Merge branch 'ingela/ssl/better-interop-tests'

* ingela/ssl/better-interop-tests:
  ssl: Add new interop test suite
  ssl: Use diffrent digest for some TLS/DTLS versions

6 files changed, 875 insertions, 193 deletions

diff --git a/lib/ssl/test/Makefile b/lib/ssl/test/Makefile
index f7fae16088..dba90aaff0 100644
--- a/lib/ssl/test/Makefile
+++ b/lib/ssl/test/Makefile
@@ -44,6 +44,7 @@ MODULES = \
 	ssl_bench_SUITE \
 	ssl_cipher_SUITE \
         ssl_cipher_suite_SUITE \
+	openssl_server_cipher_suite_SUITE\
 	ssl_certificate_verify_SUITE\
 	ssl_crl_SUITE\
 	ssl_dist_SUITE \
diff --git a/lib/ssl/test/openssl_server_cipher_suite_SUITE.erl b/lib/ssl/test/openssl_server_cipher_suite_SUITE.erl
new file mode 100644
index 0000000000..907de1abe2
--- /dev/null
+++ b/lib/ssl/test/openssl_server_cipher_suite_SUITE.erl
@@ -0,0 +1,768 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2019-2019. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+%%
+
+-module(openssl_server_cipher_suite_SUITE).
+
+%% Note: This directive should only be used in test suites.
+-compile(export_all).
+
+-include_lib("common_test/include/ct.hrl").
+
+%%--------------------------------------------------------------------
+%% Common Test interface functions -----------------------------------
+%%--------------------------------------------------------------------
+all() -> 
+   [
+     {group, 'tlsv1.2'},
+     {group, 'tlsv1.1'},
+     {group, 'tlsv1'},
+     {group, 'sslv3'},
+     {group, 'dtlsv1.2'},
+     {group, 'dtlsv1'}
+    ].
+
+groups() ->
+    %% TODO: Enable SRP, PSK suites (needs OpenSSL s_server conf)
+    %% TODO: Enable all "kex" on DTLS
+    [
+     {'tlsv1.2', [], kex()},
+     {'tlsv1.1', [], kex()},
+     {'tlsv1', [], kex()},
+     {'sslv3', [], kex()},
+     {'dtlsv1.2', [], dtls_kex()},
+     {'dtlsv1', [], dtls_kex()},
+     {dhe_rsa, [],[dhe_rsa_3des_ede_cbc, 
+                   dhe_rsa_aes_128_cbc,
+                   dhe_rsa_aes_256_cbc,
+                   dhe_rsa_chacha20_poly1305
+                  ]},
+     {ecdhe_rsa, [], [ecdhe_rsa_3des_ede_cbc, 
+                      ecdhe_rsa_aes_128_cbc,
+                      ecdhe_rsa_aes_128_gcm,
+                      ecdhe_rsa_aes_256_cbc,
+                      ecdhe_rsa_aes_256_gcm,
+                      ecdhe_rsa_chacha20_poly1305
+                    ]},
+     {ecdhe_ecdsa, [],[ecdhe_ecdsa_rc4_128, 
+                       ecdhe_ecdsa_3des_ede_cbc, 
+                       ecdhe_ecdsa_aes_128_cbc,
+                       ecdhe_ecdsa_aes_128_gcm,
+                       ecdhe_ecdsa_aes_256_cbc,
+                       ecdhe_ecdsa_aes_256_gcm,
+                       ecdhe_ecdsa_chacha20_poly1305
+                      ]},
+     {rsa, [], [rsa_3des_ede_cbc, 
+                rsa_aes_128_cbc,
+                rsa_aes_256_cbc,
+                rsa_rc4_128
+               ]},
+     {dhe_dss, [], [dhe_dss_3des_ede_cbc, 
+                    dhe_dss_aes_128_cbc,
+                    dhe_dss_aes_256_cbc]},
+     %% {srp_rsa, [], [srp_rsa_3des_ede_cbc, 
+     %%                srp_rsa_aes_128_cbc,
+     %%                srp_rsa_aes_256_cbc]},
+     %% {srp_dss, [], [srp_dss_3des_ede_cbc, 
+     %%                srp_dss_aes_128_cbc,
+     %%                srp_dss_aes_256_cbc]},
+     %% {rsa_psk, [], [rsa_psk_3des_ede_cbc,                    
+     %%                rsa_psk_rc4_128,
+     %%                rsa_psk_aes_128_cbc,
+     %%                rsa_psk_aes_256_cbc
+     %%               ]},
+     {dh_anon, [], [dh_anon_rc4_128,
+                    dh_anon_3des_ede_cbc, 
+                    dh_anon_aes_128_cbc,
+                    dh_anon_aes_128_gcm,
+                    dh_anon_aes_256_cbc,
+                    dh_anon_aes_256_gcm]},
+     {ecdh_anon, [], [ecdh_anon_3des_ede_cbc, 
+                      ecdh_anon_aes_128_cbc,
+                      ecdh_anon_aes_256_cbc
+                     ]}    
+     %% {srp_anon, [], [srp_anon_3des_ede_cbc, 
+     %%                 srp_anon_aes_128_cbc,
+     %%                 srp_anon_aes_256_cbc]},
+     %% {psk, [], [psk_3des_ede_cbc,                    
+     %%            psk_rc4_128,
+     %%            psk_aes_128_cbc,
+     %%            psk_aes_128_ccm,
+     %%            psk_aes_128_ccm_8,
+     %%            psk_aes_256_cbc,
+     %%            psk_aes_256_ccm,
+     %%            psk_aes_256_ccm_8
+     %%           ]},
+     %% {dhe_psk, [], [dhe_psk_3des_ede_cbc,                    
+     %%                dhe_psk_rc4_128,
+     %%                dhe_psk_aes_128_cbc,
+     %%                dhe_psk_aes_128_ccm,
+     %%                dhe_psk_aes_128_ccm_8,
+     %%                dhe_psk_aes_256_cbc,
+     %%                dhe_psk_aes_256_ccm,
+     %%                dhe_psk_aes_256_ccm_8
+     %%           ]},
+     %% {ecdhe_psk, [], [ecdhe_psk_3des_ede_cbc,                    
+     %%                 ecdhe_psk_rc4_128,
+     %%                 ecdhe_psk_aes_128_cbc,
+     %%                 ecdhe_psk_aes_128_ccm,
+     %%                 ecdhe_psk_aes_128_ccm_8,
+     %%                 ecdhe_psk_aes_256_cbc
+     %%           ]}
+    ].
+
+kex() ->
+     rsa() ++ ecdsa() ++ dss() ++ anonymous().
+
+dtls_kex() -> %% Should be all kex in the future
+      dtls_rsa() ++ dss() ++ anonymous().
+
+rsa() ->
+    [{group, dhe_rsa},
+     {group, ecdhe_rsa},
+     {group, rsa} %%, {group, srp_rsa},
+     %%{group, rsa_psk}
+    ].
+
+dtls_rsa() ->
+    [
+     {group, rsa} 
+     %%,{group, rsa_psk}
+    ].
+
+ecdsa() ->
+    [{group, ecdhe_ecdsa}].
+    
+dss() ->
+    [{group, dhe_dss}
+     %%{group, srp_dss}
+    ].
+
+anonymous() ->
+    [{group, dh_anon},
+     {group, ecdh_anon}
+     %% {group, psk},
+     %%{group, dhe_psk},
+     %%{group, ecdhe_psk}
+     %%{group, srp_anon}
+    ].
+
+init_per_suite(Config) ->
+    catch crypto:stop(),
+    try crypto:start() of
+	ok ->
+	    ssl_test_lib:clean_start(),
+            Config
+    catch _:_ ->
+	    {skip, "Crypto did not start"}
+    end.
+
+end_per_suite(_Config) ->
+    ssl:stop(),
+    application:stop(crypto).
+
+%%--------------------------------------------------------------------
+init_per_group(GroupName, Config) ->
+       case ssl_test_lib:is_tls_version(GroupName) of
+           true ->
+               case ssl_test_lib:supports_ssl_tls_version(GroupName) of
+                   true ->
+                       do_init_per_group(GroupName, Config);
+                   false ->
+                       {skip, {openssl_does_not_support, GroupName}}
+               end;  
+           false ->
+               do_init_per_group(GroupName, Config)
+       end.
+
+do_init_per_group(GroupName, Config) when GroupName == ecdh_anon;
+                                       GroupName == ecdhe_rsa;
+                                       GroupName == ecdhe_psk ->
+    case proplists:get_bool(ecdh, proplists:get_value(public_keys, crypto:supports())) of
+        true ->
+            init_certs(GroupName, Config);
+        false ->
+            {skip, "Missing EC crypto support"}
+    end;
+do_init_per_group(ecdhe_ecdsa = GroupName, Config) ->
+    PKAlg = proplists:get_value(public_keys, crypto:supports()),
+    case lists:member(ecdh, PKAlg) andalso lists:member(ecdsa, PKAlg) of
+        true ->
+            init_certs(GroupName, Config);
+        false ->
+            {skip, "Missing EC crypto support"}
+    end;
+do_init_per_group(dhe_dss = GroupName, Config) ->
+    PKAlg = proplists:get_value(public_keys, crypto:supports()),
+    case lists:member(dss, PKAlg) andalso lists:member(dh, PKAlg) of
+        true ->
+            init_certs(GroupName, Config);
+        false ->
+            {skip, "Missing DSS crypto support"}
+    end;
+do_init_per_group(srp_dss = GroupName, Config) ->
+    PKAlg = proplists:get_value(public_keys, crypto:supports()),
+    case lists:member(dss, PKAlg) andalso lists:member(srp, PKAlg) of
+        true ->
+            init_certs(GroupName, Config);
+        false ->
+            {skip, "Missing DSS_SRP crypto support"}
+    end;
+do_init_per_group(GroupName, Config) when GroupName == srp_anon;
+                                       GroupName == srp_rsa ->
+    PKAlg = proplists:get_value(public_keys, crypto:supports()),
+    case lists:member(srp, PKAlg) of
+        true ->
+            init_certs(GroupName, Config);
+        false ->
+            {skip, "Missing SRP crypto support"}
+    end;
+do_init_per_group(dhe_psk = GroupName, Config) ->
+    PKAlg = proplists:get_value(public_keys, crypto:supports()),
+    case lists:member(dh, PKAlg) of
+        true ->
+            init_certs(GroupName, Config);
+        false ->
+            {skip, "Missing SRP crypto support"}
+    end;
+do_init_per_group(GroupName, Config0) ->
+    case ssl_test_lib:is_tls_version(GroupName) of
+        true ->
+            ssl_test_lib:init_tls_version(GroupName, end_per_group(GroupName, Config0));
+        false ->
+            init_certs(GroupName, Config0)
+    end.
+  
+end_per_group(GroupName, Config) ->
+  case ssl_test_lib:is_tls_version(GroupName) of
+      true ->
+          ssl_test_lib:clean_tls_version(Config);
+      false ->
+          Config
+  end.
+
+init_per_testcase(TestCase, Config) when TestCase == psk_3des_ede_cbc;
+                                         TestCase == srp_anon_3des_ede_cbc;
+                                         TestCase == dhe_psk_3des_ede_cbc;
+                                         TestCase == ecdhe_psk_3des_ede_cbc;
+                                         TestCase == srp_rsa_3des_ede_cbc;
+                                         TestCase == srp_dss_3des_ede_cbc;
+                                         TestCase == rsa_psk_3des_ede_cbc;
+                                         TestCase == rsa_3des_ede_cbc;
+                                         TestCase == dhe_rsa_3des_ede_cbc;
+                                         TestCase == dhe_dss_3des_ede_cbc;
+                                         TestCase == ecdhe_rsa_3des_ede_cbc;
+                                         TestCase == srp_anon_dss_3des_ede_cbc;
+                                         TestCase == dh_anon_3des_ede_cbc;
+                                         TestCase == ecdh_anon_3des_ede_cbc;
+                                         TestCase == ecdhe_ecdsa_3des_ede_cbc ->
+    SupCiphers = proplists:get_value(ciphers, crypto:supports()),
+    case lists:member(des_ede3, SupCiphers) of
+        true ->
+            ct:timetrap({seconds, 5}),
+            Config;
+        _ ->
+            {skip, "Missing 3DES crypto support"}
+    end;
+init_per_testcase(TestCase, Config) when TestCase == psk_rc4_128;
+                                         TestCase == ecdhe_psk_rc4_128;
+                                         TestCase == dhe_psk_rc4_128;
+                                         TestCase == rsa_psk_rc4_128;
+                                         TestCase == rsa_rc4_128;
+                                         TestCase == ecdhe_rsa_rc4_128;
+                                         TestCase == ecdhe_ecdsa_rc4_128;
+                                         TestCase == dh_anon_rc4_128 ->
+    SupCiphers = proplists:get_value(ciphers, crypto:supports()),
+    case lists:member(rc4, SupCiphers) of
+        true ->
+            ct:timetrap({seconds, 5}),
+            Config;
+        _ ->
+            {skip, "Missing RC4 crypto support"}
+    end;
+init_per_testcase(TestCase, Config) when  TestCase == psk_aes_128_ccm_8;
+                                          TestCase == rsa_psk_aes_128_ccm_8;
+                                          TestCase == psk_aes_128_ccm_8;
+                                          TestCase == dhe_psk_aes_128_ccm_8;
+                                          TestCase == ecdhe_psk_aes_128_ccm_8 ->
+    SupCiphers = proplists:get_value(ciphers, crypto:supports()),
+    case lists:member(aes_128_ccm, SupCiphers) of
+        true ->
+            ct:timetrap({seconds, 5}),
+            Config;
+        _ ->
+            {skip, "Missing AES_128_CCM crypto support"}
+    end;
+init_per_testcase(TestCase, Config) when TestCase == psk_aes_256_ccm_8;
+                                         TestCase == rsa_psk_aes_256_ccm_8;
+                                         TestCase == psk_aes_256_ccm_8;
+                                         TestCase == dhe_psk_aes_256_ccm_8;
+                                         TestCase == ecdhe_psk_aes_256_ccm_8 ->
+    SupCiphers = proplists:get_value(ciphers, crypto:supports()),
+    case lists:member(aes_256_ccm, SupCiphers) of
+        true ->
+            ct:timetrap({seconds, 5}),
+            Config;
+        _ ->
+            {skip, "Missing AES_256_CCM crypto support"}
+    end;
+init_per_testcase(TestCase, Config) ->
+    Cipher = ssl_test_lib:test_cipher(TestCase, Config),
+    SupCiphers = proplists:get_value(ciphers, crypto:supports()),
+    case lists:member(Cipher, SupCiphers) of
+        true ->
+            ct:timetrap({seconds, 5}),
+            Config;
+        _ ->
+            {skip, {Cipher, SupCiphers}}
+    end.
+
+end_per_testcase(_TestCase, Config) ->
+    Config.
+
+%%--------------------------------------------------------------------
+%% Initializtion ------------------------------------------
+%%--------------------------------------------------------------------
+init_certs(srp_rsa, Config) ->
+    {ClientOpts, ServerOpts} = ssl_test_lib:make_rsa_cert_chains([{server_chain, ssl_test_lib:default_cert_chain_conf()},
+                                                                  {client_chain, ssl_test_lib:default_cert_chain_conf()}],
+                                                                 Config, ""),
+    [{tls_config, #{server_config => [{user_lookup_fun, {fun ssl_test_lib:user_lookup/3, undefined}} | ServerOpts],
+                    client_config => [{srp_identity, {"Test-User", "secret"}} | ClientOpts]}} |
+     proplists:delete(tls_config, Config)];
+init_certs(srp_anon, Config) ->
+    [{tls_config, #{server_config => [{user_lookup_fun, {fun ssl_test_lib:user_lookup/3, undefined}}],
+                    client_config => [{srp_identity, {"Test-User", "secret"}}]}} |
+     proplists:delete(tls_config, Config)];
+init_certs(rsa_psk, Config) ->
+    Ext = x509_test:extensions([{key_usage, [digitalSignature, keyEncipherment]}]),
+    {ClientOpts, ServerOpts} = ssl_test_lib:make_rsa_cert_chains([{server_chain, 
+                                                                   [[ssl_test_lib:digest()],[ssl_test_lib:digest()],
+                                                                    [ssl_test_lib:digest(), {extensions, Ext}]]},
+                                                                  {client_chain, ssl_test_lib:default_cert_chain_conf()}], 
+                                                                 Config, "_peer_keyEncipherment"),
+    PskSharedSecret = <<1,2,3,4,5,6,7,8,9,10,11,12,13,14,15>>,
+    [{tls_config, #{server_config => [{user_lookup_fun, {fun ssl_test_lib:user_lookup/3, PskSharedSecret}} | ServerOpts],
+                    client_config => [{psk_identity, "Test-User"},
+                                      {user_lookup_fun, {fun ssl_test_lib:user_lookup/3, PskSharedSecret}} | ClientOpts]}} |
+     proplists:delete(tls_config, Config)];
+init_certs(rsa, Config) ->
+    Ext = x509_test:extensions([{key_usage, [digitalSignature, keyEncipherment]}]),
+    {ClientOpts, ServerOpts} = ssl_test_lib:make_rsa_cert_chains([{server_chain, 
+                                                                   [[ssl_test_lib:digest()],[ssl_test_lib:digest()],
+                                                                    [ssl_test_lib:digest(), {extensions, Ext}]]} 
+                                                                 ], 
+                                                                 Config, "_peer_keyEncipherment"),
+    [{tls_config, #{server_config => ServerOpts,
+                    client_config => ClientOpts}} |
+     proplists:delete(tls_config, Config)];
+init_certs(dhe_dss, Config) ->
+     {ClientOpts, ServerOpts} = ssl_test_lib:make_dsa_cert_chains([{server_chain, ssl_test_lib:default_cert_chain_conf()},
+                                                                  {client_chain, ssl_test_lib:default_cert_chain_conf()}], 
+                                                                  Config, ""),
+    [{tls_config, #{server_config => ServerOpts,
+                    client_config => ClientOpts}} |
+     proplists:delete(tls_config, Config)];
+init_certs(srp_dss, Config) ->
+    {ClientOpts, ServerOpts} = ssl_test_lib:make_dsa_cert_chains([{server_chain, ssl_test_lib:default_cert_chain_conf()},
+                                                                  {client_chain, ssl_test_lib:default_cert_chain_conf()}], 
+                                                                 Config, ""),
+    [{tls_config, #{server_config => [{user_lookup_fun, {fun ssl_test_lib:user_lookup/3, undefined}} | ServerOpts],
+                    client_config => [{srp_identity, {"Test-User", "secret"}} | ClientOpts]}} |
+       proplists:delete(tls_config, Config)];
+init_certs(GroupName, Config) when GroupName == dhe_rsa;
+                                   GroupName == ecdhe_rsa ->
+    {ClientOpts, ServerOpts} = ssl_test_lib:make_rsa_cert_chains([{server_chain, ssl_test_lib:default_cert_chain_conf()},
+                                                                  {client_chain, ssl_test_lib:default_cert_chain_conf()}], 
+                                                                 Config, ""),
+    [{tls_config, #{server_config => ServerOpts,
+                    client_config => ClientOpts}} |
+     proplists:delete(tls_config, Config)];
+init_certs(GroupName, Config) when GroupName == dhe_ecdsa;
+                                   GroupName == ecdhe_ecdsa ->
+    {ClientOpts, ServerOpts} = ssl_test_lib:make_ecc_cert_chains([{server_chain, ssl_test_lib:default_cert_chain_conf()},
+                                                                 {client_chain, ssl_test_lib:default_cert_chain_conf()}], 
+                                                                 Config, ""),
+    [{tls_config, #{server_config => ServerOpts,
+                    client_config => ClientOpts}} |
+     proplists:delete(tls_config, Config)];
+init_certs(GroupName, Config) when GroupName == psk;
+                                   GroupName == dhe_psk;
+                                   GroupName == ecdhe_psk ->
+    PskSharedSecret = <<1,2,3,4,5,6,7,8,9,10,11,12,13,14,15>>,
+    [{tls_config, #{server_config => [{user_lookup_fun, {fun ssl_test_lib:user_lookup/3, PskSharedSecret}}],
+                    client_config => [{psk_identity, "Test-User"},
+                                      {user_lookup_fun, {fun ssl_test_lib:user_lookup/3, PskSharedSecret}}]}} |
+     proplists:delete(tls_config, Config)]; 
+init_certs(srp, Config) -> 
+      [{tls_config, #{server_config => [{user_lookup_fun, {fun ssl_test_lib:user_lookup/3, undefined}}],
+                      client_config => [{srp_identity, {"Test-User", "secret"}}]}} |
+       proplists:delete(tls_config, Config)];
+init_certs(_GroupName, Config) -> 
+    %% Anonymous does not need certs
+     [{tls_config, #{server_config => [],
+                     client_config => []}} |
+       proplists:delete(tls_config, Config)].
+%%--------------------------------------------------------------------
+%% Test Cases --------------------------------------------------------
+%%--------------------------------------------------------------------
+
+%%--------------------------------------------------------------------
+%% SRP --------------------------------------------------------
+%%--------------------------------------------------------------------
+srp_rsa_3des_ede_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(srp_rsa, '3des_ede_cbc', Config).                 
+    
+srp_rsa_aes_128_cbc(Config) when is_list(Config) ->
+   run_ciphers_test(srp_rsa, 'aes_128_cbc', Config).             
+
+srp_rsa_aes_256_cbc(Config) when is_list(Config) ->
+   run_ciphers_test(srp_rsa, 'aes_256_cbc', Config).             
+
+srp_dss_3des_ede_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(srp_dss, '3des_ede_cbc', Config).                 
+    
+srp_dss_aes_128_cbc(Config) when is_list(Config) ->
+   run_ciphers_test(srp_dss, 'aes_128_cbc', Config).             
+
+srp_dss_aes_256_cbc(Config) when is_list(Config) ->
+   run_ciphers_test(srp_dss, 'aes_256_cbc', Config).     
+
+%%--------------------------------------------------------------------
+%% PSK --------------------------------------------------------
+%%--------------------------------------------------------------------
+rsa_psk_3des_ede_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(rsa_psk, '3des_ede_cbc', Config).            
+
+rsa_psk_aes_128_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(rsa_psk, 'aes_128_cbc', Config).             
+
+rsa_psk_aes_128_ccm(Config) when is_list(Config) ->
+    run_ciphers_test(rsa_psk, 'aes_128_ccm', Config).             
+
+rsa_psk_aes_128_ccm_8(Config) when is_list(Config) ->
+    run_ciphers_test(rsa_psk, 'aes_128_ccm_8', Config).             
+
+rsa_psk_aes_256_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(rsa_psk, 'aes_256_cbc', Config). 
+
+rsa_psk_aes_256_ccm(Config) when is_list(Config) ->
+    run_ciphers_test(rsa_psk, 'aes_256_ccm', Config).             
+
+rsa_psk_aes_256_ccm_8(Config) when is_list(Config) ->
+    run_ciphers_test(rsa_psk, 'aes_256_ccm_8', Config).             
+     
+rsa_psk_rc4_128(Config) when is_list(Config) ->
+    run_ciphers_test(rsa_psk, 'rc4_128', Config).    
+         
+%%--------------------------------------------------------------------
+%% RSA --------------------------------------------------------
+%%--------------------------------------------------------------------
+rsa_des_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(rsa, 'des_cbc', Config).            
+
+rsa_3des_ede_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(rsa, '3des_ede_cbc', Config).            
+
+rsa_aes_128_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(rsa, 'aes_128_cbc', Config).             
+
+rsa_aes_256_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(rsa, 'aes_256_cbc', Config).
+
+rsa_aes_128_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(rsa, 'aes_128_gcm', Config).             
+
+rsa_aes_256_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(rsa, 'aes_256_gcm', Config).
+
+rsa_rc4_128(Config) when is_list(Config) ->
+    run_ciphers_test(rsa, 'rc4_128', Config).    
+%%--------------------------------------------------------------------
+%% DHE_RSA --------------------------------------------------------
+%%--------------------------------------------------------------------
+dhe_rsa_3des_ede_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_rsa, '3des_ede_cbc', Config).         
+
+dhe_rsa_aes_128_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_rsa, 'aes_128_cbc', Config).   
+
+dhe_rsa_aes_128_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_rsa, 'aes_128_gcm', Config).   
+
+dhe_rsa_aes_256_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_rsa, 'aes_256_cbc', Config).   
+
+dhe_rsa_aes_256_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_rsa, 'aes_256_gcm', Config).
+
+dhe_rsa_chacha20_poly1305(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_rsa, 'chacha20_poly1305', Config).
+%%--------------------------------------------------------------------
+%% ECDHE_RSA --------------------------------------------------------
+%%--------------------------------------------------------------------
+ecdhe_rsa_3des_ede_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_rsa, '3des_ede_cbc', Config).         
+
+ecdhe_rsa_aes_128_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_rsa, 'aes_128_cbc', Config).         
+
+ecdhe_rsa_aes_128_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_rsa, 'aes_128_gcm', Config).         
+
+ecdhe_rsa_aes_256_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_rsa, 'aes_256_cbc', Config).   
+
+ecdhe_rsa_aes_256_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_rsa, 'aes_256_gcm', Config).   
+
+ecdhe_rsa_rc4_128(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_rsa, 'rc4_128', Config).      
+
+ecdhe_rsa_chacha20_poly1305(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_rsa, 'chacha20_poly1305', Config).
+
+%%--------------------------------------------------------------------
+%% ECDHE_ECDSA --------------------------------------------------------
+%%--------------------------------------------------------------------
+ecdhe_ecdsa_rc4_128(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_ecdsa, 'rc4_128', Config).         
+
+ecdhe_ecdsa_3des_ede_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_ecdsa, '3des_ede_cbc', Config).         
+
+ecdhe_ecdsa_aes_128_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_ecdsa, 'aes_128_cbc', Config).         
+
+ecdhe_ecdsa_aes_128_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_ecdsa, 'aes_128_gcm', Config).         
+
+ecdhe_ecdsa_aes_256_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_ecdsa, 'aes_256_cbc', Config).   
+
+ecdhe_ecdsa_aes_256_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_ecdsa, 'aes_256_gcm', Config).   
+
+ecdhe_ecdsa_chacha20_poly1305(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_ecdsa, 'chacha20_poly1305', Config).
+%%--------------------------------------------------------------------
+%% DHE_DSS --------------------------------------------------------
+%%--------------------------------------------------------------------
+dhe_dss_des_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_dss, 'des_cbc', Config).            
+
+dhe_dss_3des_ede_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_dss, '3des_ede_cbc', Config).            
+
+dhe_dss_aes_128_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_dss, 'aes_128_cbc', Config).             
+
+dhe_dss_aes_256_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_dss, 'aes_256_cbc', Config).
+
+dhe_dss_aes_128_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_dss, 'aes_128_gcm', Config).             
+
+dhe_dss_aes_256_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_dss, 'aes_256_gcm', Config).
+
+%%--------------------------------------------------------------------
+%% Anonymous --------------------------------------------------------
+%%--------------------------------------------------------------------
+dh_anon_3des_ede_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(dh_anon, '3des_ede_cbc', Config).         
+
+dh_anon_aes_128_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(dh_anon, 'aes_128_cbc', Config).         
+
+dh_anon_aes_128_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(dh_anon, 'aes_128_gcm', Config).         
+
+dh_anon_aes_256_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(dh_anon, 'aes_256_cbc', Config).   
+
+dh_anon_aes_256_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(dh_anon, 'aes_256_gcm', Config).   
+
+dh_anon_rc4_128(Config) when is_list(Config) ->
+    run_ciphers_test(dh_anon, 'rc4_128', Config).      
+
+ecdh_anon_3des_ede_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(ecdh_anon, '3des_ede_cbc', Config).         
+
+ecdh_anon_aes_128_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(ecdh_anon, 'aes_128_cbc', Config).   
+
+ecdh_anon_aes_256_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(ecdh_anon, 'aes_256_cbc', Config).   
+
+srp_anon_3des_ede_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(srp_anon, '3des_ede_cbc', Config).                 
+    
+srp_anon_aes_128_cbc(Config) when is_list(Config) ->
+   run_ciphers_test(srp_anon, 'aes_128_cbc', Config).             
+
+srp_anon_aes_256_cbc(Config) when is_list(Config) ->
+   run_ciphers_test(srp_anon, 'aes_256_cbc', Config).     
+
+dhe_psk_des_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_psk, 'des_cbc', Config).            
+
+dhe_psk_rc4_128(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_psk, 'rc4_128', Config).            
+
+dhe_psk_3des_ede_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_psk, '3des_ede_cbc', Config).            
+
+dhe_psk_aes_128_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_psk, 'aes_128_cbc', Config).             
+
+dhe_psk_aes_256_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_psk, 'aes_256_cbc', Config).
+
+dhe_psk_aes_128_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_psk, 'aes_128_gcm', Config).             
+
+dhe_psk_aes_256_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_psk, 'aes_256_gcm', Config).
+
+dhe_psk_aes_128_ccm(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_psk, 'aes_128_ccm', Config).             
+
+dhe_psk_aes_256_ccm(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_psk, 'aes_256_ccm', Config).
+
+dhe_psk_aes_128_ccm_8(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_psk, 'aes_128_ccm_8', Config).
+
+dhe_psk_aes_256_ccm_8(Config) when is_list(Config) ->
+    run_ciphers_test(dhe_psk, 'aes_256_ccm_8', Config).
+
+ecdhe_psk_des_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_psk, 'des_cbc', Config).            
+
+ecdhe_psk_rc4_128(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_psk, 'rc4_128', Config).            
+
+ecdhe_psk_3des_ede_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_psk, '3des_ede_cbc', Config).            
+
+ecdhe_psk_aes_128_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_psk, 'aes_128_cbc', Config).             
+
+ecdhe_psk_aes_256_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_psk, 'aes_256_cbc', Config).
+
+ecdhe_psk_aes_128_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_psk, 'aes_128_gcm', Config).             
+
+ecdhe_psk_aes_256_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_psk, 'aes_256_gcm', Config).
+
+ecdhe_psk_aes_128_ccm(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_psk, 'aes_128_ccm', Config).             
+
+ecdhe_psk_aes_128_ccm_8(Config) when is_list(Config) ->
+    run_ciphers_test(ecdhe_psk, 'aes_128_ccm_8', Config).
+
+psk_des_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(psk, 'des_cbc', Config).            
+
+psk_rc4_128(Config) when is_list(Config) ->
+    run_ciphers_test(psk, 'rc4_128', Config).            
+
+psk_3des_ede_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(psk, '3des_ede_cbc', Config).            
+
+psk_aes_128_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(psk, 'aes_128_cbc', Config).             
+
+psk_aes_256_cbc(Config) when is_list(Config) ->
+    run_ciphers_test(psk, 'aes_256_cbc', Config).
+
+psk_aes_128_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(psk, 'aes_128_gcm', Config).             
+
+psk_aes_256_gcm(Config) when is_list(Config) ->
+    run_ciphers_test(psk, 'aes_256_gcm', Config).
+
+psk_aes_128_ccm(Config) when is_list(Config) ->
+    run_ciphers_test(psk, 'aes_128_ccm', Config).             
+
+psk_aes_256_ccm(Config) when is_list(Config) ->
+    run_ciphers_test(psk, 'aes_256_ccm', Config).
+
+psk_aes_128_ccm_8(Config) when is_list(Config) ->
+    run_ciphers_test(psk, 'aes_128_ccm_8', Config).             
+
+psk_aes_256_ccm_8(Config) when is_list(Config) ->
+    run_ciphers_test(psk, 'aes_256_ccm_8', Config).
+
+%%--------------------------------------------------------------------
+%% Internal functions  ----------------------------------------------
+%%--------------------------------------------------------------------
+run_ciphers_test(Kex, Cipher, Config) ->
+    Version = ssl_test_lib:protocol_version(Config),
+    TestCiphers = test_ciphers(Kex, Cipher, Version),                  
+    
+    case TestCiphers of
+        [_|_] -> 
+            lists:foreach(fun(TestCipher) -> 
+                                  cipher_suite_test(TestCipher, Version, Config)
+                          end, TestCiphers);
+        []  ->
+            {skip, {not_sup, Kex, Cipher, Version}}
+    end.
+
+cipher_suite_test(CipherSuite, _Version, Config) ->
+    #{server_config := SOpts,
+      client_config := COpts} = proplists:get_value(tls_config, Config),
+    ServerOpts = ssl_test_lib:ssl_options(SOpts, Config),
+    ClientOpts = ssl_test_lib:ssl_options(COpts, Config),
+    ct:log("Testing CipherSuite ~p~n", [CipherSuite]),
+    ct:log("Server Opts ~p~n", [ServerOpts]),
+    ct:log("Client Opts ~p~n", [ClientOpts]),
+    ssl_test_lib:basic_test([{ciphers, [CipherSuite]} | COpts], SOpts, [{client_type, erlang},
+                                                                        {server_type, openssl} | Config]).
+
+
+test_ciphers(Kex, Cipher, Version) ->
+    Ciphers = ssl:filter_cipher_suites(ssl:cipher_suites(default, Version) ++ ssl:cipher_suites(anonymous, Version), 
+                             [{key_exchange, 
+                               fun(Kex0) when Kex0 == Kex -> true; 
+                                  (_) -> false 
+                               end}, 
+                              {cipher,  
+                               fun(Cipher0) when Cipher0 == Cipher -> true; 
+                                  (_) -> false 
+                               end}]),
+    ct:log("Version ~p Testing  ~p~n", [Version, Ciphers]),
+    OpenSSLCiphers = openssl_ciphers(),
+    ct:log("OpenSSLCiphers ~p~n", [OpenSSLCiphers]),
+    lists:filter(fun(C) ->
+                         ct:log("Cipher ~p~n", [C]),
+                         lists:member(ssl_cipher_format:suite_map_to_openssl_str(C), OpenSSLCiphers)
+                 end, Ciphers).
+
+
+openssl_ciphers() ->
+    Str = os:cmd("openssl ciphers"),
+    string:split(string:strip(Str, right, $\n), ":", all).
diff --git a/lib/ssl/test/ssl_ECC_SUITE.erl b/lib/ssl/test/ssl_ECC_SUITE.erl
index c64358960c..d02888793c 100644
--- a/lib/ssl/test/ssl_ECC_SUITE.erl
+++ b/lib/ssl/test/ssl_ECC_SUITE.erl
@@ -51,35 +51,7 @@ groups() ->
     ].
 
 test_cases()->
-    key_cert_combinations()
-        ++ misc() 
-        ++ ecc_negotiation().
-
-key_cert_combinations() ->
-    server_ecdh_rsa() ++
-        server_ecdhe_rsa() ++
-        server_ecdh_ecdsa() ++
-        server_ecdhe_ecdsa().
-
-server_ecdh_rsa() ->
-    [client_ecdh_rsa_server_ecdh_rsa,
-     client_ecdhe_rsa_server_ecdh_rsa,     
-     client_ecdhe_ecdsa_server_ecdh_rsa].
-
-server_ecdhe_rsa() ->
-    [client_ecdh_rsa_server_ecdhe_rsa,
-     client_ecdhe_rsa_server_ecdhe_rsa,
-     client_ecdhe_ecdsa_server_ecdhe_rsa].
-
-server_ecdh_ecdsa() ->
-    [client_ecdh_ecdsa_server_ecdh_ecdsa,
-     client_ecdhe_rsa_server_ecdh_ecdsa,
-     client_ecdhe_ecdsa_server_ecdh_ecdsa].
-
-server_ecdhe_ecdsa() ->
-    [client_ecdh_rsa_server_ecdhe_ecdsa,
-     client_ecdh_ecdsa_server_ecdhe_ecdsa,
-     client_ecdhe_ecdsa_server_ecdhe_ecdsa].
+    misc() ++ ecc_negotiation().
 
 misc()->
     [client_ecdsa_server_ecdsa_with_raw_key].
@@ -160,35 +132,6 @@ end_per_testcase(_TestCase, Config) ->
 %% Test diffrent certificate chain types, note that it is the servers
 %% chain that affect what cipher suit that will be choosen
 
-%% ECDH_RSA 
-client_ecdh_rsa_server_ecdh_rsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdh_rsa_server_ecdh_rsa(Config).
-client_ecdhe_rsa_server_ecdh_rsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdhe_rsa_server_ecdh_rsa(Config).
-client_ecdhe_ecdsa_server_ecdh_rsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdhe_ecdsa_server_ecdh_rsa(Config).
-%% ECDHE_RSA    
-client_ecdh_rsa_server_ecdhe_rsa(Config)  when is_list(Config) ->
-    ssl_ECC:client_ecdh_rsa_server_ecdhe_rsa(Config).
-client_ecdhe_rsa_server_ecdhe_rsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdhe_rsa_server_ecdhe_rsa(Config).
-client_ecdhe_ecdsa_server_ecdhe_rsa(Config) when is_list(Config) ->
-   ssl_ECC:client_ecdhe_ecdsa_server_ecdhe_rsa(Config).
-%% ECDH_ECDSA
-client_ecdh_ecdsa_server_ecdh_ecdsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdh_ecdsa_server_ecdh_ecdsa(Config).
-client_ecdhe_rsa_server_ecdh_ecdsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdhe_rsa_server_ecdh_ecdsa(Config).
-client_ecdhe_ecdsa_server_ecdh_ecdsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdhe_ecdsa_server_ecdh_ecdsa(Config).
-%% ECDHE_ECDSA
-client_ecdh_rsa_server_ecdhe_ecdsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdh_rsa_server_ecdhe_ecdsa(Config).
-client_ecdh_ecdsa_server_ecdhe_ecdsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdh_ecdsa_server_ecdhe_ecdsa(Config).
-client_ecdhe_ecdsa_server_ecdhe_ecdsa(Config) when is_list(Config) ->
-     ssl_ECC:client_ecdhe_ecdsa_server_ecdhe_ecdsa(Config).
-
 client_ecdsa_server_ecdsa_with_raw_key(Config)  when is_list(Config) ->
      Default = ssl_test_lib:default_cert_chain_conf(),
     {COpts0, SOpts0} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
diff --git a/lib/ssl/test/ssl_ECC_openssl_SUITE.erl b/lib/ssl/test/ssl_ECC_openssl_SUITE.erl
index 81a7dfd2da..68d4e910fd 100644
--- a/lib/ssl/test/ssl_ECC_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_ECC_openssl_SUITE.erl
@@ -33,77 +33,23 @@
 %%--------------------------------------------------------------------
 
 all() ->
-    case test_cases() of
-        [_|_] ->
-            all_groups();
-        [] ->
-            [skip]
-    end.
-
-all_groups() ->
     case ssl_test_lib:openssl_sane_dtls() of 
         true ->
             [{group, 'tlsv1.2'},
-             {group, 'tlsv1.1'},
-             {group, 'tlsv1'},
-             {group, 'dtlsv1.2'},
-             {group, 'dtlsv1'}];
+             {group, 'dtlsv1.2'}];   
         false ->
-            [{group, 'tlsv1.2'},
-             {group, 'tlsv1.1'},
-             {group, 'tlsv1'}]
+            [{group, 'tlsv1.2'}]
     end.
 
 groups() ->
     case ssl_test_lib:openssl_sane_dtls() of 
         true ->
-            [{'tlsv1.2', [], [mix_sign | test_cases()]},
-             {'tlsv1.1', [], test_cases()},
-             {'tlsv1', [], test_cases()},
-             {'dtlsv1.2', [],  [mix_sign | test_cases()]},
-             {'dtlsv1', [], test_cases()}];
+            [{'tlsv1.2', [], [mix_sign]},
+             {'dtlsv1.2', [],  [mix_sign]}];
         false ->
-            [{'tlsv1.2', [], [mix_sign | test_cases()]},
-             {'tlsv1.1', [], test_cases()},
-             {'tlsv1', [], test_cases()}]
+            [{'tlsv1.2', [], [mix_sign]}]
     end.
-
-test_cases()->
-   cert_combinations().
   
-cert_combinations() ->
-    lists:append(lists:map(fun({Name, Suites}) -> 
-                                   case ssl_test_lib:openssl_filter(Name) of
-                                       [] ->
-                                           [];
-                                       [_|_] ->
-                                           Suites
-                                   end
-                           end, [{"ECDH-ECDSA", server_ecdh_ecdsa()},
-                                 {"ECDH-RSA", server_ecdh_rsa()},
-                                 {"ECDHE-RSA", server_ecdhe_rsa()},
-                                 {"ECDHE-ECDSA", server_ecdhe_ecdsa()}
-                                ])).
-server_ecdh_rsa() ->
-    [client_ecdh_rsa_server_ecdh_rsa,
-     client_ecdhe_rsa_server_ecdh_rsa,     
-     client_ecdhe_ecdsa_server_ecdh_rsa].
-
-server_ecdhe_rsa() ->
-    [client_ecdh_rsa_server_ecdhe_rsa,
-     client_ecdhe_rsa_server_ecdhe_rsa,
-     client_ecdhe_ecdsa_server_ecdhe_rsa].
-
-server_ecdh_ecdsa() ->
-    [client_ecdh_ecdsa_server_ecdh_ecdsa,
-     client_ecdhe_rsa_server_ecdh_ecdsa,
-     client_ecdhe_ecdsa_server_ecdh_ecdsa].
-
-server_ecdhe_ecdsa() ->
-    [client_ecdh_rsa_server_ecdhe_ecdsa,
-     client_ecdh_ecdsa_server_ecdhe_ecdsa,
-     client_ecdhe_ecdsa_server_ecdhe_ecdsa].
-
 %%--------------------------------------------------------------------
 init_per_suite(Config0) ->
     end_per_suite(Config0),
@@ -171,38 +117,6 @@ end_per_testcase(_TestCase, Config) ->
 skip(Config) when is_list(Config) ->
     {skip, openssl_does_not_support_ECC}.
 
-%% Test diffrent certificate chain types, note that it is the servers
-%% chain that affect what cipher suit that will be choosen
-
-%% ECDH_RSA 
-client_ecdh_rsa_server_ecdh_rsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdh_rsa_server_ecdh_rsa(Config).
-client_ecdhe_rsa_server_ecdh_rsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdhe_rsa_server_ecdh_rsa(Config).
-client_ecdhe_ecdsa_server_ecdh_rsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdhe_ecdsa_server_ecdh_rsa(Config).
-%% ECDHE_RSA    
-client_ecdh_rsa_server_ecdhe_rsa(Config)  when is_list(Config) ->
-    ssl_ECC:client_ecdh_rsa_server_ecdhe_rsa(Config).
-client_ecdhe_rsa_server_ecdhe_rsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdhe_rsa_server_ecdhe_rsa(Config).
-client_ecdhe_ecdsa_server_ecdhe_rsa(Config) when is_list(Config) ->
-   ssl_ECC:client_ecdhe_ecdsa_server_ecdhe_rsa(Config).
-%% ECDH_ECDSA
-client_ecdh_ecdsa_server_ecdh_ecdsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdh_ecdsa_server_ecdh_ecdsa(Config).
-client_ecdhe_rsa_server_ecdh_ecdsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdhe_rsa_server_ecdh_ecdsa(Config).
-client_ecdhe_ecdsa_server_ecdh_ecdsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdhe_ecdsa_server_ecdh_ecdsa(Config).
-%% ECDHE_ECDSA
-client_ecdh_rsa_server_ecdhe_ecdsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdh_rsa_server_ecdhe_ecdsa(Config).
-client_ecdh_ecdsa_server_ecdhe_ecdsa(Config) when is_list(Config) ->
-    ssl_ECC:client_ecdh_ecdsa_server_ecdhe_ecdsa(Config).
-client_ecdhe_ecdsa_server_ecdhe_ecdsa(Config) when is_list(Config) ->
-     ssl_ECC:client_ecdhe_ecdsa_server_ecdhe_ecdsa(Config).
-
 mix_sign(Config) ->
     {COpts0, SOpts0} = ssl_test_lib:make_mix_cert(Config),
     COpts = ssl_test_lib:ssl_options(COpts0, Config), 
diff --git a/lib/ssl/test/ssl_cipher_suite_SUITE.erl b/lib/ssl/test/ssl_cipher_suite_SUITE.erl
index 8805df7b52..51788c29e7 100644
--- a/lib/ssl/test/ssl_cipher_suite_SUITE.erl
+++ b/lib/ssl/test/ssl_cipher_suite_SUITE.erl
@@ -127,7 +127,6 @@ groups() ->
                ]}
     ].
 
-
 kex() ->
      rsa() ++ ecdsa() ++ dss() ++ anonymous().
 
@@ -154,7 +153,6 @@ anonymous() ->
      {group, ecdhe_psk},
      {group, srp_anon}
     ].
-    
 
 init_per_suite(Config) ->
     catch crypto:stop(),
@@ -170,7 +168,7 @@ end_per_suite(_Config) ->
     ssl:stop(),
     application:stop(crypto).
 
-%%--------------------------------------------------------------------
+
 init_per_group(GroupName, Config) when GroupName == ecdh_anon;
                                        GroupName == ecdhe_rsa;
                                        GroupName == ecdhe_psk ->
@@ -236,6 +234,7 @@ end_per_group(GroupName, Config) ->
       false ->
           Config
   end.
+
 init_per_testcase(TestCase, Config) when TestCase == psk_3des_ede_cbc;
                                          TestCase == srp_anon_3des_ede_cbc;
                                          TestCase == dhe_psk_3des_ede_cbc;
@@ -302,8 +301,7 @@ init_per_testcase(TestCase, Config) when TestCase == psk_aes_256_ccm_8;
             {skip, "Missing AES_256_CCM crypto support"}
     end;
 init_per_testcase(TestCase, Config) ->
-    Cipher = test_cipher(TestCase, Config),
-    %%Reason = io_lib:format("Missing ~p crypto support", [Cipher]),
+    Cipher = ssl_test_lib:test_cipher(TestCase, Config),
     SupCiphers = proplists:get_value(ciphers, crypto:supports()),
     case lists:member(Cipher, SupCiphers) of
         true ->
@@ -316,17 +314,21 @@ init_per_testcase(TestCase, Config) ->
 end_per_testcase(_TestCase, Config) ->
     Config.
 
+%%--------------------------------------------------------------------
+%% Initializtion   ------------------------------------------
+%%--------------------------------------------------------------------
+
 init_certs(srp_rsa, Config) ->
     DefConf = ssl_test_lib:default_cert_chain_conf(),
     CertChainConf = ssl_test_lib:gen_conf(rsa, rsa, DefConf, DefConf),
     #{server_config := ServerOpts,
       client_config := ClientOpts} 
         = public_key:pkix_test_data(CertChainConf),
-    [{tls_config, #{server_config => [{user_lookup_fun, {fun user_lookup/3, undefined}} | ServerOpts],
+    [{tls_config, #{server_config => [{user_lookup_fun, {fun ssl_test_lib:user_lookup/3, undefined}} | ServerOpts],
                     client_config => [{srp_identity, {"Test-User", "secret"}} | ClientOpts]}} |
      proplists:delete(tls_config, Config)];
 init_certs(srp_anon, Config) ->
-    [{tls_config, #{server_config => [{user_lookup_fun, {fun user_lookup/3, undefined}}],
+    [{tls_config, #{server_config => [{user_lookup_fun, {fun ssl_test_lib:user_lookup/3, undefined}}],
                     client_config => [{srp_identity, {"Test-User", "secret"}}]}} |
      proplists:delete(tls_config, Config)];
 init_certs(rsa_psk, Config) ->
@@ -335,9 +337,9 @@ init_certs(rsa_psk, Config) ->
                                                                    [[],[],[{extensions, ClientExt}]]}], 
                                                                  Config, "_peer_keyEncipherment"),
     PskSharedSecret = <<1,2,3,4,5,6,7,8,9,10,11,12,13,14,15>>,
-    [{tls_config, #{server_config => [{user_lookup_fun, {fun user_lookup/3, PskSharedSecret}} | ServerOpts],
+    [{tls_config, #{server_config => [{user_lookup_fun, {fun ssl_test_lib:user_lookup/3, PskSharedSecret}} | ServerOpts],
                     client_config => [{psk_identity, "Test-User"},
-                                      {user_lookup_fun, {fun user_lookup/3, PskSharedSecret}} | ClientOpts]}} |
+                                      {user_lookup_fun, {fun ssl_test_lib:user_lookup/3, PskSharedSecret}} | ClientOpts]}} |
      proplists:delete(tls_config, Config)];
 init_certs(rsa, Config) ->
     ClientExt = x509_test:extensions([{key_usage, [digitalSignature, keyEncipherment]}]),
@@ -362,7 +364,7 @@ init_certs(srp_dss, Config) ->
     #{server_config := ServerOpts,
       client_config := ClientOpts} 
         = public_key:pkix_test_data(CertChainConf),
-    [{tls_config, #{server_config => [{user_lookup_fun, {fun user_lookup/3, undefined}} | ServerOpts],
+    [{tls_config, #{server_config => [{user_lookup_fun, {fun ssl_test_lib:user_lookup/3, undefined}} | ServerOpts],
                     client_config => [{srp_identity, {"Test-User", "secret"}} | ClientOpts]}} |
        proplists:delete(tls_config, Config)];
 init_certs(GroupName, Config) when GroupName == dhe_rsa;
@@ -389,12 +391,12 @@ init_certs(GroupName, Config) when GroupName == psk;
                                    GroupName == dhe_psk;
                                    GroupName == ecdhe_psk ->
     PskSharedSecret = <<1,2,3,4,5,6,7,8,9,10,11,12,13,14,15>>,
-    [{tls_config, #{server_config => [{user_lookup_fun, {fun user_lookup/3, PskSharedSecret}}],
+    [{tls_config, #{server_config => [{user_lookup_fun, {fun ssl_test_lib:user_lookup/3, PskSharedSecret}}],
                     client_config => [{psk_identity, "Test-User"},
-                                      {user_lookup_fun, {fun user_lookup/3, PskSharedSecret}}]}} |
+                                      {user_lookup_fun, {fun ssl_test_lib:user_lookup/3, PskSharedSecret}}]}} |
      proplists:delete(tls_config, Config)]; 
 init_certs(srp, Config) -> 
-      [{tls_config, #{server_config => [{user_lookup_fun, {fun user_lookup/3, undefined}}],
+      [{tls_config, #{server_config => [{user_lookup_fun, {fun ssl_test_lib:user_lookup/3, undefined}}],
                       client_config => [{srp_identity, {"Test-User", "secret"}}]}} |
        proplists:delete(tls_config, Config)];
 init_certs(_GroupName, Config) -> 
@@ -402,6 +404,7 @@ init_certs(_GroupName, Config) ->
      [{tls_config, #{server_config => [],
                      client_config => []}} |
        proplists:delete(tls_config, Config)].
+
 %%--------------------------------------------------------------------
 %% Test Cases --------------------------------------------------------
 %%--------------------------------------------------------------------
@@ -700,10 +703,6 @@ psk_aes_256_ccm_8(Config) when is_list(Config) ->
 %%--------------------------------------------------------------------
 %% Internal functions  ----------------------------------------------
 %%--------------------------------------------------------------------
-test_cipher(TestCase, Config) ->
-    [{name, Group} |_] = proplists:get_value(tc_group_properties, Config),
-    list_to_atom(re:replace(atom_to_list(TestCase), atom_to_list(Group) ++ "_",  "", [{return, list}])).
-
 run_ciphers_test(Kex, Cipher, Config) ->
     Version = ssl_test_lib:protocol_version(Config),
     TestCiphers = test_ciphers(Kex, Cipher, Version),                  
@@ -717,30 +716,28 @@ run_ciphers_test(Kex, Cipher, Config) ->
             {skip, {not_sup, Kex, Cipher, Version}}
     end.
 
-cipher_suite_test(CipherSuite, Version, Config) ->
+cipher_suite_test(ErlangCipherSuite, Version, Config) ->
     #{server_config := SOpts,
       client_config := COpts} = proplists:get_value(tls_config, Config),
     ServerOpts = ssl_test_lib:ssl_options(SOpts, Config),
     ClientOpts = ssl_test_lib:ssl_options(COpts, Config),
-    ct:log("Testing CipherSuite ~p~n", [CipherSuite]),
+    ct:log("Testing CipherSuite ~p~n", [ErlangCipherSuite]),
     ct:log("Server Opts ~p~n", [ServerOpts]),
     ct:log("Client Opts ~p~n", [ClientOpts]),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
-    ErlangCipherSuite = erlang_cipher_suite(CipherSuite),
-
     ConnectionInfo = {ok, {Version, ErlangCipherSuite}},
     
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
 					{from, self()},
                                         {mfa, {ssl_test_lib, cipher_result, [ConnectionInfo]}},
-                                        {options, [{versions, [Version]}, {ciphers, [CipherSuite]} | ServerOpts]}]),
+                                        {options, [{versions, [Version]}, {ciphers, [ErlangCipherSuite]} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					{host, Hostname},
 					{from, self()},
 					{mfa, {ssl_test_lib, cipher_result, [ConnectionInfo]}},
-					{options, [{versions, [Version]}, {ciphers, [CipherSuite]} |
+					{options, [{versions, [Version]}, {ciphers, [ErlangCipherSuite]} |
                                                    ClientOpts]}]),
 
     ssl_test_lib:check_result(Server, ok, Client, ok),
@@ -748,17 +745,6 @@ cipher_suite_test(CipherSuite, Version, Config) ->
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client).
 
-erlang_cipher_suite(Suite) when is_list(Suite)->
-    ssl_cipher_format:suite_definition(ssl_cipher_format:suite_openssl_str_to_map(Suite));
-erlang_cipher_suite(Suite) ->
-    Suite.
-
-user_lookup(psk, _Identity, UserState) ->
-    {ok, UserState};
-user_lookup(srp, Username, _UserState) ->
-    Salt = ssl_cipher:random_bytes(16),
-    UserPassHash = crypto:hash(sha, [Salt, crypto:hash(sha, [Username, <<$:>>, <<"secret">>])]),
-    {ok, {srp_1024, Salt, UserPassHash}}.
 
 test_ciphers(Kex, Cipher, Version) ->
     ssl:filter_cipher_suites(ssl:cipher_suites(all, Version) ++ ssl:cipher_suites(anonymous, Version), 
@@ -770,3 +756,4 @@ test_ciphers(Kex, Cipher, Version) ->
                                fun(Cipher0) when Cipher0 == Cipher -> true; 
                                   (_) -> false 
                                end}]).
+
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index 65b8998cc3..3b161a0c8a 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -631,6 +631,40 @@ make_rsa_cert_chains(UserConf, Config, Suffix) ->
      [{reuseaddr, true}, {verify, verify_peer} | ServerConf]
     }.
 
+make_ecc_cert_chains(UserConf, Config, Suffix) ->
+    ClientChain = proplists:get_value(client_chain, UserConf, default_cert_chain_conf()),
+    ServerChain = proplists:get_value(server_chain, UserConf, default_cert_chain_conf()),
+    CertChainConf = gen_conf(ecdsa, ecdsa, ClientChain, ServerChain),
+    ClientFileBase = filename:join([proplists:get_value(priv_dir, Config), "ecdsa" ++ Suffix]),
+    ServerFileBase = filename:join([proplists:get_value(priv_dir, Config), "ecdsa" ++ Suffix]),
+    GenCertData = public_key:pkix_test_data(CertChainConf),
+    [{server_config, ServerConf}, 
+     {client_config, ClientConf}] = 
+        x509_test:gen_pem_config_files(GenCertData, ClientFileBase, ServerFileBase),               
+    {[{verify, verify_peer} | ClientConf],
+     [{reuseaddr, true}, {verify, verify_peer} | ServerConf]
+    }.
+
+
+make_dsa_cert_chains(UserConf, Config, Suffix) ->  
+    CryptoSupport = crypto:supports(),
+    case proplists:get_bool(dss, proplists:get_value(public_keys, CryptoSupport)) of
+        true ->
+            ClientChain = proplists:get_value(client_chain, UserConf, default_cert_chain_conf()),
+            ServerChain = proplists:get_value(server_chain, UserConf, default_cert_chain_conf()),
+            CertChainConf = gen_conf(dsa, dsa, ClientChain, ServerChain),
+            ClientFileBase = filename:join([proplists:get_value(priv_dir, Config), "dsa" ++ Suffix]),
+            ServerFileBase = filename:join([proplists:get_value(priv_dir, Config), "dsa" ++ Suffix]),
+            GenCertData = public_key:pkix_test_data(CertChainConf),
+            [{server_config, ServerConf}, 
+             {client_config, ClientConf}] = 
+                x509_test:gen_pem_config_files(GenCertData, ClientFileBase, ServerFileBase),
+            {[{verify, verify_peer} | ClientConf],
+             [{reuseaddr, true}, {verify, verify_peer} | ServerConf]};
+      false ->
+          Config
+  end.
+
 make_ec_cert_chains(UserConf, ClientChainType, ServerChainType, Config) ->
     make_ec_cert_chains(UserConf, ClientChainType, ServerChainType, Config, ?DEFAULT_CURVE).
 %%
@@ -1067,7 +1101,7 @@ accepters(Acc, N) ->
 basic_test(COpts, SOpts, Config) ->
     SType = proplists:get_value(server_type, Config),
     CType = proplists:get_value(client_type, Config),
-    {Server, Port} = start_server(SType, SOpts, Config),
+    {Server, Port} = start_server(SType, COpts, SOpts, Config),
     Client = start_client(CType, Port, COpts, Config),
     gen_check_result(Server, SType, Client, CType),
     stop(Server, Client).    
@@ -1134,7 +1168,7 @@ start_client(erlang, Port, ClientOpts, Config) ->
 			       {host, Hostname},
 			       {from, self()},
 			       {mfa, {ssl_test_lib, check_key_exchange_send_active, [KeyEx]}},
-			       {options, [{verify, verify_peer} | ClientOpts]}]).
+			       {options, ClientOpts}]).
 
 %% Workaround for running tests on machines where openssl
 %% s_client would use an IPv6 address with localhost. As
@@ -1169,20 +1203,19 @@ start_client_ecc_error(erlang, Port, ClientOpts, ECCOpts, Config) ->
                                       [{verify, verify_peer} | ClientOpts]}]).
 
 
-start_server(openssl, ServerOpts, Config) ->
-    Cert = proplists:get_value(certfile, ServerOpts),
-    Key = proplists:get_value(keyfile, ServerOpts),
-    CA = proplists:get_value(cacertfile, ServerOpts),
+start_server(openssl, ClientOpts, ServerOpts, Config) ->
     Port = inet_port(node()),
     Version = protocol_version(Config),
     Exe = "openssl",
-    Args = ["s_server", "-accept", integer_to_list(Port), ssl_test_lib:version_flag(Version),
-	    "-verify", "2", "-cert", Cert, "-CAfile", CA,
-	    "-key", Key, "-msg", "-debug"],
+    CertArgs = openssl_cert_options(ServerOpts),
+    [Cipher|_] = proplists:get_value(ciphers, ClientOpts, ssl:cipher_suites(default,Version)),
+    Args = ["s_server", "-accept", integer_to_list(Port), "-cipher",
+            ssl_cipher_format:suite_map_to_openssl_str(Cipher),
+            ssl_test_lib:version_flag(Version)] ++ CertArgs ++ ["-msg", "-debug"],
     OpenSslPort = portable_open_port(Exe, Args),
     true = port_command(OpenSslPort, "Hello world"),
     {OpenSslPort, Port};
-start_server(erlang, ServerOpts, Config) ->
+start_server(erlang, _, ServerOpts, Config) ->
     {_, ServerNode, _} = ssl_test_lib:run_where(Config),
     KeyEx = proplists:get_value(check_keyex, Config, false),
     Server = start_server([{node, ServerNode}, {port, 0},
@@ -1245,6 +1278,29 @@ stop(Client, Server)  ->
     close(Server),
     close(Client).
 
+
+openssl_cert_options(ServerOpts) ->
+    Cert = proplists:get_value(certfile, ServerOpts, undefined),
+    Key = proplists:get_value(keyfile, ServerOpts, undefined),
+    CA = proplists:get_value(cacertfile, ServerOpts, undefined),
+    case CA of
+        undefined ->
+            case cert_option("-cert", Cert) ++ cert_option("-key", Key) of
+                [] ->
+                    ["-nocert"];
+                Other ->
+                    Other
+            end;
+        _ ->
+            cert_option("-cert", Cert) ++  cert_option("-CAfile", CA) ++
+                cert_option("-key", Key) ++ ["-verify", "2"]
+    end.
+
+cert_option(_, undefined) ->
+    [];
+cert_option(Opt, Value) ->
+    [Opt, Value].
+
 supported_eccs(Opts) ->
     ToCheck = proplists:get_value(eccs, Opts, []),
     Supported = ssl:eccs(),
@@ -2374,3 +2430,16 @@ user_lookup(srp, Username, _UserState) ->
     Salt = ssl_cipher:random_bytes(16),
     UserPassHash = crypto:hash(sha, [Salt, crypto:hash(sha, [Username, <<$:>>, <<"secret">>])]),
     {ok, {srp_1024, Salt, UserPassHash}}.
+
+test_cipher(TestCase, Config) ->
+    [{name, Group} |_] = proplists:get_value(tc_group_properties, Config),
+    list_to_atom(re:replace(atom_to_list(TestCase), atom_to_list(Group) ++ "_",  "", [{return, list}])).
+
+digest() ->
+    case application:get_env(ssl, protocol_version, application:get_env(ssl, dtls_protocol_version)) of
+        Ver when Ver == 'tlsv1.2';
+                 Ver == 'dtlsv1.2' ->
+            {digest, sha256};
+        _ ->
+            {digest, sha1}
+    end.