Merge branch 'peterdmv/ssl/doc-types-and-specs/OTP-15746'

* peterdmv/ssl/doc-types-and-specs/OTP-15746:
  ssl: Add type specs for http_packet()
  ssl: Fix type specs of ssl_internal.hrl
  ssl: Fix type specs of internal handshake functions
  ssl: Fix dialyzer warnings
  eldap: Fix dialyzer warnings
  ssl: Fix missing anchor warning
  public_key: Accept digest types 'sha1' and 'sha'
  inet: Document type inet:stat_option()
  ssl: Changed function specs and ssl.xml
  ssl: Update standards_compliance.xml

OTP-15775
OTP-15776
OTP-15777

Change-Id: Ibe8e8263d6557eaa40cc0681a7ce3fcb373a4120

15 files changed, 571 insertions, 474 deletions

diff --git a/lib/eldap/src/eldap.erl b/lib/eldap/src/eldap.erl
index 6497922852..9b7e254dfe 100644
--- a/lib/eldap/src/eldap.erl
+++ b/lib/eldap/src/eldap.erl
@@ -957,20 +957,20 @@ do_modify_dn_0(Data, Entry, NewRDN, DelOldRDN, NewSup, Controls) ->
 do_unbind(Data) ->
     Req = "",
     log2(Data, "unbind request = ~p (has no reply)~n", [Req]),
-    case Data#eldap.using_tls of
-	true ->
-            send_request(Data#eldap.fd, Data, Data#eldap.id, {unbindRequest, Req}),
-            ssl:close(Data#eldap.fd);
-	false ->
-            OldTrapExit = process_flag(trap_exit, true),
-            catch send_request(Data#eldap.fd, Data, Data#eldap.id, {unbindRequest, Req}),
-            catch gen_tcp:close(Data#eldap.fd),
-            receive
-                {'EXIT', _From, _Reason} -> ok
-            after 0 -> ok
-            end,
-            process_flag(trap_exit, OldTrapExit)
-    end,
+    _ = case Data#eldap.using_tls of
+            true ->
+                send_request(Data#eldap.fd, Data, Data#eldap.id, {unbindRequest, Req}),
+                ssl:close(Data#eldap.fd);
+            false ->
+                OldTrapExit = process_flag(trap_exit, true),
+                catch send_request(Data#eldap.fd, Data, Data#eldap.id, {unbindRequest, Req}),
+                catch gen_tcp:close(Data#eldap.fd),
+                receive
+                    {'EXIT', _From, _Reason} -> ok
+                after 0 -> ok
+                end,
+                process_flag(trap_exit, OldTrapExit)
+        end,
     {no_reply, Data#eldap{binddn = (#eldap{})#eldap.binddn,
 			  passwd = (#eldap{})#eldap.passwd,
 			  fd     = (#eldap{})#eldap.fd,
@@ -1130,7 +1130,7 @@ ldap_closed_p(Data, Emsg) when Data#eldap.using_tls == true ->
     %% Check if the SSL socket seems to be alive or not
     case catch ssl:sockname(Data#eldap.fd) of
 	{error, _} ->
-	    ssl:close(Data#eldap.fd),
+	    _ = ssl:close(Data#eldap.fd),
 	    {error, ldap_closed};
 	{ok, _} ->
 	    {error, Emsg};
diff --git a/lib/kernel/doc/src/inet.xml b/lib/kernel/doc/src/inet.xml
index 709ba8e8fd..d4678ca5db 100644
--- a/lib/kernel/doc/src/inet.xml
+++ b/lib/kernel/doc/src/inet.xml
@@ -294,6 +294,9 @@ fe80::204:acff:fe17:bf38
     <datatype>
       <name name="socket_protocol"/>
     </datatype>
+    <datatype>
+      <name name="stat_option"/>
+    </datatype>
   </datatypes>
 
   <funcs>
diff --git a/lib/public_key/src/pubkey_cert.erl b/lib/public_key/src/pubkey_cert.erl
index 61a1239d26..12c61e158f 100644
--- a/lib/public_key/src/pubkey_cert.erl
+++ b/lib/public_key/src/pubkey_cert.erl
@@ -1187,6 +1187,8 @@ sign_algorithm(#'ECPrivateKey'{parameters = Parms}, Opts) ->
                           parameters = Parms}.
 rsa_digest_oid(sha1) ->
     ?'sha1WithRSAEncryption';
+rsa_digest_oid(sha) ->
+    ?'sha1WithRSAEncryption';
 rsa_digest_oid(sha512) ->
     ?'sha512WithRSAEncryption';
 rsa_digest_oid(sha384) ->
@@ -1198,6 +1200,8 @@ rsa_digest_oid(md5) ->
 
 ecdsa_digest_oid(sha1) ->
     ?'ecdsa-with-SHA1';
+ecdsa_digest_oid(sha) ->
+    ?'ecdsa-with-SHA1';
 ecdsa_digest_oid(sha512) ->
     ?'ecdsa-with-SHA512';
 ecdsa_digest_oid(sha384) ->
diff --git a/lib/public_key/src/public_key.erl b/lib/public_key/src/public_key.erl
index 431c77141c..47266c514c 100644
--- a/lib/public_key/src/public_key.erl
+++ b/lib/public_key/src/public_key.erl
@@ -112,6 +112,7 @@
 -type ssh_file()             :: openssh_public_key | rfc4716_public_key | known_hosts |
 				auth_keys.
 -type digest_type()          :: none % None is for backwards compatibility
+                              | sha1 % Backwards compatibility
                               | crypto:rsa_digest_type()
                               | crypto:dss_digest_type()
                               | crypto:ecdsa_digest_type().
diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml
index 74a0a0a03e..422bd6a19d 100644
--- a/lib/ssl/doc/src/ssl.xml
+++ b/lib/ssl/doc/src/ssl.xml
@@ -136,14 +136,26 @@
        <name name="protocol_version"/>
      </datatype>
 
-       <datatype>
+     <datatype>
+       <name name="protocol_version_tuple"/>
+     </datatype>
+
+     <datatype>
        <name name="tls_version"/>
      </datatype>
-     
+
+     <datatype>
+       <name name="tls_version_tuple"/>
+     </datatype>
+
      <datatype>
        <name name="dtls_version"/>
      </datatype>
-     
+
+     <datatype>
+       <name name="dtls_version_tuple"/>
+     </datatype>
+
      <datatype>
        <name name="tls_legacy_version"/>
      </datatype>
@@ -151,9 +163,8 @@
      <datatype>
        <name name="dtls_legacy_version"/>
      </datatype>
-     
-     
-       <datatype>
+
+     <datatype>
        <name name="prf_random"/>
      </datatype>
      
@@ -218,10 +229,6 @@
      </datatype>
 
      <datatype>
-      <name name="eccs"/>
-     </datatype>
-
-     <datatype>
       <name name="named_curve"/>
      </datatype>
 
@@ -253,6 +260,50 @@
       <name name="tls_alert"/>
      </datatype>
 
+     <datatype>
+      <name name="reason"/>
+     </datatype>
+
+     <datatype>
+      <name name="http_packet"/>
+     </datatype>
+
+     <datatype>
+      <name name="http_request"/>
+     </datatype>
+
+     <datatype>
+      <name name="http_response"/>
+     </datatype>
+
+     <datatype>
+      <name name="http_header"/>
+     </datatype>
+
+     <datatype>
+      <name name="http_error"/>
+     </datatype>
+
+     <datatype>
+      <name name="http_method"/>
+     </datatype>
+
+     <datatype>
+      <name name="http_uri"/>
+     </datatype>
+
+     <datatype>
+      <name name="http_version"/>
+     </datatype>
+
+     <datatype>
+      <name name="http_field"/>
+     </datatype>
+
+     <datatype>
+      <name name="http_string"/>
+     </datatype>
+
     <datatype_title>TLS/DTLS OPTION DESCRIPTIONS - COMMON for SERVER and CLIENT</datatype_title>
     
     <datatype>
@@ -343,13 +394,6 @@
     </datatype>
     
     <datatype>
-      <name name="eccs"/>
-      <desc><p> Allows to specify the order of preference for named curves
-      and to restrict their usage when using a cipher suite supporting them.</p>
-      </desc>
-    </datatype>
-
-    <datatype>
       <name name="signature_schemes"/>
       <desc>
 	  <p>
@@ -1109,13 +1153,8 @@ fun(srp, Username :: string(), UserState :: term()) ->
   <funcs>
 
     <func>
-      <name since="OTP 20.3">append_cipher_suites(Deferred, Suites) -> ciphers() </name>
+      <name name="append_cipher_suites" arity="2" since="OTP 20.3"/>
       <fsummary></fsummary>
-      <type>
-        <v>Deferred = <seealso marker="#type-ciphers">ciphers()</seealso> |
-	<seealso marker="#type-cipher_filters">cipher_filters()</seealso></v>
-	<v>Suites  =  <seealso marker="#type-ciphers">ciphers()</seealso></v>
-      </type>
       <desc><p>Make <c>Deferred</c> suites become the least preferred
       suites, that is put them at the end of the cipher suite list
       <c>Suites</c> after removing them from <c>Suites</c> if
@@ -1126,25 +1165,18 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
     
     <func>
-      <name since="OTP R14B">cipher_suites() -></name>
-      <name since="OTP R14B">cipher_suites(Type) -> [old_cipher_suite()]</name>
+      <name name="cipher_suites" arity="0" since="OTP R14B"/>
+      <name name="cipher_suites" arity="1" since="OTP R14B"/>
       <fsummary>Returns a list of supported cipher suites.</fsummary>
-      <type>
-        <v>Type = erlang | openssl | all</v>
-      </type>
       <desc>
 	<p>Deprecated in OTP 21, use <seealso marker="#cipher_suites-2">cipher_suites/2</seealso> instead.</p>
       </desc>
     </func>
     
    <func>
-      <name since="OTP 20.3">cipher_suites(Supported, Version) ->  ciphers()</name>
+      <name name="cipher_suites" arity="2" since="OTP 20.3"/>
       <fsummary>Returns a list of all default or
       all supported cipher suites.</fsummary>
-      <type>
-        <v> Supported = default | all | anonymous </v>
-	<v> Version = <seealso marker="#type-protocol_version">protocol_version() </seealso></v>
-      </type>
       <desc><p>Returns all default or all supported (except anonymous),
       or all anonymous cipher suites for a
       TLS version</p>
@@ -1152,16 +1184,9 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
 
     <func>
-      <name since="OTP 19.2">eccs() -></name>
-      <name since="OTP 19.2">eccs(Version) -> NamedCurves</name>
+      <name name="eccs" arity="0" since="OTP 19.2"/>
+      <name name="eccs" arity="1" since="OTP 19.2"/>
       <fsummary>Returns a list of supported ECCs.</fsummary>
-
-      <type>
-	<v> Version = <seealso marker="#type-protocol_version">protocol_version() </seealso></v>
-	<v> NamedCurves = <seealso marker="#type-named_curve">[named_curve()] </seealso></v>
-	
-      </type>
-      
       <desc><p>Returns a list of supported ECCs. <c>eccs()</c>
       is equivalent to calling <c>eccs(Protocol)</c> with all
       supported protocols and then deduplicating the output.</p>
@@ -1169,9 +1194,8 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
     
     <func>
-      <name since="OTP 17.5">clear_pem_cache() -> ok </name>
+      <name name="clear_pem_cache" arity="0" since="OTP 17.5"/>
       <fsummary> Clears the pem cache</fsummary>
-
       <desc><p>PEM files, used by ssl API-functions, are cached. The
       cache is regularly checked to see if any cache entries should be
       invalidated, however this function provides a way to
@@ -1181,19 +1205,10 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
    
     <func>
-      <name since="OTP R14B">connect(Socket, Options) -> </name>
-      <name since="">connect(Socket, Options, Timeout) -> {ok, SslSocket} | {ok, SslSocket, Ext}
-	| {error, Reason}</name>
+      <name name="connect" arity="2" since="OTP R14B"/>
+      <name name="connect" arity="3" clause_i="1" since=""/>
       <fsummary>Upgrades a <c>gen_tcp</c>, or
 	equivalent, connected socket to an TLS socket.</fsummary>
-      <type>
-	<v>Socket = <seealso marker="#type-socket"> socket() </seealso></v>
-	<v>Options = <seealso marker="#type-tls_client_option"> [tls_client_option()] </seealso></v>
-	<v>Timeout = timeout()</v>
-	<v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-	<v>Ext = <seealso marker="#type-protocol_extensions">protocol_extensions()</seealso></v>
-	<v>Reason = closed | timeout | <seealso marker="#type-error_alert"> error_alert() </seealso></v>
-      </type>
       <desc><p>Upgrades a <c>gen_tcp</c>, or equivalent,
 	  connected socket to an TLS socket, that is, performs the
 	  client-side TLS handshake.</p>
@@ -1225,18 +1240,9 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
 
     <func>
-      <name since="">connect(Host, Port, Options) -></name>
-      <name since="">connect(Host, Port, Options, Timeout) ->
-	  {ok, SslSocket}| {ok, SslSocket, Ext} | {error, Reason}</name>
+      <name since="" name="connect" arity="3" clause_i="2"/>
+      <name since="" name="connect" arity="4"/>
       <fsummary>Opens an TLS/DTLS connection to <c>Host</c>, <c>Port</c>.</fsummary>
-      <type>
-	  <v>Host =<seealso marker="#type-host"> host() </seealso> </v>
-	  <v>Port = <seealso marker="kernel:inet#type-port_number">inet:port_number()</seealso></v>
-	  <v>Options = <seealso marker="#type-tls_client_option"> [tls_client_option()]</seealso></v>
-	  <v>Timeout = timeout()</v>
-	  <v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-	  <v>Reason = closed | timeout | <seealso marker="#type-error_alert"> error_alert() </seealso></v>
-      </type>
       <desc><p>Opens an TLS/DTLS connection to <c>Host</c>, <c>Port</c>.</p>
       
       <p> When the option <c>verify</c> is set to <c>verify_peer</c> the check 
@@ -1273,24 +1279,15 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
 
     <func>
-      <name since="">close(SslSocket) -> ok | {error, Reason}</name>
+      <name since="" name="close" arity="1" />
       <fsummary>Closes an TLS/DTLS connection.</fsummary>
-      <type>
-	  <v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-	  <v>Reason = term()</v>
-      </type>
       <desc><p>Closes an TLS/DTLS connection.</p>
       </desc>
     </func>
 
     <func>
-      <name since="OTP 18.1">close(SslSocket, How) -> ok | {ok, port()} | {error, Reason}</name>
+      <name since="OTP 18.1" name="close" arity="2"/>
       <fsummary>Closes an TLS connection.</fsummary>
-      <type>
-	  <v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-	  <v>How =  timeout() | {NewController::pid(), timeout()} </v>
-	  <v>Reason = term()</v>
-      </type>
       <desc><p>Closes or downgrades an TLS connection. In the latter case the transport
       connection will be handed over to the <c>NewController</c> process after receiving
       the TLS close alert from the peer. The returned transport socket will have
@@ -1299,15 +1296,9 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
     
     <func>
-      <name since="">controlling_process(SslSocket, NewOwner) ->
-	ok | {error, Reason}</name>
+      <name since="" name="controlling_process" arity="2" />
 	<fsummary>Assigns a new controlling process to the
 	TLS/DTLS socket.</fsummary>
-	<type>
-	  <v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-	  <v>NewOwner = pid()</v>
-	  <v>Reason = term()</v>
-	</type>
 	<desc><p>Assigns a new controlling process to the SSL socket. A
 	controlling process is the owner of an SSL socket, and receives
 	all messages from the socket.</p>
@@ -1315,17 +1306,9 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
 
     <func>
-      <name since="OTP 18.0">connection_information(SslSocket) ->
-        {ok, Result} |  {error, Reason} </name>
+      <name since="OTP 18.0" name="connection_information" arity="1"/>
       <fsummary>Returns all the connection information.
       </fsummary>
-      <type>
-	<v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-        <v>Item = protocol | selected_cipher_suite | sni_hostname | ecc | session_id | atom()</v>
-	<d>Meaningful atoms, not specified above, are the ssl option names.</d>
-	<v>Result = [{Item::atom(), Value::term()}]</v>
-        <v>Reason = term()</v>
-      </type>
       <desc><p>Returns the most relevant information about the connection, ssl options that
       are undefined will be filtered out. Note that values that affect the security of the
       connection will only be returned if explicitly requested by connection_information/2.</p>
@@ -1336,34 +1319,23 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
 
     <func>
-      <name since="OTP 18.0">connection_information(SslSocket, Items) ->
-        {ok, Result} |  {error, Reason} </name>
+      <name since="OTP 18.0" name="connection_information" arity="2"/>
       <fsummary>Returns the requested connection information.
       </fsummary>
-      <type>
-	<v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-	<v>Items = [Item]</v>
-	<v>Item = protocol | cipher_suite | sni_hostname | ecc | session_id | client_random 
-          | server_random  | master_secret | atom()</v>
-	<d>Note that client_random, server_random  and master_secret are values
-        that affect the security of connection. Meaningful atoms, not specified above, are the ssl option names.</d>
-	<v>Result = [{Item::atom(), Value::term()}]</v>
-        <v>Reason = term()</v>
-      </type>
       <desc><p>Returns the requested information items about the connection,
       if they are defined.</p>
+      <p>Note that client_random, server_random  and master_secret are values
+      that affect the security of connection. Meaningful atoms, not specified
+      above, are the ssl option names.</p>
+
       <note><p>If only undefined options are requested the
       resulting list can be empty.</p></note>
       </desc>
     </func>
 
       <func>
-      <name since="OTP 20.3">filter_cipher_suites(Suites, Filters) -> ciphers()</name>
+      <name since="OTP 20.3" name="filter_cipher_suites" arity="2" />
       <fsummary></fsummary>
-      <type>
-	<v> Suites =  <seealso marker="#type-ciphers"> ciphers() </seealso></v>
-        <v> Filters =  <seealso marker="#type-cipher_filters"> cipher_filters() </seealso></v>
-      </type>
       <desc><p>Removes cipher suites if any of the filter functions
       returns false for any part of the cipher suite. This function
       also calls default filter functions to make sure the cipher
@@ -1373,24 +1345,16 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
     
     <func>
-      <name since="">format_error(Reason) -> string()</name>
+      <name since="" name="format_error" arity="1" />
       <fsummary>Returns an error string.</fsummary>
-      <type>
-        <v>Reason = term()</v>
-      </type>
       <desc>
         <p>Presents the error returned by an SSL function as a printable string.</p>
       </desc>
     </func>
    
     <func>
-      <name since="">getopts(SslSocket, OptionNames) ->
-	{ok, [socketoption()]} | {error, Reason}</name>
+      <name since="" name="getopts" arity="2" />
       <fsummary>Gets the values of the specified options.</fsummary>
-      <type>
-	<v>Socket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-	<v>OptionNames = [atom()]</v>
-      </type>
       <desc>
 	<p>Gets the values of the specified socket options.
 	</p>
@@ -1398,16 +1362,9 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
 
     <func>
-      <name since="OTP 19.0">getstat(SslSocket) ->
-        {ok, OptionValues} | {error, inet:posix()}</name>
-      <name since="OTP 19.0">getstat(SslSocket, OptionNames) ->
-        {ok, OptionValues} | {error, inet:posix()}</name>
+      <name since="OTP 19.0" name="getstat" arity="1" />
+      <name since="OTP 19.0" name="getstat" arity="2" />
       <fsummary>Get one or more statistic options for a socket</fsummary>
-      <type>
-    <v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-    <v>OptionNames = [atom()]</v>
-        <v>OptionValues = [{inet:stat_option(), integer()}]</v>
-      </type>
       <desc>
         <p>Gets one or more statistic options for the underlying TCP socket.</p>
         <p>See inet:getstat/2 for statistic options description.</p>
@@ -1415,14 +1372,9 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
 
     <func>
-      <name since="OTP 21.0">handshake(HsSocket) -> </name>
-      <name since="OTP 21.0">handshake(HsSocket, Timeout) -> {ok, SslSocket}  | {error, Reason}</name>
+      <name since="OTP 21.0" name="handshake" arity="1" />
+      <name since="OTP 21.0" name="handshake" arity="2" clause_i="1" />
       <fsummary>Performs server-side SSL/TLS handshake.</fsummary>
-      <type>
-        <v>HsSocket = SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-        <v>Timeout = timeout()</v>
-        <v>Reason = closed | timeout | <seealso marker="#type-error_alert"> error_alert() </seealso></v>
-      </type>
       <desc>
         <p>Performs the SSL/TLS/DTLS server-side handshake.</p>
 	<p>Returns a new TLS/DTLS socket if the handshake is successful.</p>
@@ -1435,17 +1387,9 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
 
     <func>
-      <name since="OTP 21.0">handshake(Socket, Options) -> </name>
-      <name since="OTP 21.0">handshake(Socket, Options, Timeout) -> {ok, SslSocket} | {ok, SslSocket, Ext} | {error, Reason}</name>
+      <name since="OTP 21.0" name="handshake" arity="2" clause_i="2" />
+      <name since="OTP 21.0" name="handshake" arity="3" />
       <fsummary>Performs server-side SSL/TLS/DTLS handshake.</fsummary>
-      <type>
-        <v>Socket = socket() |  <seealso marker="#type-sslsocket"> socket() </seealso> </v>
-	<v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso> </v>
-	<v>Ext =  <seealso marker="#type-protocol_extensions">protocol_extensions()</seealso></v>
-	<v>Options = <seealso marker="#type-tls_server_option"> [server_option()] </seealso>  </v>
-        <v>Timeout = timeout()</v>
-        <v>Reason = closed | timeout | <seealso marker="#type-error_alert"> error_alert() </seealso></v>
-      </type>
       <desc>
         <p>If <c>Socket</c> is a ordinary <c>socket()</c>: upgrades a <c>gen_tcp</c>,
 	or equivalent, socket to an SSL socket, that is, performs
@@ -1481,52 +1425,33 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
 
     <func>
-      <name since="OTP 21.0">handshake_cancel(SslSocket) -> ok </name>
+      <name since="OTP 21.0" name="handshake_cancel" arity="1" />
       <fsummary>Cancel handshake with a fatal alert</fsummary>
-      <type>
-        <v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-      </type>
       <desc>
         <p>Cancel the handshake with a fatal <c>USER_CANCELED</c> alert.</p>
       </desc>
     </func>
 
     <func>
-      <name since="OTP 21.0">handshake_continue(HsSocket, Options) -> {ok, SslSocket} | {error, Reason}</name>
-      <name since="OTP 21.0">handshake_continue(HsSocket, Options, Timeout) -> {ok, SslSocket} | {error, Reason}</name>
+      <name since="OTP 21.0" name="handshake_continue" arity="2" />
+      <name since="OTP 21.0" name="handshake_continue" arity="3" />
       <fsummary>Continue the SSL/TLS handshake.</fsummary>
-      <type>
-	<v>HsSocket = SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-	<v>Options = <seealso marker="#type-tls_option"> tls_option() </seealso> </v>
-	<v>Timeout = timeout()</v>
-	<v>Reason = closed | timeout | <seealso marker="#type-error_alert"> error_alert() </seealso></v>
-      </type>
       <desc>
         <p>Continue the SSL/TLS handshake possiby with new, additional or changed options.</p>
       </desc>
     </func>
     
     <func>
-      <name since="">listen(Port, Options) ->
-	{ok, ListenSocket} | {error, Reason}</name>
+      <name since="" name="listen" arity="2" />
       <fsummary>Creates an SSL listen socket.</fsummary>
-      <type>
-	<v>Port = <seealso marker="kernel:inet#type-port_number">inet:port_number()</seealso></v>
-	<v>Options = <seealso marker="#type-tls_server_option"> [server_option()] </seealso></v>
-	<v>ListenSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-      </type>
       <desc>
 	<p>Creates an SSL listen socket.</p>
       </desc>
     </func>
 
     <func>
-      <name since="OTP 18.0">negotiated_protocol(SslSocket) -> {ok, Protocol} | {error, protocol_not_negotiated}</name>
+      <name since="OTP 18.0" name="negotiated_protocol" arity="1" />
       <fsummary>Returns the protocol negotiated through ALPN or NPN extensions.</fsummary>
-      <type>
-        <v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-        <v>Protocol = binary()</v>
-      </type>
       <desc>
         <p>
           Returns the protocol negotiated through ALPN or NPN extensions.
@@ -1535,12 +1460,8 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
     
     <func>
-      <name since="">peercert(SslSocket) -> {ok, Cert} | {error, Reason}</name>
+      <name since="" name="peercert" arity="1" />
       <fsummary>Returns the peer certificate.</fsummary>
-     <type>
-        <v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-        <v>Cert = binary()</v>
-      </type>
       <desc>
         <p>The peer certificate is returned as a DER-encoded binary.
 	  The certificate can be decoded with
@@ -1550,27 +1471,16 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
 
     <func>
-      <name since="">peername(SslSocket) -> {ok, {Address, Port}} |
-	{error, Reason}</name>
+      <name since="" name="peername" arity="1" />
       <fsummary>Returns the peer address and port.</fsummary>
-      <type>
-        <v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-        <v>Address = ipaddress()</v>
-	<v>Port = <seealso marker="kernel:inet#type-port_number">inet:port_number()</seealso></v>
-      </type>
       <desc>
         <p>Returns the address and port number of the peer.</p>
       </desc>
     </func>
     
       <func>
-      <name since="OTP 20.3">prepend_cipher_suites(Preferred, Suites) -> ciphers()</name>
+      <name since="OTP 20.3" name="prepend_cipher_suites" arity="2" />
       <fsummary></fsummary>
-      <type>
-	<v>Preferred = <seealso marker="#type-ciphers">ciphers()</seealso> |
-	<seealso marker="#type-cipher_filters">cipher_filters()</seealso></v>
-	<v>Suites  =  <seealso marker="#type-ciphers">ciphers()</seealso></v>
-      </type>
       <desc><p>Make <c>Preferred</c> suites become the most preferred
       suites that is put them at the head of the cipher suite list
       <c>Suites</c> after removing them from <c>Suites</c> if
@@ -1581,15 +1491,8 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
 
     <func>
-      <name since="OTP R15B01">prf(Socket, Secret, Label, Seed, WantedLength) -> {ok, binary()} | {error, reason()}</name>
+      <name since="OTP R15B01" name="prf" arity="5" />
       <fsummary>Uses a session Pseudo-Random Function to generate key material.</fsummary>
-      <type>
-	<v>Socket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-	<v>Secret = binary() | master_secret</v>
-	<v>Label = binary()</v>
-	<v>Seed = [binary() | <seealso marker="#type-prf_random"> prf_random()</seealso>]</v>
-	<v>WantedLength = non_neg_integer()</v>
-      </type>
       <desc>
         <p>Uses the Pseudo-Random Function (PRF) of a TLS session to generate
 	  extra key material. It either takes user-generated values for
@@ -1601,16 +1504,9 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
     
     <func>
-      <name since="">recv(SslSocket, Length) -> </name>
-      <name since="">recv(SslSocket, Length, Timeout) -> {ok, Data} | {error,
-	Reason}</name>
+      <name since="" name="recv" arity="2" />
+      <name since="" name="recv" arity="3" />
       <fsummary>Receives data on a socket.</fsummary>
-      <type>
-        <v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-        <v>Length = integer()</v>
-        <v>Timeout = timeout()</v>
-        <v>Data = [char()] | binary()</v>
-      </type>
       <desc>
         <p>Receives a packet from a socket in passive
           mode. A closed socket is indicated by return value
@@ -1628,11 +1524,8 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
     
     <func>
-      <name since="OTP R14B">renegotiate(SslSocket) -> ok | {error, Reason}</name>
+      <name since="OTP R14B" name="renegotiate" arity="1" />
       <fsummary>Initiates a new handshake.</fsummary>
-      <type>
-	<v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-      </type>
       <desc><p>Initiates a new handshake. A notable return value is
       <c>{error, renegotiation_rejected}</c> indicating that the peer
       refused to go through with the renegotiation, but the connection
@@ -1641,40 +1534,27 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
     
     <func>
-      <name since="">send(SslSocket, Data) -> ok | {error, Reason}</name>
+      <name since="" name="send" arity="2" />
       <fsummary>Writes data to a socket.</fsummary>
-      <type>
-        <v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-        <v>Data = iodata()</v>
-      </type>
       <desc>
-        <p>Writes <c>Data</c> to <c>Socket</c>.</p>
+        <p>Writes <c>Data</c> to <c>SslSocket</c>.</p>
         <p>A notable return value is <c>{error, closed}</c> indicating that
           the socket is closed.</p>
       </desc>
     </func>
 
     <func>
-      <name since="">setopts(SslSocket, Options) -> ok | {error, Reason}</name>
+      <name since="" name="setopts" arity="2" />
       <fsummary>Sets socket options.</fsummary>
-      <type>
-        <v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-        <v>Options = <seealso marker="#type-socket_option"> [socket_option()] </seealso></v>
-      </type>
       <desc>
         <p>Sets options according to <c>Options</c> for socket
-          <c>Socket</c>.</p>
+          <c>SslSocket</c>.</p>
       </desc>
     </func>
 
     <func>
-      <name since="OTP R14B">shutdown(SslSocket, How) -> ok | {error, Reason}</name>
+      <name since="OTP R14B" name="shutdown" arity="2" />
       <fsummary>Immediately closes a socket.</fsummary>
-      <type>
-        <v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-        <v>How = read | write | read_write</v>
-        <v>Reason = reason()</v>
-      </type>
       <desc>
         <p>Immediately closes a socket in one or two directions.</p>
         <p><c>How == write</c> means closing the socket for writing,
@@ -1686,14 +1566,9 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
     
     <func>
-      <name since="">ssl_accept(SslSocket) -> </name>
-      <name since="">ssl_accept(SslSocket, Timeout) -> ok | {error, Reason}</name>
+      <name since="" name="ssl_accept" arity="1" />
+      <name since="" name="ssl_accept" arity="2" />
       <fsummary>Performs server-side SSL/TLS handshake.</fsummary>
-      <type>
-        <v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-        <v>Timeout = timeout()</v>
-        <v>Reason = closed | timeout | <seealso marker="#type-error_alert"> error_alert() </seealso></v>
-      </type>
       <desc>
 	<p>Deprecated in OTP 21, use <seealso marker="#handshake-1">handshake/[1,2]</seealso> instead.</p>
 	<note><p>handshake/[1,2] always returns a new socket.</p></note>
@@ -1701,15 +1576,8 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
 
     <func>
-      <name since="">ssl_accept(Socket, Options) -> </name>
-      <name since="OTP R14B">ssl_accept(Socket, Options, Timeout) -> {ok, Socket} | ok | {error, Reason}</name>
+      <name since="OTP R14B" name="ssl_accept" arity="3" />
       <fsummary>Performs server-side SSL/TLS/DTLS handshake.</fsummary>
-      <type>
-        <v>Socket = socket() |  <seealso marker="#type-sslsocket"> sslsocket() </seealso> </v>
-	<v>Options =  <seealso marker="#type-tls_server_option"> [server_option()] </seealso> </v>
-        <v>Timeout = timeout()</v>
-        <v>Reason = closed | timeout | <seealso marker="#type-error_alert"> error_alert() </seealso></v>
-      </type>
       <desc>
 	<p>Deprecated in OTP 21, use  <seealso marker="#handshake-3">handshake/[2,3]</seealso> instead.</p>
 	<note><p>handshake/[2,3] always returns a new socket.</p></note>
@@ -1717,27 +1585,18 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
     
     <func>
-      <name since="">sockname(SslSocket) -> {ok, {Address, Port}} |
-	{error, Reason}</name>
+      <name since="" name="sockname" arity="1" />
       <fsummary>Returns the local address and port.</fsummary>
-      <type>
-        <v>SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-	<v>Address = <seealso marker="#type-ip_address">ip_address()</seealso></v>
-	<v>Port = <seealso marker="kernel:inet#type-port_number">inet:port_number()</seealso></v>
-      </type>
       <desc>
         <p>Returns the local address and port number of socket
-          <c>Socket</c>.</p>
+          <c>SslSocket</c>.</p>
       </desc>
     </func>
     
     <func>
-      <name since="OTP R14B">start() -> </name>
+      <name since="OTP R14B" name="start" arity="0" />
       <name since="OTP R14B">start(Type) -> ok | {error, Reason}</name>
       <fsummary>Starts the SSL application.</fsummary>
-      <type>
-        <v>Type = permanent | transient | temporary</v>
-      </type>
       <desc>
         <p>Starts the SSL application. Default type
           is <c>temporary</c>.</p>
@@ -1745,7 +1604,7 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
 
     <func>
-      <name since="OTP R14B">stop() -> ok </name>
+      <name since="OTP R14B" name="stop" arity="0" />
       <fsummary>Stops the SSL application.</fsummary>
       <desc>
         <p>Stops the SSL application.</p>
@@ -1753,28 +1612,18 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
 
     <func>
-      <name since="OTP 21.0">suite_to_str(CipherSuite) -> String</name>
+      <name since="OTP 21.0" name="suite_to_str" arity="1" />
       <fsummary>Returns the string representation of a cipher suite.</fsummary>
-      <type>
-        <v>CipherSuite =  <seealso marker="#type-erl_cipher_suite"> erl_cipher_suite() </seealso></v>
-	<v>String = string()</v>
-      </type>
       <desc>
         <p>Returns the string representation of a cipher suite.</p>
       </desc>
     </func>
 
     <func>
-      <name since="">transport_accept(ListenSocket) -></name>
-      <name since="">transport_accept(ListenSocket, Timeout) ->
-	{ok, SslSocket} | {error, Reason}</name>
+      <name since="" name="transport_accept" arity="1" />
+      <name since="" name="transport_accept" arity="2" />
       <fsummary>Accepts an incoming connection and
 	prepares for <c>ssl_accept</c>.</fsummary>
-      <type>
-        <v>ListenSocket = SslSocket =  <seealso marker="#type-sslsocket"> sslsocket() </seealso></v>
-        <v>Timeout = timeout()</v>
-        <v>Reason = reason()</v>
-      </type>
       <desc>
         <p>Accepts an incoming connection request on a listen socket.
 	<c>ListenSocket</c> must be a socket returned from
@@ -1800,13 +1649,9 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
     
     <func>
-      <name since="OTP R14B">versions() -> [versions_info()]</name>
+      <name since="OTP R14B" name="versions" arity="0" />
       <fsummary>Returns version information relevant for the
 	SSL application.</fsummary>
-      <type>
-	<v>versions_info() = {app_vsn, string()} | {supported | available, [ssl_tls_protocol()]} |
-	{supported_dtls | available_dtls, [dtls_protocol()]}	</v>
-      </type>
       <desc>
 	<p>Returns version information relevant for the SSL
 	application.</p>
diff --git a/lib/ssl/doc/src/standards_compliance.xml b/lib/ssl/doc/src/standards_compliance.xml
index c20bab4e50..25840d0fc6 100644
--- a/lib/ssl/doc/src/standards_compliance.xml
+++ b/lib/ssl/doc/src/standards_compliance.xml
@@ -126,8 +126,33 @@
 
   <section>
     <title>TLS 1.3</title>
-    <p> This section describes the current state of standards compliance for TLS 1.3.</p>
-    <p>(C = Compliant, NC = Non-Compliant, P = Partially-Compliant, NA = Not Applicable)</p>
+    <p>OTP-22 introduces basic support for TLS 1.3 on the server side. Basic functionality
+    covers a simple TLS 1.3 handshake with support of the mandatory extensions
+    (supported_groups, signature_algorithms, key_share, supported_versions and
+    signature_algorithms_cert). The server supports a selective set of cryptographic algorithms:</p>
+    <list type="bulleted">
+      <item>Key Exchange: ECDHE</item>
+      <item>Groups: all standard groups supported for the Diffie-Hellman key exchange</item>
+      <item>Ciphers: TLS_AES_128_GCM_SHA256 and TLS_AES_256_GCM_SHA384</item>
+      <item>Signature Algorithms: RSA and RSA PSS</item>
+      <item>Certificates: currently only certificates with RSA keys are supported</item>
+    </list>
+    <p>Other notable features:</p>
+    <list type="bulleted">
+      <item>The server supports the HelloRetryRequest mechanism</item>
+      <item>PSK and session resumption not supported</item>
+      <item>Early data and 0-RTT not supported</item>
+      <item>Key and Initialization Vector Update not supported</item>
+    </list>
+    <p>For more detailed information see the
+    <seealso marker="#soc_table">Standards Compliance</seealso> below.</p>
+    <warning><p>Note that the client side is not yet functional. It is planned to be released
+    later in OTP-22.</p></warning>
+
+    <p> The following table describes the current state of standards compliance for TLS 1.3.</p>
+    <p>(<em>C</em> = Compliant, <em>NC</em> = Non-Compliant, <em>PC</em> = Partially-Compliant,
+    <em>NA</em> = Not Applicable)</p>
+    <marker id="soc_table"/>
     <table>
       <row>
         <cell align="left" valign="middle"><em>Section</em></cell>
@@ -155,7 +180,7 @@
       <row>
         <cell align="left" valign="middle"></cell>
         <cell align="left" valign="middle">RSASSA-PSS signature schemes</cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle">22</cell>
       </row>
       <row>
@@ -178,7 +203,7 @@
 	  </url>
 	</cell>
         <cell align="left" valign="middle"></cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle"><em>22</em></cell>
       </row>
       <row>
@@ -240,7 +265,7 @@
 	  </url>
 	</cell>
         <cell align="left" valign="middle"></cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle"><em>22</em></cell>
       </row>
       <row>
@@ -783,7 +808,7 @@
       <row>
         <cell align="left" valign="middle"></cell>
         <cell align="left" valign="middle"><em>Server</em></cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle"><em>22</em></cell>
       </row>
       <row>
@@ -1265,7 +1290,7 @@
       <row>
         <cell align="left" valign="middle"></cell>
         <cell align="left" valign="middle"><em>Server</em></cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle"><em>22</em></cell>
       </row>
       <row>
@@ -1379,7 +1404,7 @@
       <row>
         <cell align="left" valign="middle"></cell>
         <cell align="left" valign="middle"><em>Server</em></cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle"><em>22</em></cell>
       </row>
       <row>
@@ -1456,7 +1481,7 @@
       <row>
         <cell align="left" valign="middle"></cell>
         <cell align="left" valign="middle"><em>Server</em></cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle"><em>22</em></cell>
       </row>
       <row>
@@ -1527,7 +1552,7 @@
       <row>
         <cell align="left" valign="middle"></cell>
         <cell align="left" valign="middle"><em>Server</em></cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle"><em></em></cell>
       </row>
       <row>
@@ -1762,7 +1787,7 @@
 	  </url>
 	</cell>
         <cell align="left" valign="middle"><em></em></cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle"><em>22</em></cell>
       </row>
       <row>
@@ -1924,7 +1949,7 @@
 	  </url>
 	</cell>
         <cell align="left" valign="middle"><em></em></cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle"><em>22</em></cell>
       </row>
       <row>
@@ -1949,7 +1974,7 @@
       <row>
         <cell align="left" valign="middle"></cell>
         <cell align="left" valign="middle"><em>Digital signatures</em></cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle"><em>22</em></cell>
       </row>
       <row>
@@ -1997,7 +2022,7 @@
 	  </url>
 	</cell>
         <cell align="left" valign="middle"><em></em></cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle"><em>22</em></cell>
       </row>
       <row>
@@ -2108,7 +2133,7 @@
       <row>
         <cell align="left" valign="middle"></cell>
         <cell align="left" valign="middle"><em>TLS 1.3 ServerHello</em></cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle"><em>22</em></cell>
       </row>
       <row>
@@ -2160,7 +2185,7 @@
 	  </url>
 	</cell>
         <cell align="left" valign="middle"><em></em></cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle"><em>22</em></cell>
       </row>
       <row>
@@ -2223,7 +2248,7 @@
 	  </url>
 	</cell>
         <cell align="left" valign="middle"><em></em></cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle"><em>22</em></cell>
       </row>
 
@@ -2289,7 +2314,7 @@
 	  </url>
 	</cell>
         <cell align="left" valign="middle"><em></em></cell>
-	<cell align="left" valign="middle"><em>P</em></cell>
+	<cell align="left" valign="middle"><em>PC</em></cell>
 	<cell align="left" valign="middle"><em>22</em></cell>
       </row>
 
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 74511dce4b..a3138e8c30 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -80,33 +80,38 @@
               cipher_filters/0,
               sign_algo/0,
               protocol_version/0,
+              protocol_version_tuple/0,
               protocol_extensions/0,
               session_id/0,
               error_alert/0,
               srp_param_type/0]).
 
 %% -------------------------------------------------------------------------------------------------------
--type socket()                   :: gen_tcp:socket().
--type socket_option()            :: gen_tcp:connect_option() | gen_tcp:listen_option() | gen_udp:option().
--type sslsocket()                :: any().
--type tls_option()               :: tls_client_option() | tls_server_option().
--type tls_client_option()        :: client_option() | common_option() | socket_option() |  transport_option().
--type tls_server_option()        :: server_option() | common_option() | socket_option() | transport_option().
+
+-type socket()                   :: gen_tcp:socket(). % exported
+-type socket_option()            :: gen_tcp:connect_option() | gen_tcp:listen_option() | gen_udp:option(). % exported
+-type sslsocket()                :: any(). % exported
+-type tls_option()               :: tls_client_option() | tls_server_option(). % exported
+-type tls_client_option()        :: client_option() | common_option() | socket_option() |  transport_option(). % exported
+-type tls_server_option()        :: server_option() | common_option() | socket_option() | transport_option(). % exported
 -type active_msgs()              :: {ssl, sslsocket(), Data::binary() | list()} | {ssl_closed, sslsocket()} |
-                                    {ssl_error, sslsocket(), Reason::term()} | {ssl_passive, sslsocket()}.
+                                    {ssl_error, sslsocket(), Reason::any()} | {ssl_passive, sslsocket()}. % exported
 -type transport_option()         :: {cb_info, {CallbackModule::atom(), DataTag::atom(),
                                                ClosedTag::atom(), ErrTag::atom()}} |  
                                     {cb_info, {CallbackModule::atom(), DataTag::atom(),
                                                ClosedTag::atom(), ErrTag::atom(), PassiveTag::atom()}}.
--type host()                     :: hostname() | ip_address().
+-type host()                     :: hostname() | ip_address(). % exported
 -type hostname()                 :: string().
 -type ip_address()               :: inet:ip_address().
--type session_id()               :: binary().
--type protocol_version()         :: tls_version() | dtls_version().
+-type session_id()               :: binary(). % exported
+-type protocol_version()         :: tls_version() | dtls_version(). % exported
+-type protocol_version_tuple()   :: tls_version_tuple() | dtls_version_tuple(). % exported
 -type tls_version()              :: 'tlsv1.2' | 'tlsv1.3' | tls_legacy_version().
+-type tls_version_tuple()        :: {3,0} | {3,1} | {3,2} | {3,3} | {3,4}.
 -type dtls_version()             :: 'dtlsv1.2' | dtls_legacy_version().
+-type dtls_version_tuple()       :: {254,254} | {254,253}.
 -type tls_legacy_version()       ::  tlsv1 | 'tlsv1.1' | sslv3.
--type dtls_legacy_version()      :: 'dtlsv1'. 
+-type dtls_legacy_version()      :: 'dtlsv1'.
 -type verify_type()              :: verify_none | verify_peer.
 -type cipher()                   :: aes_128_cbc |
                                     aes_256_cbc |
@@ -117,14 +122,16 @@
                                     aes_128_ccm_8 |
                                     aes_256_ccm_8 |                                    
                                     chacha20_poly1305 |
-                                    legacy_cipher().
+                                    null |
+                                    legacy_cipher(). % exported
 -type legacy_cipher()            ::  rc4_128 |
                                      des_cbc |
                                      '3des_ede_cbc'.
 
 -type hash()                     :: sha |
                                     sha2() |
-                                    legacy_hash().
+                                    legacy_hash() |
+                                    null. % exported
 
 -type sha2()                    ::  sha224 |
                                     sha256 |
@@ -133,7 +140,7 @@
 
 -type legacy_hash()             :: md5.
 
--type sign_algo()               :: rsa | dsa | ecdsa.
+-type sign_algo()               :: rsa | dsa | ecdsa. % exported
 
 -type sign_scheme()             :: rsa_pkcs1_sha256 
                                  | rsa_pkcs1_sha384
@@ -155,7 +162,7 @@
                                    srp_rsa| srp_dss |
                                    psk | dhe_psk | rsa_psk |
                                    dh_anon | ecdh_anon | srp_anon |
-                                   any. %% TLS 1.3
+                                   any | null. %% TLS 1.3 , exported
 -type erl_cipher_suite()       :: #{key_exchange := kex_algo(),
                                     cipher := cipher(),
                                     mac    := hash() | aead,
@@ -195,15 +202,18 @@
                                  secp160r1 |
                                  secp160r2.
 
+-type group() :: secp256r1 | secp384r1 | secp521r1 | ffdhe2048 |
+                 ffdhe3072 | ffdhe4096 | ffdhe6144 | ffdhe8192.
+
 -type srp_param_type()        :: srp_1024 |
                                  srp_1536 |
                                  srp_2048 |
                                  srp_3072 |
                                  srp_4096 |
                                  srp_6144 |
-                                 srp_8192.
+                                 srp_8192. % exported
 
--type error_alert()           :: {tls_alert, {tls_alert(), Description::string()}}.
+-type error_alert()           :: {tls_alert, {tls_alert(), Description::string()}}. % exported
 
 -type tls_alert()             :: close_notify | 
                                  unexpected_message | 
@@ -234,6 +244,74 @@
                                  bad_certificate_hash_value |
                                  unknown_psk_identity |
                                  no_application_protocol.
+-type http_packet()           :: http_request() |
+                                 http_response() |
+                                 http_header() |
+                                 http_eoh |
+                                 http_error().
+-type http_request()          :: {http_request, http_method(), http_uri(), http_version()}.
+-type http_response()         :: {http_response, http_version(), integer(), http_string()}.
+-type http_header()           :: {http_header, integer(), http_field(), Reserved :: term(),
+                                  Value :: http_string()}.
+-type http_error()            :: {http_error, http_string()}.
+-type http_method()           :: 'OPTIONS' | 'GET' | 'HEAD' | 'POST' | 'PUT' | 'DELETE' | 'TRACE'.
+-type http_uri()              :: any().
+-type http_version()          :: {Major :: integer(), Minor :: integer()}.
+-type http_field()            :: 'Cache-Control' |
+                                 'Connection' |
+                                 'Date' |
+                                 'Pragma' |
+                                 'Transfer-Encoding' |
+                                 'Upgrade' |
+                                 'Via' |
+                                 'Accept' |
+                                 'Accept-Charset' |
+                                 'Accept-Encoding' |
+                                 'Accept-Language' |
+                                 'Authorization' |
+                                 'From' |
+                                 'Host' |
+                                 'If-Modified-Since' |
+                                 'If-Match' |
+                                 'If-None-Match' |
+                                 'If-Range' |
+                                 'If-Unmodified-Since' |
+                                 'Max-Forwards' |
+                                 'Proxy-Authorization' |
+                                 'Range' |
+                                 'Referer' |
+                                 'User-Agent' |
+                                 'Age' |
+                                 'Location' |
+                                 'Proxy-Authenticate' |
+                                 'Public' |
+                                 'Retry-After' |
+                                 'Server' |
+                                 'Vary' |
+                                 'Warning' |
+                                 'Www-Authenticate' |
+                                 'Allow' |
+                                 'Content-Base' |
+                                 'Content-Encoding' |
+                                 'Content-Language' |
+                                 'Content-Length' |
+                                 'Content-Location' |
+                                 'Content-Md5' |
+                                 'Content-Range' |
+                                 'Content-Type' |
+                                 'Etag' |
+                                 'Expires' |
+                                 'Last-Modified' |
+                                 'Accept-Ranges' |
+                                 'Set-Cookie' |
+                                 'Set-Cookie2' |
+                                 'X-Forwarded-For' |
+                                 'Cookie' |
+                                 'Keep-Alive' |
+                                 'Proxy-Connection' |
+                                 http_string().
+-type http_string()           :: string() | binary().
+
 %% -------------------------------------------------------------------------------------------------------
 -type common_option()        :: {protocol, protocol()} |
                                 {handshake, handshake_completion()} |
@@ -243,7 +321,7 @@
                                 {keyfile, key_pem()} |
                                 {password, key_password()} |
                                 {ciphers, cipher_suites()} |
-                                {eccs, eccs()} |
+                                {eccs, [named_curve()]} |
                                 {signature_algs_cert, signature_schemes()} |
                                 {secure_renegotiate, secure_renegotiation()} |
                                 {depth, allowed_cert_chain_length()} |
@@ -270,29 +348,28 @@
                                      #{algorithm := rsa | dss | ecdsa, 
                                        engine := crypto:engine_ref(), 
                                        key_id := crypto:key_id(), 
-                                       password => crypto:password()}.
+                                       password => crypto:password()}. % exported
 -type key_pem()                   :: file:filename().
 -type key_password()              :: string().
 -type cipher_suites()             :: ciphers().    
 -type ciphers()                   :: [erl_cipher_suite()] |
-                                     string(). % (according to old API)
+                                     string(). % (according to old API) exported
 -type cipher_filters()            :: list({key_exchange | cipher | mac | prf,
-                                        algo_filter()}).
+                                        algo_filter()}). % exported
 -type algo_filter()               :: fun((kex_algo()|cipher()|hash()|aead|default_prf) -> true | false).
--type eccs()                      :: [named_curve()].  
 -type secure_renegotiation()      :: boolean(). 
 -type allowed_cert_chain_length() :: integer().
 
--type custom_verify()               ::  {Verifyfun :: fun(), InitialUserState :: term()}.
+-type custom_verify()               ::  {Verifyfun :: fun(), InitialUserState :: any()}.
 -type crl_check()                :: boolean() | peer | best_effort.
--type crl_cache_opts()           :: [term()].
+-type crl_cache_opts()           :: [any()].
 -type handshake_size()           :: integer().
 -type hibernate_after()          :: timeout().
 -type root_fun()                 ::  fun().
 -type protocol_versions()        ::  [protocol_version()].
 -type signature_algs()           ::  [{hash(), sign_algo()}].
 -type signature_schemes()        ::  [sign_scheme()].
--type custom_user_lookup()       ::  {Lookupfun :: fun(), UserState :: term()}.
+-type custom_user_lookup()       ::  {Lookupfun :: fun(), UserState :: any()}.
 -type padding_check()            :: boolean(). 
 -type beast_mitigation()         :: one_n_minus_one | zero_n | disabled.
 -type srp_identity()             :: {Username :: string(), Password :: string()}.
@@ -375,7 +452,7 @@
 -type honor_ecc_order()          :: boolean().
 -type client_renegotiation()     :: boolean().
 %% -------------------------------------------------------------------------------------------------------
--type prf_random() :: client_random | server_random.
+-type prf_random() :: client_random | server_random. % exported
 -type protocol_extensions()  :: #{renegotiation_info => binary(),
                                   signature_algs => signature_algs(),
                                   alpn =>  app_level_protocol(),
@@ -383,7 +460,7 @@
                                   next_protocol => app_level_protocol(),
                                   ec_point_formats  => [0..2],
                                   elliptic_curves => [public_key:oid()],
-                                  sni => hostname()}.
+                                  sni => hostname()}. % exported
 %% -------------------------------------------------------------------------------------------------------
 
 %%%--------------------------------------------------------------------
@@ -419,14 +496,31 @@ stop() ->
 %%
 %% Description: Connect to an ssl server.
 %%--------------------------------------------------------------------
--spec connect(host() | port(), [tls_client_option()]) -> {ok, #sslsocket{}} |
-                                                      {error, reason()}.
+
+-spec connect(TCPSocket, TLSOptions) ->
+                     {ok, sslsocket()} |
+                     {error, reason()} |
+                     {option_not_a_key_value_tuple, any()} when
+      TCPSocket :: socket(),
+      TLSOptions :: [tls_client_option()].
+
 connect(Socket, SslOptions) when is_port(Socket) ->
     connect(Socket, SslOptions, infinity).
 
--spec connect(host() | port(), [tls_client_option()] | inet:port_number(),
-	      timeout() | list()) ->
-		     {ok, #sslsocket{}} | {error, reason()}.
+-spec connect(TCPSocket, TLSOptions, Timeout) ->
+                     {ok, sslsocket()} | {error, reason()} when
+      TCPSocket :: socket(),
+      TLSOptions :: [tls_client_option()],
+      Timeout :: timeout();
+             (Host, Port, TLSOptions) ->
+                     {ok, sslsocket()} |
+                     {ok, sslsocket(),Ext :: protocol_extensions()} |
+                     {error, reason()} |
+                     {option_not_a_key_value_tuple, any()} when
+      Host :: host(),
+      Port :: inet:port_number(),
+      TLSOptions :: [tls_client_option()].
+
 connect(Socket, SslOptions0, Timeout) when is_port(Socket),
                                            (is_integer(Timeout) andalso Timeout >= 0) or (Timeout == infinity) ->
     CbInfo = handle_option(cb_info, SslOptions0, default_cb_info(tls)),
@@ -443,8 +537,16 @@ connect(Socket, SslOptions0, Timeout) when is_port(Socket),
 connect(Host, Port, Options) ->
     connect(Host, Port, Options, infinity).
 
--spec connect(host() | port(), inet:port_number(), list(), timeout()) ->
-		     {ok, #sslsocket{}} | {error, reason()}.
+
+-spec connect(Host, Port, TLSOptions, Timeout) ->
+                     {ok, sslsocket()} |
+                     {ok, sslsocket(),Ext :: protocol_extensions()} |
+                     {error, reason()} |
+                     {option_not_a_key_value_tuple, any()} when
+      Host :: host(),
+      Port :: inet:port_number(),
+      TLSOptions :: [tls_client_option()],
+      Timeout :: timeout().
 
 connect(Host, Port, Options, Timeout) when (is_integer(Timeout) andalso Timeout >= 0) or (Timeout == infinity) ->
     try
@@ -461,7 +563,10 @@ connect(Host, Port, Options, Timeout) when (is_integer(Timeout) andalso Timeout
     end.
 
 %%--------------------------------------------------------------------
--spec listen(inet:port_number(), [tls_server_option()]) ->{ok, #sslsocket{}} | {error, reason()}.
+-spec listen(Port, Options) -> {ok, ListenSocket} | {error, reason()} when
+      Port::inet:port_number(),
+      Options::[tls_server_option()],
+      ListenSocket :: sslsocket().
 
 %%
 %% Description: Creates an ssl listen socket.
@@ -480,13 +585,20 @@ listen(Port, Options0) ->
 %%
 %% Description: Performs transport accept on an ssl listen socket
 %%--------------------------------------------------------------------
--spec transport_accept(#sslsocket{}) -> {ok, #sslsocket{}} |
-					{error, reason()}.
+-spec transport_accept(ListenSocket) -> {ok, SslSocket} |
+					{error, reason()} when
+      ListenSocket :: sslsocket(),
+      SslSocket :: sslsocket().
+
 transport_accept(ListenSocket) ->
     transport_accept(ListenSocket, infinity).
 
--spec transport_accept(#sslsocket{}, timeout()) -> {ok, #sslsocket{}} |
-						   {error, reason()}.
+-spec transport_accept(ListenSocket, Timeout) -> {ok, SslSocket} |
+					{error, reason()} when
+      ListenSocket :: sslsocket(),
+      Timeout :: timeout(),
+      SslSocket :: sslsocket().
+
 transport_accept(#sslsocket{pid = {ListenSocket,
 				   #config{connection_cb = ConnectionCb} = Config}}, Timeout) 
   when (is_integer(Timeout) andalso Timeout >= 0) or (Timeout == infinity) ->
@@ -502,12 +614,22 @@ transport_accept(#sslsocket{pid = {ListenSocket,
 %% Description: Performs accept on an ssl listen socket. e.i. performs
 %%              ssl handshake.
 %%--------------------------------------------------------------------
--spec ssl_accept(#sslsocket{}) -> ok | {error, timeout | closed | {options, any()}| error_alert()}.
+-spec ssl_accept(SslSocket) ->
+                        ok |
+                        {error, Reason} when
+      SslSocket :: sslsocket(),
+      Reason :: closed | timeout | error_alert().
+
 ssl_accept(ListenSocket) ->
     ssl_accept(ListenSocket, [], infinity).
 
--spec ssl_accept(#sslsocket{} | port(), timeout()| [tls_server_option()]) ->
-			ok | {ok, #sslsocket{}} | {error, timeout | closed | {options, any()}| error_alert()}.
+-spec ssl_accept(Socket, TimeoutOrOptions) ->
+			ok |
+                        {ok, sslsocket()} | {error, Reason} when
+      Socket :: sslsocket() | socket(),
+      TimeoutOrOptions :: timeout() | [tls_server_option()],
+      Reason :: timeout | closed | {options, any()} | error_alert().
+
 ssl_accept(Socket, Timeout)  when  (is_integer(Timeout) andalso Timeout >= 0) or (Timeout == infinity) ->
     ssl_accept(Socket, [], Timeout);
 ssl_accept(ListenSocket, SslOptions) when is_port(ListenSocket) ->
@@ -515,8 +637,13 @@ ssl_accept(ListenSocket, SslOptions) when is_port(ListenSocket) ->
 ssl_accept(Socket, Timeout) ->
     ssl_accept(Socket, [], Timeout).
 
--spec ssl_accept(#sslsocket{} | port(), [tls_server_option()], timeout()) ->
-			ok | {ok, #sslsocket{}} | {error, timeout | closed | {options, any()}| error_alert()}.
+-spec ssl_accept(Socket, Options, Timeout) ->
+			ok | {ok, sslsocket()} | {error, Reason} when
+      Socket :: sslsocket() | socket(),
+      Options :: [tls_server_option()],
+      Timeout :: timeout(),
+      Reason :: timeout | closed | {options, any()} | error_alert().
+
 ssl_accept(Socket, SslOptions, Timeout) when is_port(Socket) ->
     handshake(Socket, SslOptions, Timeout);
 ssl_accept(Socket, SslOptions, Timeout) ->
@@ -533,13 +660,28 @@ ssl_accept(Socket, SslOptions, Timeout) ->
 %%--------------------------------------------------------------------
 
 %% Performs the SSL/TLS/DTLS server-side handshake.
--spec handshake(#sslsocket{}) -> {ok, #sslsocket{}} | {error, timeout | closed | {options, any()} | error_alert()}.
+-spec handshake(HsSocket) -> {ok, SslSocket} | {ok, SslSocket, Ext} | {error, Reason} when
+      HsSocket :: sslsocket(),
+      SslSocket :: sslsocket(),
+      Ext :: protocol_extensions(),
+      Reason :: closed | timeout | error_alert().
 
 handshake(ListenSocket) ->
     handshake(ListenSocket, infinity).
 
--spec handshake(#sslsocket{} | port(), timeout()| [tls_server_option()]) ->
-                       {ok, #sslsocket{}} | {error, timeout | closed | {options, any()} | error_alert()}.
+-spec handshake(HsSocket, Timeout) -> {ok, SslSocket} | {ok, SslSocket, Ext} | {error, Reason} when
+      HsSocket :: sslsocket(),
+      Timeout :: timeout(),
+      SslSocket :: sslsocket(),
+      Ext :: protocol_extensions(),
+      Reason :: closed | timeout | error_alert();
+               (Socket, Options) -> {ok, SslSocket} | {ok, SslSocket, Ext} | {error, Reason} when
+      Socket :: socket() | sslsocket(),
+      SslSocket :: sslsocket(),
+      Options :: [server_option()],
+      Ext :: protocol_extensions(),
+      Reason :: closed | timeout | error_alert().
+
 handshake(#sslsocket{} = Socket, Timeout) when  (is_integer(Timeout) andalso Timeout >= 0) or 
                                                 (Timeout == infinity) ->
     ssl_connection:handshake(Socket, Timeout);
@@ -553,8 +695,17 @@ handshake(#sslsocket{} = Socket, Timeout) when  (is_integer(Timeout) andalso Tim
 handshake(ListenSocket, SslOptions)  when is_port(ListenSocket) ->
     handshake(ListenSocket, SslOptions, infinity).
 
--spec handshake(#sslsocket{} | port(), [tls_server_option()], timeout()) ->
-			{ok, #sslsocket{}} | {error, timeout | closed | {options, any()} | error_alert()}.
+-spec handshake(Socket, Options, Timeout) ->
+                       {ok, SslSocket} |
+                       {ok, SslSocket, Ext} |
+                       {error, Reason} when
+      Socket :: socket() | sslsocket(),
+      SslSocket :: sslsocket(),
+      Options :: [server_option()],
+      Timeout :: timeout(),
+      Ext :: protocol_extensions(),
+      Reason :: closed | timeout | {options, any()} | error_alert().
+
 handshake(#sslsocket{} = Socket, [], Timeout) when (is_integer(Timeout) andalso Timeout >= 0) or 
                                                     (Timeout == infinity)->
     handshake(Socket, Timeout);
@@ -597,8 +748,12 @@ handshake(Socket, SslOptions, Timeout) when is_port(Socket),
 
 
 %%--------------------------------------------------------------------
--spec handshake_continue(#sslsocket{}, [tls_client_option() | tls_server_option()]) -> 
-                                {ok, #sslsocket{}} | {error, reason()}.
+-spec handshake_continue(HsSocket, Options) ->
+                                {ok, SslSocket} | {error, Reason} when
+      HsSocket :: sslsocket(),
+      Options :: [tls_client_option() | tls_server_option()],
+      SslSocket :: sslsocket(),
+      Reason :: closed | timeout | error_alert().
 %%
 %%
 %% Description: Continues the handshke possible with newly supplied options.
@@ -606,8 +761,13 @@ handshake(Socket, SslOptions, Timeout) when is_port(Socket),
 handshake_continue(Socket, SSLOptions) ->
     handshake_continue(Socket, SSLOptions, infinity).
 %%--------------------------------------------------------------------
--spec handshake_continue(#sslsocket{}, [tls_client_option() | tls_server_option()], timeout()) -> 
-                                {ok, #sslsocket{}} | {error, reason()}.
+-spec handshake_continue(HsSocket, Options, Timeout) ->
+                                {ok, SslSocket} | {error, Reason} when
+      HsSocket :: sslsocket(),
+      Options :: [tls_client_option() | tls_server_option()],
+      Timeout :: timeout(),
+      SslSocket :: sslsocket(),
+      Reason :: closed | timeout | error_alert().
 %%
 %%
 %% Description: Continues the handshke possible with newly supplied options.
@@ -615,7 +775,7 @@ handshake_continue(Socket, SSLOptions) ->
 handshake_continue(Socket, SSLOptions, Timeout) ->
     ssl_connection:handshake_continue(Socket, SSLOptions, Timeout).
 %%--------------------------------------------------------------------
--spec  handshake_cancel(#sslsocket{}) -> term().
+-spec  handshake_cancel(#sslsocket{}) -> any().
 %%
 %% Description: Cancels the handshakes sending a close alert.
 %%--------------------------------------------------------------------
@@ -623,7 +783,9 @@ handshake_cancel(Socket) ->
     ssl_connection:handshake_cancel(Socket).
 
 %%--------------------------------------------------------------------
--spec  close(#sslsocket{}) -> term().
+-spec  close(SslSocket) -> ok | {error, Reason} when
+      SslSocket :: sslsocket(),
+      Reason :: any().
 %%
 %% Description: Close an ssl connection
 %%--------------------------------------------------------------------
@@ -635,7 +797,10 @@ close(#sslsocket{pid = {ListenSocket, #config{transport_info={Transport,_,_,_,_}
     Transport:close(ListenSocket).
 
 %%--------------------------------------------------------------------
--spec  close(#sslsocket{}, timeout() | {pid(), integer()}) -> term().
+-spec  close(SslSocket, How) -> ok | {ok, port()} | {error,Reason} when
+      SslSocket :: sslsocket(),
+      How :: timeout() | {NewController::pid(), timeout()},
+      Reason :: any().
 %%
 %% Description: Close an ssl connection
 %%--------------------------------------------------------------------
@@ -651,7 +816,9 @@ close(#sslsocket{pid = {ListenSocket, #config{transport_info={Transport,_,_,_,_}
     Transport:close(ListenSocket).
 
 %%--------------------------------------------------------------------
--spec send(#sslsocket{}, iodata()) -> ok | {error, reason()}.
+-spec send(SslSocket, Data) -> ok | {error, reason()} when
+      SslSocket :: sslsocket(),
+      Data :: iodata().
 %%
 %% Description: Sends data over the ssl connection
 %%--------------------------------------------------------------------
@@ -671,11 +838,20 @@ send(#sslsocket{pid = {ListenSocket, #config{transport_info = Info}}}, Data) ->
 %%
 %% Description: Receives data when active = false
 %%--------------------------------------------------------------------
--spec recv(#sslsocket{}, integer()) -> {ok, binary()| list()} | {error, reason()}.
+-spec recv(SslSocket, Length) -> {ok, Data} | {error, reason()} when
+      SslSocket :: sslsocket(),
+      Length :: integer(),
+      Data :: binary() | list() | http_packet().
+
 recv(Socket, Length) ->
     recv(Socket, Length, infinity).
 
--spec recv(#sslsocket{}, integer(), timeout()) -> {ok, binary()| list()} | {error, reason()}.
+-spec recv(SslSocket, Length, Timeout) -> {ok, Data} | {error, reason()} when
+      SslSocket :: sslsocket(),
+      Length :: integer(),
+      Data :: binary() | list() | http_packet(),
+      Timeout :: timeout().
+
 recv(#sslsocket{pid = [Pid|_]}, Length, Timeout) when is_pid(Pid),
 						  (is_integer(Timeout) andalso Timeout >= 0) or (Timeout == infinity)->
     ssl_connection:recv(Pid, Length, Timeout);
@@ -687,7 +863,10 @@ recv(#sslsocket{pid = {Listen,
     Transport:recv(Listen, 0). %% {error,enotconn}
 
 %%--------------------------------------------------------------------
--spec controlling_process(#sslsocket{}, pid()) -> ok | {error, reason()}.
+-spec controlling_process(SslSocket, NewOwner) -> ok | {error, Reason} when
+      SslSocket :: sslsocket(),
+      NewOwner :: pid(),
+      Reason :: any().
 %%
 %% Description: Changes process that receives the messages when active = true
 %% or once.
@@ -706,7 +885,11 @@ controlling_process(#sslsocket{pid = {Listen,
 
 
 %%--------------------------------------------------------------------
--spec connection_information(#sslsocket{}) -> {ok, list()} | {error, reason()}.
+-spec connection_information(SslSocket) -> {ok, Result} | {error, reason()} when
+      SslSocket :: sslsocket(),
+      Result :: [{OptionName, OptionValue}],
+      OptionName :: atom(),
+      OptionValue :: any().
 %%
 %% Description: Return SSL information for the connection
 %%--------------------------------------------------------------------
@@ -723,7 +906,12 @@ connection_information(#sslsocket{pid = {dtls,_}}) ->
     {error,enotconn}. 
 
 %%--------------------------------------------------------------------
--spec connection_information(#sslsocket{}, [atom()]) -> {ok, list()} | {error, reason()}.
+-spec connection_information(SslSocket, Items) -> {ok, Result} | {error, reason()} when
+      SslSocket :: sslsocket(),
+      Items :: [OptionName],
+      Result :: [{OptionName, OptionValue}],
+      OptionName :: atom(),
+      OptionValue :: any().
 %%
 %% Description: Return SSL information for the connection
 %%--------------------------------------------------------------------
@@ -737,7 +925,11 @@ connection_information(#sslsocket{pid = [Pid|_]}, Items) when is_pid(Pid) ->
     end.
 
 %%--------------------------------------------------------------------
--spec peername(#sslsocket{}) -> {ok, {inet:ip_address(), inet:port_number()}} | {error, reason()}.
+-spec peername(SslSocket) -> {ok, {Address, Port}} |
+                             {error, reason()} when
+      SslSocket :: sslsocket(),
+      Address :: inet:ip_address(),
+      Port :: inet:port_number().
 %%
 %% Description: same as inet:peername/1.
 %%--------------------------------------------------------------------
@@ -753,7 +945,9 @@ peername(#sslsocket{pid = {dtls,_}}) ->
     {error,enotconn}.
 
 %%--------------------------------------------------------------------
--spec peercert(#sslsocket{}) ->{ok, DerCert::binary()} | {error, reason()}.
+-spec peercert(SslSocket) -> {ok, Cert} | {error, reason()} when
+      SslSocket :: sslsocket(),
+      Cert :: binary().
 %%
 %% Description: Returns the peercert.
 %%--------------------------------------------------------------------
@@ -770,7 +964,10 @@ peercert(#sslsocket{pid = {Listen, _}}) when is_port(Listen) ->
     {error, enotconn}.
 
 %%--------------------------------------------------------------------
--spec negotiated_protocol(#sslsocket{}) -> {ok, binary()} | {error, reason()}.
+-spec negotiated_protocol(SslSocket) -> {ok, Protocol} | {error, Reason} when
+      SslSocket :: sslsocket(),
+      Protocol :: binary(),
+      Reason :: protocol_not_negotiated.
 %%
 %% Description: Returns the protocol that has been negotiated. If no
 %% protocol has been negotiated will return {error, protocol_not_negotiated}
@@ -784,8 +981,9 @@ negotiated_protocol(#sslsocket{pid = [Pid|_]}) when is_pid(Pid) ->
 cipher_suites() ->
     cipher_suites(erlang).
 %%--------------------------------------------------------------------
--spec cipher_suites(erlang | openssl | all) -> 
-                           [old_cipher_suite() | string()].
+-spec cipher_suites(Type) -> [old_cipher_suite() | string()] when
+      Type :: erlang | openssl | all.
+
 %% Description: Returns all supported cipher suites.
 %%--------------------------------------------------------------------
 cipher_suites(erlang) ->
@@ -799,9 +997,10 @@ cipher_suites(all) ->
     [ssl_cipher_format:suite_legacy(Suite) || Suite <- available_suites(all)].
 
 %%--------------------------------------------------------------------
--spec cipher_suites(default | all | anonymous, ssl_record:ssl_version() |
-                    tls_record:tls_atom_version() |  dtls_record:dtls_atom_version()) -> 
-                           [erl_cipher_suite()].
+-spec cipher_suites(Supported, Version) -> ciphers() when
+      Supported :: default | all | anonymous,
+      Version :: protocol_version().
+
 %% Description: Returns all default and all supported cipher suites for a
 %% TLS/DTLS version
 %%--------------------------------------------------------------------
@@ -817,9 +1016,10 @@ cipher_suites(Base, Version) ->
     [ssl_cipher_format:suite_bin_to_map(Suite) || Suite <- supported_suites(Base, Version)].
 
 %%--------------------------------------------------------------------
--spec filter_cipher_suites([erl_cipher_suite()] | [ssl_cipher_format:cipher_suite()] , 
-                           [{key_exchange | cipher | mac | prf, fun()}] | []) -> 
-                                  [erl_cipher_suite()] | [ssl_cipher_format:cipher_suite()].
+-spec filter_cipher_suites(Suites, Filters) -> Ciphers when
+      Suites :: ciphers(),
+      Filters :: cipher_filters(),
+      Ciphers :: ciphers().
 
 %% Description: Removes cipher suites if any of the filter functions returns false
 %% for any part of the cipher suite. This function also calls default filter functions
@@ -837,10 +1037,10 @@ filter_cipher_suites(Suites, Filters0) ->
                 prf_filters => add_filter(proplists:get_value(prf, Filters0), PrfF)},
     ssl_cipher:filter_suites(Suites, Filters).
 %%--------------------------------------------------------------------
--spec prepend_cipher_suites([erl_cipher_suite()] | 
-                            [{key_exchange | cipher | mac | prf, fun()}],
-                            [erl_cipher_suite()]) -> 
-                                   [erl_cipher_suite()].
+-spec prepend_cipher_suites(Preferred, Suites) -> ciphers() when
+      Preferred :: ciphers() | cipher_filters(),
+      Suites :: ciphers().
+
 %% Description: Make <Preferred> suites become the most prefered
 %%      suites that is put them at the head of the cipher suite list
 %%      and remove them from <Suites> if present. <Preferred> may be a
@@ -855,10 +1055,10 @@ prepend_cipher_suites(Filters, Suites) ->
     Preferred = filter_cipher_suites(Suites, Filters), 
     Preferred ++ (Suites -- Preferred).
 %%--------------------------------------------------------------------
--spec append_cipher_suites(Deferred :: [erl_cipher_suite()] | 
-                                       [{key_exchange | cipher | mac | prf, fun()}],
-                           [erl_cipher_suite()]) -> 
-                                  [erl_cipher_suite()].
+-spec append_cipher_suites(Deferred, Suites) -> ciphers() when
+      Deferred :: ciphers() | cipher_filters(),
+      Suites :: ciphers().
+
 %% Description: Make <Deferred> suites suites become the 
 %% least prefered suites that is put them at the end of the cipher suite list
 %% and removed them from <Suites> if present.
@@ -872,7 +1072,9 @@ append_cipher_suites(Filters, Suites) ->
     (Suites -- Deferred) ++  Deferred.
 
 %%--------------------------------------------------------------------
--spec eccs() -> tls_v1:curves().
+-spec eccs() -> NamedCurves when
+      NamedCurves :: [named_curve()].
+
 %% Description: returns all supported curves across all versions
 %%--------------------------------------------------------------------
 eccs() ->
@@ -880,9 +1082,10 @@ eccs() ->
     eccs_filter_supported(Curves).
 
 %%--------------------------------------------------------------------
--spec eccs(tls_record:tls_atom_version() |
-           ssl_record:ssl_version() | dtls_record:dtls_atom_version()) ->
-                  tls_v1:curves().
+-spec eccs(Version) -> NamedCurves when
+      Version :: protocol_version() | protocol_version_tuple(),
+      NamedCurves :: [named_curve()].
+
 %% Description: returns the curves supported for a given version of
 %% ssl/tls.
 %%--------------------------------------------------------------------
@@ -908,22 +1111,24 @@ eccs_filter_supported(Curves) ->
                  Curves).
 
 %%--------------------------------------------------------------------
--spec groups() -> tls_v1:supported_groups().
+-spec groups() -> [group()].
 %% Description: returns all supported groups (TLS 1.3 and later)
 %%--------------------------------------------------------------------
 groups() ->
     tls_v1:groups(4).
 
 %%--------------------------------------------------------------------
--spec groups(default) -> tls_v1:supported_groups().
+-spec groups(default) -> [group()].
 %% Description: returns the default groups (TLS 1.3 and later)
 %%--------------------------------------------------------------------
 groups(default) ->
     tls_v1:default_groups(4).
 
 %%--------------------------------------------------------------------
--spec getopts(#sslsocket{}, [gen_tcp:option_name()]) ->
-		     {ok, [gen_tcp:option()]} | {error, reason()}.
+-spec getopts(SslSocket, OptionNames) ->
+		     {ok, [gen_tcp:option()]} | {error, reason()} when
+      SslSocket :: sslsocket(),
+      OptionNames :: [gen_tcp:option_name()].
 %%
 %% Description: Gets options
 %%--------------------------------------------------------------------
@@ -954,7 +1159,9 @@ getopts(#sslsocket{}, OptionTags) ->
     {error, {options, {socket_options, OptionTags}}}.
 
 %%--------------------------------------------------------------------
--spec setopts(#sslsocket{},  [gen_tcp:option()]) -> ok | {error, reason()}.
+-spec setopts(SslSocket, Options) -> ok | {error, reason()} when
+      SslSocket :: sslsocket(),
+      Options :: [gen_tcp:option()].
 %%
 %% Description: Sets options
 %%--------------------------------------------------------------------
@@ -1010,9 +1217,9 @@ setopts(#sslsocket{}, Options) ->
     {error, {options,{not_a_proplist, Options}}}.
 
 %%---------------------------------------------------------------
--spec getstat(Socket) ->
-	{ok, OptionValues} | {error, inet:posix()} when
-      Socket :: #sslsocket{},
+-spec getstat(SslSocket) ->
+                     {ok, OptionValues} | {error, inet:posix()} when
+      SslSocket :: sslsocket(),
       OptionValues :: [{inet:stat_option(), integer()}].
 %%
 %% Description: Get all statistic options for a socket.
@@ -1021,9 +1228,9 @@ getstat(Socket) ->
 	getstat(Socket, inet:stats()).
 
 %%---------------------------------------------------------------
--spec getstat(Socket, Options) ->
-	{ok, OptionValues} | {error, inet:posix()} when
-      Socket :: #sslsocket{},
+-spec getstat(SslSocket, Options) ->
+                     {ok, OptionValues} | {error, inet:posix()} when
+      SslSocket :: sslsocket(),
       Options :: [inet:stat_option()],
       OptionValues :: [{inet:stat_option(), integer()}].
 %%
@@ -1036,7 +1243,9 @@ getstat(#sslsocket{pid = [Pid|_], fd = {Transport, Socket, _, _}}, Options) when
     tls_socket:getstat(Transport, Socket, Options).
 
 %%---------------------------------------------------------------
--spec shutdown(#sslsocket{}, read | write | read_write) ->  ok | {error, reason()}.
+-spec shutdown(SslSocket, How) ->  ok | {error, reason()} when
+      SslSocket :: sslsocket(),
+      How :: read | write | read_write.
 %%
 %% Description: Same as gen_tcp:shutdown/2
 %%--------------------------------------------------------------------
@@ -1050,7 +1259,11 @@ shutdown(#sslsocket{pid = [Pid|_]}, How) when is_pid(Pid) ->
     ssl_connection:shutdown(Pid, How).
 
 %%--------------------------------------------------------------------
--spec sockname(#sslsocket{}) -> {ok, {inet:ip_address(), inet:port_number()}} | {error, reason()}.
+-spec sockname(SslSocket) ->
+                      {ok, {Address, Port}} | {error, reason()} when
+      SslSocket :: sslsocket(),
+      Address :: inet:ip_address(),
+      Port :: inet:port_number().
 %%
 %% Description: Same as inet:sockname/1
 %%--------------------------------------------------------------------
@@ -1064,10 +1277,10 @@ sockname(#sslsocket{pid = [Pid| _], fd = {Transport, Socket,_,_}}) when is_pid(P
     tls_socket:sockname(Transport, Socket).
 
 %%---------------------------------------------------------------
--spec versions() -> [{ssl_app, string()} | {supported, [tls_record:tls_atom_version()]} |
-                     {supported_dtls, [dtls_record:dtls_atom_version()]} |
-		     {available, [tls_record:tls_atom_version()]} |
-                     {available_dtls, [dtls_record:dtls_atom_version()]}].
+-spec versions() -> [VersionInfo] when
+      VersionInfo :: {ssl_app, string()} |
+                     {supported | available, [tls_version()]} |
+                     {supported_dtls | available_dtls, [dtls_version()]}.
 %%
 %% Description: Returns a list of relevant versions.
 %%--------------------------------------------------------------------
@@ -1085,7 +1298,8 @@ versions() ->
 
 
 %%---------------------------------------------------------------
--spec renegotiate(#sslsocket{}) -> ok | {error, reason()}.
+-spec renegotiate(SslSocket) -> ok | {error, reason()} when
+      SslSocket :: sslsocket().
 %%
 %% Description: Initiates a renegotiation.
 %%--------------------------------------------------------------------
@@ -1105,9 +1319,13 @@ renegotiate(#sslsocket{pid = {Listen,_}}) when is_port(Listen) ->
     {error, enotconn}.
 
 %%--------------------------------------------------------------------
--spec prf(#sslsocket{}, binary() | 'master_secret', binary(),
-	  [binary() | prf_random()], non_neg_integer()) ->
-		 {ok, binary()} | {error, reason()}.
+-spec prf(SslSocket, Secret, Label, Seed, WantedLength) ->
+                 {ok, binary()} | {error, reason()} when
+      SslSocket :: sslsocket(),
+      Secret :: binary() | 'master_secret',
+      Label::binary(),
+      Seed :: [binary() | prf_random()],
+      WantedLength :: non_neg_integer().
 %%
 %% Description: use a ssl sessions TLS PRF to generate key material
 %%--------------------------------------------------------------------
@@ -1128,7 +1346,8 @@ clear_pem_cache() ->
     ssl_pem_cache:clear().
 
 %%---------------------------------------------------------------
--spec format_error({error, term()}) -> list().
+-spec format_error({error, Reason}) -> string() when
+      Reason :: any().
 %%
 %% Description: Creates error string.
 %%--------------------------------------------------------------------
@@ -1167,7 +1386,8 @@ tls_version({254, _} = Version) ->
     dtls_v1:corresponding_tls_version(Version).
 
 %%--------------------------------------------------------------------
--spec suite_to_str(erl_cipher_suite()) -> string().
+-spec suite_to_str(CipherSuite) -> string() when
+      CipherSuite :: erl_cipher_suite().
 %%
 %% Description: Return the string representation of a cipher suite.
 %%--------------------------------------------------------------------
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index 6e325b504c..a5f754d2e3 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -115,7 +115,7 @@ handshake(Connection, Port, Socket, Opts, User, CbInfo, Timeout) ->
 
 %%--------------------------------------------------------------------
 -spec handshake(#sslsocket{}, timeout()) ->  {ok, #sslsocket{}} |
-                                                 {ok,  #sslsocket{}, map()}| {error, reason()}.
+                                             {ok,  #sslsocket{}, map()}| {error, reason()}.
 %%
 %% Description: Starts ssl handshake. 
 %%--------------------------------------------------------------------
@@ -130,8 +130,8 @@ handshake(#sslsocket{pid = [Pid|_]} = Socket, Timeout) ->
     end.
 
 %%--------------------------------------------------------------------
--spec handshake(#sslsocket{}, {#ssl_options{},#socket_options{}},
-		timeout()) ->   {ok, #sslsocket{}} | {error, reason()}.
+-spec handshake(#sslsocket{}, {#ssl_options{},#socket_options{}}, timeout()) ->
+                       {ok, #sslsocket{}} | {ok, #sslsocket{}, map()} | {error, reason()}.
 %%
 %% Description: Starts ssl handshake with some new options 
 %%--------------------------------------------------------------------
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index dc037bb1ea..7b34991f4f 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -98,7 +98,7 @@ hello_request() ->
     #hello_request{}.
 
 %%--------------------------------------------------------------------
--spec server_hello(#session{}, ssl_record:ssl_version(), ssl_record:connection_states(),
+-spec server_hello(binary(), ssl_record:ssl_version(), ssl_record:connection_states(),
 		   Extension::map()) -> #server_hello{}.
 %%
 %% Description: Creates a server hello message.
diff --git a/lib/ssl/src/ssl_internal.hrl b/lib/ssl/src/ssl_internal.hrl
index 4ee0230d88..06c3ccae45 100644
--- a/lib/ssl/src/ssl_internal.hrl
+++ b/lib/ssl/src/ssl_internal.hrl
@@ -28,12 +28,12 @@
 -define(VSN, "8.2.6").
 -define(SECRET_PRINTOUT, "***").
 
--type reason()            :: term().
--type reply()             :: term().
--type msg()               :: term().
--type from()              :: term().
+-type reason()            :: any().
+-type reply()             :: any().
+-type msg()               :: any().
+-type from()              :: any().
 -type certdb_ref()        :: reference().
--type db_handle()         :: term().
+-type db_handle()         :: any().
 -type der_cert()          :: binary().
 -type issuer()            :: tuple().
 -type serialnumber()      :: integer().
@@ -109,26 +109,26 @@
 -define('24H_in_sec', 86400).
 
 -record(ssl_options, {
-	  protocol    :: tls | dtls,
-	  versions    :: [ssl_record:ssl_version()], %% ssl_record:atom_version() in API
-	  verify      :: verify_none | verify_peer,
+	  protocol    :: tls | dtls | 'undefined',
+	  versions    :: [ssl_record:ssl_version()] | 'undefined', %% ssl_record:atom_version() in API
+	  verify      :: verify_none | verify_peer | 'undefined',
 	  verify_fun,  %%:: fun(CertVerifyErrors::term()) -> boolean(),
-	  partial_chain       :: fun(),
-	  fail_if_no_peer_cert ::  boolean(),
-	  verify_client_once   ::  boolean(),
+	  partial_chain       :: fun() | 'undefined',
+	  fail_if_no_peer_cert ::  boolean() | 'undefined',
+	  verify_client_once   ::  boolean() | 'undefined',
 	  %% fun(Extensions, State, Verify, AccError) ->  {Extensions, State, AccError}
 	  validate_extensions_fun, 
-	  depth                :: integer(),
-	  certfile             :: binary(),
+	  depth                :: integer() | 'undefined',
+	  certfile             :: binary() | 'undefined',
 	  cert                 :: public_key:der_encoded() | secret_printout() | 'undefined',
-	  keyfile              :: binary(),
-	  key	               :: {'RSAPrivateKey' | 'DSAPrivateKey' | 'ECPrivateKey' | 'PrivateKeyInfo', 
+	  keyfile              :: binary() | 'undefined',
+	  key	               :: {'RSAPrivateKey' | 'DSAPrivateKey' | 'ECPrivateKey' | 'PrivateKeyInfo' | 'undefined',
                                    public_key:der_encoded()} | map()  %%map() -> ssl:key() how to handle dialyzer?
                                 | secret_printout() | 'undefined',
 	  password	       :: string() | secret_printout() | 'undefined',
 	  cacerts              :: [public_key:der_encoded()] | secret_printout() | 'undefined',
-	  cacertfile           :: binary(),
-	  dh                   :: public_key:der_encoded() | secret_printout(),
+	  cacertfile           :: binary() | 'undefined',
+	  dh                   :: public_key:der_encoded() | secret_printout() | 'undefined',
 	  dhfile               :: binary() | secret_printout() | 'undefined',
 	  user_lookup_fun,  % server option, fun to lookup the user
 	  psk_identity         :: binary() | secret_printout() | 'undefined',
@@ -140,23 +140,23 @@
 	  reuse_session        :: fun() | binary() | undefined, %% Server side is a fun()
 	  %% If false sessions will never be reused, if true they
 	  %% will be reused if possible.
-	  reuse_sessions       :: boolean() | save,  %% Only client side can use value save
+	  reuse_sessions       :: boolean() | save | 'undefined',  %% Only client side can use value save
 	  renegotiate_at,
 	  secure_renegotiate,
 	  client_renegotiation,
 	  %% undefined if not hibernating, or number of ms of
 	  %% inactivity after which ssl_connection will go into
 	  %% hibernation
-	  hibernate_after      :: timeout(),          
+	  hibernate_after      :: timeout() | 'undefined',
 	  %% This option should only be set to true by inet_tls_dist
 	  erl_dist = false     :: boolean(),
-          alpn_advertised_protocols = undefined :: [binary()] | undefined ,
+          alpn_advertised_protocols = undefined :: [binary()] | undefined,
           alpn_preferred_protocols = undefined  :: [binary()] | undefined,
 	  next_protocols_advertised = undefined :: [binary()] | undefined,
 	  next_protocol_selector = undefined,  %% fun([binary()]) -> binary())
 	  log_level = notice :: atom(),
 	  server_name_indication = undefined,
-	  sni_hosts  :: [{inet:hostname(), [tuple()]}],
+	  sni_hosts  :: [{inet:hostname(), [tuple()]}] | 'undefined',
 	  sni_fun :: function() | undefined,
 	  %% Should the server prefer its own cipher order over the one provided by
 	  %% the client?
@@ -166,14 +166,14 @@
 	  %%mitigation entirely?
 	  beast_mitigation = one_n_minus_one :: one_n_minus_one | zero_n | disabled,
 	  fallback = false           :: boolean(),
-	  crl_check                  :: boolean() | peer | best_effort, 
+	  crl_check                  :: boolean() | peer | best_effort | 'undefined',
 	  crl_cache,
 	  signature_algs,
 	  signature_algs_cert,
 	  eccs,
 	  supported_groups,  %% RFC 8422, RFC 8446
-	  honor_ecc_order            :: boolean(),
-          max_handshake_size         :: integer(),
+	  honor_ecc_order            :: boolean() | 'undefined',
+          max_handshake_size         :: integer() | 'undefined',
           handshake,
           customize_hostname_check
     %%                 ,
@@ -199,9 +199,9 @@
 		}).
 
 -type state_name()           :: hello | abbreviated | certify | cipher | connection.
--type gen_fsm_state_return() :: {next_state, state_name(), term()} |
-				{next_state, state_name(), term(), timeout()} |
-				{stop, term(), term()}.
+-type gen_fsm_state_return() :: {next_state, state_name(), any()} |
+				{next_state, state_name(), any(), timeout()} |
+				{stop, any(), any()}.
 -type ssl_options()          :: #ssl_options{}.
 
 -endif. % -ifdef(ssl_internal).
diff --git a/lib/ssl/src/tls_handshake.erl b/lib/ssl/src/tls_handshake.erl
index 74ab0d5923..2480e05097 100644
--- a/lib/ssl/src/tls_handshake.erl
+++ b/lib/ssl/src/tls_handshake.erl
@@ -251,7 +251,7 @@ encode_handshake(Package, Version) ->
 %%--------------------------------------------------------------------
 -spec get_tls_handshake(tls_record:tls_version(), binary(), binary() | iolist(), 
                         #ssl_options{}) ->
-     {[tls_handshake()], binary()}.
+     {[{tls_handshake(), binary()}], binary()}.
 %%
 %% Description: Given buffered and new data from ssl_record, collects
 %% and returns it as a list of handshake messages, also returns leftover
diff --git a/lib/ssl/test/ssl_ECC_SUITE.erl b/lib/ssl/test/ssl_ECC_SUITE.erl
index ca8d0ec70c..c64358960c 100644
--- a/lib/ssl/test/ssl_ECC_SUITE.erl
+++ b/lib/ssl/test/ssl_ECC_SUITE.erl
@@ -212,7 +212,7 @@ client_ecdsa_server_ecdsa_with_raw_key(Config)  when is_list(Config) ->
 
 ecc_default_order(Config) ->
     Default = ssl_test_lib:default_cert_chain_conf(),
-    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(0))),
+    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(1))),
     {COpts0, SOpts0} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
                                                          {client_chain, Default}],
                                                         ecdhe_ecdsa, ecdhe_ecdsa,
@@ -227,7 +227,7 @@ ecc_default_order(Config) ->
 
 ecc_default_order_custom_curves(Config) ->
     Default = ssl_test_lib:default_cert_chain_conf(),
-    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(0))),
+    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(1))),
     {COpts0, SOpts0} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
                                                          {client_chain, Default}],
                                                         ecdhe_ecdsa, ecdhe_ecdsa,
@@ -242,7 +242,7 @@ ecc_default_order_custom_curves(Config) ->
 
 ecc_client_order(Config) ->
     Default = ssl_test_lib:default_cert_chain_conf(),
-    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(0))),
+    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(1))),
     {COpts0, SOpts0} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
                                                          {client_chain, Default}],
                                                         ecdhe_ecdsa, ecdhe_ecdsa,
@@ -257,7 +257,7 @@ ecc_client_order(Config) ->
 
 ecc_client_order_custom_curves(Config) ->
     Default = ssl_test_lib:default_cert_chain_conf(),
-    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(0))),
+    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(1))),
     {COpts0, SOpts0} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default},
                                                         {client_chain, Default}],
                                                         ecdhe_ecdsa, ecdhe_ecdsa,
@@ -282,7 +282,7 @@ ecc_unknown_curve(Config) ->
 
 client_ecdh_rsa_server_ecdhe_ecdsa_server_custom(Config) ->
     Default = ssl_test_lib:default_cert_chain_conf(),
-    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(0))),
+    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(1))),
     {COpts0, SOpts0} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default},
                                                        {client_chain, Default}], 
                                                         ecdh_rsa, ecdhe_ecdsa, Config),
@@ -296,7 +296,7 @@ client_ecdh_rsa_server_ecdhe_ecdsa_server_custom(Config) ->
 
 client_ecdh_rsa_server_ecdhe_rsa_server_custom(Config) ->
     Default = ssl_test_lib:default_cert_chain_conf(),
-    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(0))),
+    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(1))),
     {COpts0, SOpts0} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
                                                          {client_chain, Default}],
                                                         ecdh_rsa, ecdhe_rsa, Config),
@@ -311,7 +311,7 @@ client_ecdh_rsa_server_ecdhe_rsa_server_custom(Config) ->
 
 client_ecdhe_rsa_server_ecdhe_ecdsa_server_custom(Config) ->
     Default = ssl_test_lib:default_cert_chain_conf(),
-    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(0))),
+    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(1))),
     {COpts0, SOpts0} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
                                                          {client_chain, Default}],
                                                         ecdhe_rsa, ecdhe_ecdsa, Config),
@@ -325,7 +325,7 @@ client_ecdhe_rsa_server_ecdhe_ecdsa_server_custom(Config) ->
 
 client_ecdhe_rsa_server_ecdhe_rsa_server_custom(Config) ->
     Default = ssl_test_lib:default_cert_chain_conf(),
-    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(0))),
+    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(1))),
     {COpts0, SOpts0} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
                                                          {client_chain, Default}], 
                                                         ecdhe_rsa, ecdhe_rsa, Config),
@@ -339,7 +339,7 @@ client_ecdhe_rsa_server_ecdhe_rsa_server_custom(Config) ->
      end.
 client_ecdhe_rsa_server_ecdh_rsa_server_custom(Config) ->
     Default = ssl_test_lib:default_cert_chain_conf(),
-    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(0))),
+    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(1))),
     Ext = x509_test:extensions([{key_usage, [keyEncipherment]}]),
     {COpts0, SOpts0} = ssl_test_lib:make_ec_cert_chains([{server_chain, [[], [], [{extensions, Ext}]]},
                                                          {client_chain, Default}], 
@@ -357,7 +357,7 @@ client_ecdhe_rsa_server_ecdh_rsa_server_custom(Config) ->
 
 client_ecdhe_ecdsa_server_ecdhe_ecdsa_server_custom(Config) ->
     Default = ssl_test_lib:default_cert_chain_conf(),
-    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(0))),
+    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(1))),
     {COpts0, SOpts0} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
                                                        {client_chain, Default}], 
                                                         ecdhe_ecdsa, ecdhe_ecdsa, Config),
@@ -371,7 +371,7 @@ client_ecdhe_ecdsa_server_ecdhe_ecdsa_server_custom(Config) ->
 
 client_ecdhe_ecdsa_server_ecdhe_rsa_server_custom(Config) ->
     Default = ssl_test_lib:default_cert_chain_conf(),
-    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(0))),
+    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(1))),
     {COpts0, SOpts0} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
                                                          {client_chain, Default}],
                                                         ecdhe_ecdsa, ecdhe_rsa, Config),
@@ -385,7 +385,7 @@ client_ecdhe_ecdsa_server_ecdhe_rsa_server_custom(Config) ->
 
 client_ecdhe_ecdsa_server_ecdhe_ecdsa_client_custom(Config) ->
     Default = ssl_test_lib:default_cert_chain_conf(),
-    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(0))),
+    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(1))),
     {COpts0, SOpts0} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
                                                        {client_chain, Default}],
                                                         ecdhe_ecdsa, ecdhe_ecdsa, Config),
@@ -399,7 +399,7 @@ client_ecdhe_ecdsa_server_ecdhe_ecdsa_client_custom(Config) ->
 
 client_ecdhe_rsa_server_ecdhe_ecdsa_client_custom(Config) ->
     Default = ssl_test_lib:default_cert_chain_conf(),
-    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(0))),
+    DefaultCurve = pubkey_cert_records:namedCurves(hd(tls_v1:ecc_curves(1))),
     {COpts0, SOpts0} = ssl_test_lib:make_ec_cert_chains([{server_chain, Default}, 
                                                          {client_chain, Default}],
                                                          ecdhe_rsa, ecdhe_ecdsa, Config),
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index 7b98209b31..56e6117cc4 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -549,11 +549,10 @@ alerts(Config) when is_list(Config) ->
     Alerts = [?ALERT_REC(?WARNING, ?CLOSE_NOTIFY) | 
 	      [?ALERT_REC(?FATAL, Desc) || Desc <- Descriptions]],
     lists:foreach(fun(Alert) ->
-			case ssl_alert:alert_txt(Alert) of
-			    Txt when is_list(Txt) ->
-				ok;
-			    Other ->
-				ct:fail({unexpected, Other})
+                          try ssl_alert:alert_txt(Alert)
+                          catch
+			    C:E:T ->
+                                  ct:fail({unexpected, {C, E, T}})
 			end 
 		  end, Alerts).
 %%--------------------------------------------------------------------
@@ -3655,7 +3654,7 @@ listen_socket(Config) ->
     {error, enotconn} = ssl:peername(ListenSocket),
     {error, enotconn} = ssl:peercert(ListenSocket),
     {error, enotconn} = ssl:renegotiate(ListenSocket),
-    {error, enotconn} = ssl:prf(ListenSocket, 'master_secret', <<"Label">>, client_random, 256),
+    {error, enotconn} = ssl:prf(ListenSocket, 'master_secret', <<"Label">>, [client_random], 256),
     {error, enotconn} = ssl:shutdown(ListenSocket, read_write),
 
     ok = ssl:close(ListenSocket).
diff --git a/lib/ssl/test/ssl_certificate_verify_SUITE.erl b/lib/ssl/test/ssl_certificate_verify_SUITE.erl
index 4f340af4f5..55dee9a48f 100644
--- a/lib/ssl/test/ssl_certificate_verify_SUITE.erl
+++ b/lib/ssl/test/ssl_certificate_verify_SUITE.erl
@@ -448,7 +448,7 @@ server_require_peer_cert_partial_chain_fun_fail(Config) when is_list(Config) ->
     [{_,_,_}, {_, IntermidiateCA, _} | _] = public_key:pem_decode(ServerCAs),
 
     PartialChain =  fun(_CertChain) ->
-                            ture = false %% crash on purpose
+                            true = false %% crash on purpose
 		    end,
 
     Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index 798bdf0416..65b8998cc3 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -1873,6 +1873,14 @@ check_sane_openssl_version(Version) ->
 	    case {Version, os:cmd("openssl version")} of
                 {'sslv3', "OpenSSL 1.0.2" ++ _} ->
                     false;
+                {'dtlsv1', "OpenSSL 0" ++ _} ->
+		    false;
+		{'dtlsv1.2', "OpenSSL 0" ++ _} ->
+		    false;
+                {'dtlsv1.2', "OpenSSL 1.0.2" ++ _} ->
+		    false;
+		{'dtlsv1',  "OpenSSL 1.0.0" ++ _} ->
+		    false;
                 {'dtlsv1', _} ->
 		    not is_fips(openssl);
 		{'dtlsv1.2', _} ->
@@ -1885,18 +1893,10 @@ check_sane_openssl_version(Version) ->
 		    false;
 		{'tlsv1.1', "OpenSSL 1.0.0" ++ _} ->
 		    false;
-                {'dtlsv1.2', "OpenSSL 1.0.2" ++ _} ->
-		    false;
-		{'dtlsv1',  "OpenSSL 1.0.0" ++ _} ->
-		    false;
 		{'tlsv1.2', "OpenSSL 0" ++ _} ->
 		    false;
 		{'tlsv1.1', "OpenSSL 0" ++ _} ->
 		    false;
-                {'dtlsv1', "OpenSSL 0" ++ _} ->
-		    false;
-		{'dtlsv1.2', "OpenSSL 0" ++ _} ->
-		    false;
 		{_, _} ->
 		    true
 	    end;