", "-msg"],
 
     OpenSslPort = ssl_test_lib:portable_open_port(Exe, Args),
     true = port_command(OpenSslPort, Data),
@@ -670,11 +660,10 @@ erlang_server_openssl_client_anon(Config) when is_list(Config) ->
     ssl_test_lib:close_port(OpenSslPort),
     process_flag(trap_exit, false).
 
-%%--------------------------------------------------------------------
-
+ %%--------------------------------------------------------------------
 erlang_server_openssl_client_reuse_session() ->
     [{doc, "Test erlang server with openssl client that reconnects with the"
-     "same session id, to test reusing of sessions."}].
+      "same session id, to test reusing of sessions."}].
 erlang_server_openssl_client_reuse_session(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
@@ -684,18 +673,18 @@ erlang_server_openssl_client_reuse_session(Config) when is_list(Config) ->
     Data = "From openssl to erlang",
 
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-			   {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
-			   {reconnect_times, 5},		
-			   {options, ServerOpts}]),
+                                        {from, self()},
+                                        {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
+                                        {reconnect_times, 5},
+                                        {options, ServerOpts}]),
     Port = ssl_test_lib:inet_port(Server),
     Version = ssl_test_lib:protocol_version(Config),
-    
+
     Exe = "openssl",
     Args = ["s_client", "-connect", hostname_format(Hostname)
             ++ ":" ++ integer_to_list(Port),
-	    ssl_test_lib:version_flag(Version),
-	    "-reconnect"],
+            ssl_test_lib:version_flag(Version),
+            "-reconnect"],
     
     OpenSslPort =  ssl_test_lib:portable_open_port(Exe, Args),
 
@@ -706,7 +695,7 @@ erlang_server_openssl_client_reuse_session(Config) when is_list(Config) ->
     %% Clean close down!   Server needs to be closed first !!
     ssl_test_lib:close(Server),
     ssl_test_lib:close_port(OpenSslPort),
-    process_flag(trap_exit, false),
+     process_flag(trap_exit, false),
     ok.
 
 %%--------------------------------------------------------------------
@@ -730,46 +719,46 @@ erlang_client_openssl_server_renegotiate(Config) when is_list(Config) ->
 
     Exe = "openssl",
     Args = ["s_server", "-accept", integer_to_list(Port),  
-	    ssl_test_lib:version_flag(Version), 
-	    "-cert", CertFile, "-key", KeyFile, "-msg"], 
+            ssl_test_lib:version_flag(Version),
+            "-cert", CertFile, "-key", KeyFile, "-msg"],
     
     OpensslPort =  ssl_test_lib:portable_open_port(Exe, Args), 
 
     ssl_test_lib:wait_for_openssl_server(Port, proplists:get_value(protocol, Config)),
 
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {?MODULE, 
-					       delayed_send, [[ErlData, OpenSslData]]}},
-					{options, ClientOpts}]),
+                                        {host, Hostname},
+                                        {from, self()},
+                                        {mfa, {?MODULE,
+                                               delayed_send, [[ErlData, OpenSslData]]}},
+                                         {options, ClientOpts}]),
 
     true = port_command(OpensslPort, ?OPENSSL_RENEGOTIATE),
     ct:sleep(?SLEEP),
     true = port_command(OpensslPort, OpenSslData),
     
     ssl_test_lib:check_result(Client, ok), 
-   
-    %% Clean close down!   Server needs to be closed first !!
+
+     %% Clean close down!   Server needs to be closed first !!
     ssl_test_lib:close_port(OpensslPort),
     ssl_test_lib:close(Client),
-    process_flag(trap_exit, false),
+     process_flag(trap_exit, false),
     ok.
 
 %%--------------------------------------------------------------------
 
 erlang_client_openssl_server_nowrap_seqnum() ->
     [{doc, "Test that erlang client will renegotiate session when",
-     "max sequence number celing is about to be reached. Although"
-     "in the testcase we use the test option renegotiate_at" 
-     " to lower treashold substantially."}].
+      "max sequence number celing is about to be reached. Although"
+      "in the testcase we use the test option renegotiate_at"
+      " to lower treashold substantially."}].
 erlang_client_openssl_server_nowrap_seqnum(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
     ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
-    
+
     ErlData = "From erlang to openssl\n",
     N = 10,
 
@@ -779,21 +768,21 @@ erlang_client_openssl_server_nowrap_seqnum(Config) when is_list(Config) ->
     Version = ssl_test_lib:protocol_version(Config),
     Exe = "openssl",
     Args = ["s_server", "-accept", integer_to_list(Port),
-	    ssl_test_lib:version_flag(Version),
-	    "-cert", CertFile, "-key", KeyFile, "-msg"], 
-    
+            ssl_test_lib:version_flag(Version),
+            "-cert", CertFile, "-key", KeyFile, "-msg"],
+
     OpensslPort = ssl_test_lib:portable_open_port(Exe, Args),
 
     ssl_test_lib:wait_for_openssl_server(Port, proplists:get_value(protocol, Config)),
 
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {ssl_test_lib, 
-					       trigger_renegotiate, [[ErlData, N+2]]}},
-					{options, [{reuse_sessions, false},
-						   {renegotiate_at, N} | ClientOpts]}]),
-    
+                                        {host, Hostname},
+                                        {from, self()},
+                                        {mfa, {ssl_test_lib,
+                                               trigger_renegotiate, [[ErlData, N+2]]}},
+                                        {options, [{reuse_sessions, false},
+                                                   {renegotiate_at, N} | ClientOpts]}]),
+
     ssl_test_lib:check_result(Client, ok), 
 
     %% Clean close down!   Server needs to be closed first !!
@@ -803,37 +792,37 @@ erlang_client_openssl_server_nowrap_seqnum(Config) when is_list(Config) ->
 %%--------------------------------------------------------------------
 erlang_server_openssl_client_nowrap_seqnum() ->
     [{doc, "Test that erlang client will renegotiate session when",
-     "max sequence number celing is about to be reached. Although"
-     "in the testcase we use the test option renegotiate_at" 
-     " to lower treashold substantially."}].
+      "max sequence number celing is about to be reached. Although"
+      "in the testcase we use the test option renegotiate_at"
+      " to lower treashold substantially."}].
 erlang_server_openssl_client_nowrap_seqnum(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
 
     {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    
+
     Data = "From openssl to erlang",
-    
+
     N = 10,
 
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-					{mfa, {ssl_test_lib, 
-					       trigger_renegotiate, [[Data, N+2]]}},
-					{options, [{renegotiate_at, N}, {reuse_sessions, false} | ServerOpts]}]),
+                                        {from, self()},
+                                        {mfa, {ssl_test_lib,
+                                               trigger_renegotiate, [[Data, N+2]]}},
+                                        {options, [{renegotiate_at, N}, {reuse_sessions, false} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
     Version = ssl_test_lib:protocol_version(Config),
     Exe = "openssl", 
     Args = ["s_client","-connect", hostname_format(Hostname) ++ ":" ++ integer_to_list(Port),
-	    ssl_test_lib:version_flag(Version),
-	    "-msg"],
-    
+            ssl_test_lib:version_flag(Version),
+            "-msg"],
+
     OpenSslPort = ssl_test_lib:portable_open_port(Exe, Args), 
 
     true = port_command(OpenSslPort, Data),
-    
+
     ssl_test_lib:check_result(Server, ok),
-    
+
     %% Clean close down!   Server needs to be closed first !!
     ssl_test_lib:close(Server),
     ssl_test_lib:close_port(OpenSslPort),
@@ -843,15 +832,15 @@ erlang_server_openssl_client_nowrap_seqnum(Config) when is_list(Config) ->
 
 erlang_client_openssl_server_no_server_ca_cert() ->
     [{doc, "Test erlang client when openssl server sends a cert chain not"
-     "including the ca cert. Explicitly test this even if it is"
-     "implicitly tested eleswhere."}].
+      "including the ca cert. Explicitly test this even if it is"
+      "implicitly tested eleswhere."}].
 erlang_client_openssl_server_no_server_ca_cert(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
     ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
-    
+
     Data = "From openssl to erlang",
 
     Port = ssl_test_lib:inet_port(node()),
@@ -860,22 +849,22 @@ erlang_client_openssl_server_no_server_ca_cert(Config) when is_list(Config) ->
     Version = ssl_test_lib:protocol_version(Config),
     Exe = "openssl",
     Args = ["s_server", "-accept", integer_to_list(Port), 
-	    ssl_test_lib:version_flag(Version),
-	    "-cert", CertFile, "-key", KeyFile, "-msg"], 
-    
+            ssl_test_lib:version_flag(Version),
+            "-cert", CertFile, "-key", KeyFile, "-msg"],
+
     OpensslPort =  ssl_test_lib:portable_open_port(Exe, Args), 
- 
+
     ssl_test_lib:wait_for_openssl_server(Port, proplists:get_value(protocol, Config)),
 
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {?MODULE, 
-					       erlang_ssl_receive, [Data]}},
-					{options, ClientOpts}]),
+                                        {host, Hostname},
+                                        {from, self()},
+                                        {mfa, {?MODULE,
+                                               erlang_ssl_receive, [Data]}},
+                                        {options, ClientOpts}]),
 
     true = port_command(OpensslPort, Data),
-    
+
     ssl_test_lib:check_result(Client, ok), 
 
     %% Clean close down!   Server needs to be closed first !!
@@ -892,9 +881,9 @@ erlang_client_openssl_server_client_cert(Config) when is_list(Config) ->
     ClientOpts = ssl_test_lib:ssl_options(client_rsa_verify_opts, Config),
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
-    
+
     Data = "From openssl to erlang",
-    
+
     Port = ssl_test_lib:inet_port(node()),
     CertFile = proplists:get_value(certfile, ServerOpts),
     CaCertFile = proplists:get_value(cacertfile, ServerOpts),
@@ -902,31 +891,30 @@ erlang_client_openssl_server_client_cert(Config) when is_list(Config) ->
     Version = ssl_test_lib:protocol_version(Config),
     Exe = "openssl",
     Args = ["s_server", "-accept", integer_to_list(Port),
-	    ssl_test_lib:version_flag(Version),
-	    "-cert", CertFile, "-CAfile", CaCertFile, 
-	    "-key", KeyFile, "-Verify", "2"],
-    
+            ssl_test_lib:version_flag(Version),
+            "-cert", CertFile, "-CAfile", CaCertFile,
+            "-key", KeyFile, "-Verify", "2"],
+
     OpensslPort = ssl_test_lib:portable_open_port(Exe, Args),   
 
     ssl_test_lib:wait_for_openssl_server(Port, proplists:get_value(protocol, Config)),
 
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {?MODULE, 
-					       erlang_ssl_receive, [Data]}},
-					{options, ClientOpts}]),
+                                        {host, Hostname},
+                                        {from, self()},
+                                        {mfa, {?MODULE,
+                                               erlang_ssl_receive, [Data]}},
+                                        {options, ClientOpts}]),
     true = port_command(OpensslPort, Data),
-    
+
     ssl_test_lib:check_result(Client, ok),
-  
+
     %% Clean close down!   Server needs to be closed first !!
     ssl_test_lib:close_port(OpensslPort), 
     ssl_test_lib:close(Client),
     process_flag(trap_exit, false).
 
 %%--------------------------------------------------------------------  
-
 erlang_server_openssl_client_client_cert() ->
     [{doc,"Test erlang server with openssl client when client sends cert"}].
 erlang_server_openssl_client_client_cert(Config) when is_list(Config) ->
@@ -935,39 +923,38 @@ erlang_server_openssl_client_client_cert(Config) when is_list(Config) ->
     ClientOpts = ssl_test_lib:ssl_options(client_rsa_verify_opts, Config),
 
     {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    
+
     Data = "From openssl to erlang",
 
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-					{mfa, {?MODULE, 
-					       erlang_ssl_receive, [Data]}},
-					{options, 
-					 [{verify , verify_peer} 
-					  | ServerOpts]}]),
+                                        {from, self()},
+                                        {mfa, {?MODULE,
+                                               erlang_ssl_receive, [Data]}},
+                                        {options,
+                                         [{verify , verify_peer}
+                                          | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
-    
+
     CaCertFile = proplists:get_value(cacertfile, ClientOpts),
     CertFile = proplists:get_value(certfile, ClientOpts),
     KeyFile = proplists:get_value(keyfile, ClientOpts),
     Version = ssl_test_lib:protocol_version(Config),
     Exe = "openssl",
     Args = ["s_client", "-cert", CertFile,
-	   "-CAfile", CaCertFile, 
-	   "-key", KeyFile,"-connect", hostname_format(Hostname) ++ ":" ++ integer_to_list(Port),
-	   ssl_test_lib:version_flag(Version)],
+            "-CAfile", CaCertFile,
+            "-key", KeyFile,"-connect", hostname_format(Hostname) ++ ":" ++ integer_to_list(Port),
+            ssl_test_lib:version_flag(Version)],
     OpenSslPort = ssl_test_lib:portable_open_port(Exe, Args), 
 
     true = port_command(OpenSslPort, Data),    
     ssl_test_lib:check_result(Server, ok),
-    
+
     %% Clean close down!   Server needs to be closed first !!
     ssl_test_lib:close_port(OpenSslPort),
     ssl_test_lib:close(Server),
     process_flag(trap_exit, false).
 
 %%--------------------------------------------------------------------  
-
 erlang_server_erlang_client_client_cert() ->
     [{doc,"Test erlang server with erlang client when client sends cert"}].
 erlang_server_erlang_client_client_cert(Config) when is_list(Config) ->
@@ -976,30 +963,30 @@ erlang_server_erlang_client_client_cert(Config) when is_list(Config) ->
     ClientOpts = proplists:get_value(client_rsa_verify_opts, Config),  
     Version = ssl_test_lib:protocol_version(Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    
+
     Data = "From erlang to erlang",
 
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-					{mfa, {?MODULE, 
-					       erlang_ssl_receive, 
-					       %% Due to 1/n-1 splitting countermeasure Rizzo/Duong-Beast
-					       [Data]}},
-					{options, 
-					 [{verify , verify_peer} 
-					  | ServerOpts]}]),
+                                        {from, self()},
+                                        {mfa, {?MODULE,
+                                               erlang_ssl_receive,
+                                               %% Due to 1/n-1 splitting countermeasure Rizzo/Duong-Beast
+                                               [Data]}},
+                                        {options,
+                                         [{verify , verify_peer}
+                                          | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
-    
+
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					%% Due to 1/n-1 splitting countermeasure Rizzo/Duong-Beast
-					{mfa, {ssl, send, [Data]}},
-					{options, 
-					 [{versions, [Version]} | ClientOpts]}]),
-    
+                                        {host, Hostname},
+                                        {from, self()},
+                                        %% Due to 1/n-1 splitting countermeasure Rizzo/Duong-Beast
+                                        {mfa, {ssl, send, [Data]}},
+                                        {options,
+                                         [{versions, [Version]} | ClientOpts]}]),
+
     ssl_test_lib:check_result(Server, ok, Client, ok),
-    
+
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client),
     process_flag(trap_exit, false).
@@ -1031,43 +1018,43 @@ erlang_client_bad_openssl_server(Config) when is_list(Config) ->
     ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
-    
+
     Port = ssl_test_lib:inet_port(node()),
     CertFile = proplists:get_value(certfile, ServerOpts),
     KeyFile = proplists:get_value(keyfile, ServerOpts),
     Version = ssl_test_lib:protocol_version(Config),
     Exe = "openssl",
     Args = ["s_server", "-accept", integer_to_list(Port), ssl_test_lib:version_flag(Version),
- 	"-cert", CertFile, "-key", KeyFile],
+            "-cert", CertFile, "-key", KeyFile],
     OpensslPort = ssl_test_lib:portable_open_port(Exe, Args), 
-    
+
     ssl_test_lib:wait_for_openssl_server(Port, proplists:get_value(protocol, Config)),
-    
+
     Client0 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					 {host, Hostname},
-					 {from, self()}, 
- 					{mfa, {?MODULE, server_sent_garbage, []}},
-					 {options,
-					  [{versions, [Version]} | ClientOpts]}]),
-    
+                                         {host, Hostname},
+                                         {from, self()},
+                                         {mfa, {?MODULE, server_sent_garbage, []}},
+                                         {options,
+                                          [{versions, [Version]} | ClientOpts]}]),
+
     %% Send garbage
     true = port_command(OpensslPort, ?OPENSSL_GARBAGE),
 
     ct:sleep(?SLEEP),
 
     Client0 ! server_sent_garbage,
-    
+
     ssl_test_lib:check_result(Client0, true),
-    
+
     ssl_test_lib:close(Client0),
-    
+
     %% Make sure openssl does not hang and leave zombie process
     Client1 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
- 					 {host, Hostname},
- 					 {from, self()},
- 					 {mfa, {ssl_test_lib, no_result_msg, []}},
- 					 {options,
-					  [{versions, [Version]} | ClientOpts]}]),
+                                         {host, Hostname},
+                                         {from, self()},
+                                         {mfa, {ssl_test_lib, no_result_msg, []}},
+                                         {options,
+                                          [{versions, [Version]} | ClientOpts]}]),
 
     %% Clean close down!   Server needs to be closed first !!
     ssl_test_lib:close_port(OpensslPort),
@@ -1092,38 +1079,38 @@ expired_session(Config) when is_list(Config) ->
 
     Exe = "openssl",
     Args = ["s_server", "-accept", integer_to_list(Port),
-	"-cert", CertFile,"-key", KeyFile], 
-    
+            "-cert", CertFile,"-key", KeyFile],
+
     OpensslPort = ssl_test_lib:portable_open_port(Exe, Args), 
 
     ssl_test_lib:wait_for_openssl_server(Port, tls),
-    
+
     Client0 =
-	ssl_test_lib:start_client([{node, ClientNode}, 
-		      {port, Port}, {host, Hostname},
-			    {mfa, {ssl_test_lib, no_result, []}},
-		      {from, self()},  {options, ClientOpts}]),   
-         
+        ssl_test_lib:start_client([{node, ClientNode},
+                                   {port, Port}, {host, Hostname},
+                                   {mfa, {ssl_test_lib, no_result, []}},
+                                   {from, self()},  {options, ClientOpts}]),
+
     ssl_test_lib:close(Client0),
 
     %% Make sure session is registered
     ct:sleep(?SLEEP),
 
     Client1 =
-	ssl_test_lib:start_client([{node, ClientNode}, 
-				   {port, Port}, {host, Hostname},
-				   {mfa, {ssl_test_lib, no_result, []}},
-				   {from, self()},  {options, ClientOpts}]),  
-    
+        ssl_test_lib:start_client([{node, ClientNode},
+                                   {port, Port}, {host, Hostname},
+                                   {mfa, {ssl_test_lib, no_result, []}},
+                                   {from, self()},  {options, ClientOpts}]),
+
     ssl_test_lib:close(Client1),
     %% Make sure session is unregistered due to expiration
     ct:sleep((?EXPIRE+1) * 1000),
-    
+
     Client2 =
-	ssl_test_lib:start_client([{node, ClientNode}, 
-				   {port, Port}, {host, Hostname},
-				   {mfa, {ssl_test_lib, no_result, []}},
-				   {from, self()},  {options, ClientOpts}]),  
+        ssl_test_lib:start_client([{node, ClientNode},
+                                   {port, Port}, {host, Hostname},
+                                   {mfa, {ssl_test_lib, no_result, []}},
+                                   {from, self()},  {options, ClientOpts}]),
 
     %% Clean close down!   Server needs to be closed first !!
     ssl_test_lib:close_port(OpensslPort),
@@ -1139,52 +1126,21 @@ ssl2_erlang_server_openssl_client(Config) when is_list(Config) ->
     ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
 
     {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    
-    Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0}, 
-					      {from, self()}, 
-					      {options, ServerOpts}]),
-    Port = ssl_test_lib:inet_port(Server),
-    
-    Exe = "openssl",
-    Args = ["s_client", "-connect", hostname_format(Hostname) ++ ":" ++ integer_to_list(Port), 
-	"-ssl2", "-msg"],
-    
-    OpenSslPort = ssl_test_lib:portable_open_port(Exe, Args),  
-    
-    ct:log("Ports ~p~n", [[erlang:port_info(P) || P <- erlang:ports()]]), 
-    consume_port_exit(OpenSslPort),
-    ssl_test_lib:check_result(Server, {error, {tls_alert, "bad record mac"}}),
-    process_flag(trap_exit, false).
-%%--------------------------------------------------------------------
-ssl2_erlang_server_openssl_client_comp() ->
-    [{doc,"Test that ssl v2 clients are rejected"}].
-
-ssl2_erlang_server_openssl_client_comp(Config) when is_list(Config) ->
-    process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
-    V2Compat = proplists:get_value(v2_hello_compatible, Config), 
-
-    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
-
-    {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    
-    Data = "From openssl to erlang",
 
     Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-			   {options, [{v2_hello_compatible, V2Compat} | ServerOpts]}]),
+                                              {from, self()},
+                                              {options, ServerOpts}]),
     Port = ssl_test_lib:inet_port(Server),
-    
+
     Exe = "openssl",
     Args = ["s_client", "-connect", hostname_format(Hostname) ++ ":" ++ integer_to_list(Port), 
-	"-ssl2", "-msg"],
-    
+            "-ssl2", "-msg"],
+
     OpenSslPort = ssl_test_lib:portable_open_port(Exe, Args),  
-    true = port_command(OpenSslPort, Data),
-    
+
     ct:log("Ports ~p~n", [[erlang:port_info(P) || P <- erlang:ports()]]), 
     consume_port_exit(OpenSslPort),
-    ssl_test_lib:check_result(Server, {error, {tls_alert, "protocol version"}}),
+    ssl_test_lib:check_result(Server, {error, {tls_alert, "bad record mac"}}),
     process_flag(trap_exit, false).
 
 %%--------------------------------------------------------------------
@@ -2012,3 +1968,11 @@ hostname_format(Hostname) ->
         false ->
             "localhost"   
     end.
+
+no_v2_flag() ->
+    case ssl_test_lib:supports_ssl_tls_version(sslv2) of
+        true ->
+            " -no_ssl2 ";
+        false ->
+            ""
+    end.