Merge branch 'ingela/ssl/ECC-combos/OTP-14334'

* ingela/ssl/ECC-combos/OTP-14334:
  ssl: Generate correct certificate chains for the ECC tests
  public_key: Public RSA key is present in private key

7 files changed, 374 insertions, 327 deletions

diff --git a/lib/public_key/doc/src/public_key.xml b/lib/public_key/doc/src/public_key.xml
index 2300ce3937..940585575c 100644
--- a/lib/public_key/doc/src/public_key.xml
+++ b/lib/public_key/doc/src/public_key.xml
@@ -331,14 +331,15 @@
   </func>   
   
   <func>
-    <name>generate_key(Params) -> {Public::binary(), Private::binary()}  | #'ECPrivateKey'{} | {#'RSAPublicKey'{}, #'RSAPrivateKey'{}}</name>
+    <name>generate_key(Params) -> {Public::binary(), Private::binary()}  | #'ECPrivateKey'{} | #'RSAPrivateKey'{}</name>
     <fsummary>Generates a new keypair.</fsummary>
     <type>
       <v>Params = #'DHParameter'{} |  {namedCurve, oid()} |  #'ECParameters'{} 
       | {rsa, Size::integer(), PubExp::integer} </v>
     </type>
   <desc>
-    <p>Generates a new keypair. See also
+    <p>Generates a new keypair. Note that except for Diffie-Hellman
+    the public key is included in the private key structure. See also
     <seealso marker="crypto:crypto#generate_key/2">crypto:generate_key/2</seealso>
     </p>
   </desc>
diff --git a/lib/public_key/src/public_key.erl b/lib/public_key/src/public_key.erl
index 965606045d..7b5819fa84 100644
--- a/lib/public_key/src/public_key.erl
+++ b/lib/public_key/src/public_key.erl
@@ -402,7 +402,7 @@ dh_gex_group(Min, N, Max, Groups) ->
                   (#'ECParameters'{}) ->
                           #'ECPrivateKey'{};
                   ({rsa, Size::pos_integer(), PubExp::pos_integer()}) ->
-                          {#'RSAPublicKey'{}, #'RSAPrivateKey'{}}.
+                          #'RSAPrivateKey'{}.
 
 %% Description: Generates a new keypair
 %%--------------------------------------------------------------------
@@ -417,18 +417,15 @@ generate_key({rsa, ModulusSize, PublicExponent}) ->
         {[E, N], [E, N, D, P, Q, D_mod_P_1, D_mod_Q_1, InvQ_mod_P]} ->
             Nint = crypto:bytes_to_integer(N),
             Eint = crypto:bytes_to_integer(E),
-            {#'RSAPublicKey'{modulus = Nint,
-                             publicExponent = Eint},
-             #'RSAPrivateKey'{version = 0, % Two-factor (I guess since otherPrimeInfos is not given)
-                              modulus = Nint,
-                              publicExponent = Eint,
-                              privateExponent = crypto:bytes_to_integer(D),
-                              prime1 = crypto:bytes_to_integer(P),
-                              prime2 = crypto:bytes_to_integer(Q),
-                              exponent1 = crypto:bytes_to_integer(D_mod_P_1),
-                              exponent2 = crypto:bytes_to_integer(D_mod_Q_1),
-                              coefficient = crypto:bytes_to_integer(InvQ_mod_P)}
-            };
+            #'RSAPrivateKey'{version = 0, % Two-factor (I guess since otherPrimeInfos is not given)
+                             modulus = Nint,
+                             publicExponent = Eint,
+                             privateExponent = crypto:bytes_to_integer(D),
+                             prime1 = crypto:bytes_to_integer(P),
+                             prime2 = crypto:bytes_to_integer(Q),
+                             exponent1 = crypto:bytes_to_integer(D_mod_P_1),
+                             exponent2 = crypto:bytes_to_integer(D_mod_Q_1),
+                             coefficient = crypto:bytes_to_integer(InvQ_mod_P)};
 
         {[E, N], [E, N, D]} -> % FIXME: what to set the other fields in #'RSAPrivateKey'?
                                % Answer: Miller [Mil76]
@@ -438,9 +435,7 @@ generate_key({rsa, ModulusSize, PublicExponent}) ->
                                %   1976.
             Nint = crypto:bytes_to_integer(N),
             Eint = crypto:bytes_to_integer(E),
-            {#'RSAPublicKey'{modulus = Nint,
-                             publicExponent = Eint},
-             #'RSAPrivateKey'{version = 0, % Two-factor (I guess since otherPrimeInfos is not given)
+            #'RSAPrivateKey'{version = 0, % Two-factor (I guess since otherPrimeInfos is not given)
                               modulus = Nint,
                               publicExponent = Eint,
                               privateExponent = crypto:bytes_to_integer(D),
@@ -448,9 +443,8 @@ generate_key({rsa, ModulusSize, PublicExponent}) ->
                               prime2 = '?',
                               exponent1 = '?',
                               exponent2 = '?',
-                              coefficient = '?'}
-            };
-
+                              coefficient = '?'};
+        
         Other ->
             Other
     end.
diff --git a/lib/public_key/test/erl_make_certs.erl b/lib/public_key/test/erl_make_certs.erl
index 00be7dd5b3..95d0dec920 100644
--- a/lib/public_key/test/erl_make_certs.erl
+++ b/lib/public_key/test/erl_make_certs.erl
@@ -351,8 +351,6 @@ gen_rsa2(Size) ->
         %% The numbers 2048,17 is choosen to not cause the cryptolib on
         %% FIPS-enabled test machines be mad at us.
         public_key:generate_key({rsa, 2048, 17})
-    of
-        {_Public, Private} -> Private
     catch
         error:notsup ->
             %% Disabled dirty_schedulers => crypto:generate_key not working
diff --git a/lib/ssl/test/ssl_ECC_SUITE.erl b/lib/ssl/test/ssl_ECC_SUITE.erl
index f779765b18..b77f909dfa 100644
--- a/lib/ssl/test/ssl_ECC_SUITE.erl
+++ b/lib/ssl/test/ssl_ECC_SUITE.erl
@@ -46,7 +46,8 @@ groups() ->
      {'tlsv1', [], all_versions_groups()},
      {'erlang_server', [], key_cert_combinations()},
      {'erlang_client', [], key_cert_combinations()},
-     {'erlang', [], key_cert_combinations() ++ misc() ++ ecc_negotiation()}
+     {'erlang', [], key_cert_combinations() ++ misc() 
+      ++ ecc_negotiation()}
     ].
 
 all_versions_groups ()->
@@ -56,13 +57,13 @@ all_versions_groups ()->
     ].
 
 key_cert_combinations() ->
-    [client_ecdh_server_ecdh,
-     client_rsa_server_ecdh,
-     client_ecdh_server_rsa,
-     client_rsa_server_rsa,
-     client_ecdsa_server_ecdsa,
-     client_ecdsa_server_rsa,
-     client_rsa_server_ecdsa
+    [client_ecdh_rsa_server_ecdh_rsa,
+     client_ecdhe_rsa_server_ecdh_rsa,
+     client_ecdh_rsa_server_ecdhe_rsa,
+     client_ecdhe_rsa_server_ecdhe_rsa,
+     client_ecdhe_ecdsa_server_ecdhe_rsa,
+     client_ecdhe_ecdsa_server_ecdhe_ecdsa,
+     client_ecdh_rsa_server_ecdhe_ecdsa
     ].
 
 misc()->
@@ -74,15 +75,15 @@ ecc_negotiation() ->
      ecc_client_order,
      ecc_client_order_custom_curves,
      ecc_unknown_curve,
-     client_ecdh_server_ecdh_ecc_server_custom,
-     client_rsa_server_ecdh_ecc_server_custom,
-     client_ecdh_server_rsa_ecc_server_custom,
-     client_rsa_server_rsa_ecc_server_custom,
-     client_ecdsa_server_ecdsa_ecc_server_custom,
-     client_ecdsa_server_rsa_ecc_server_custom,
-     client_rsa_server_ecdsa_ecc_server_custom,
-     client_ecdsa_server_ecdsa_ecc_client_custom,
-     client_rsa_server_ecdsa_ecc_client_custom
+     client_ecdh_rsa_server_ecdhe_ecdsa_server_custom,
+     client_ecdh_rsa_server_ecdhe_rsa_server_custom,
+     client_ecdhe_rsa_server_ecdhe_ecdsa_server_custom,
+     client_ecdhe_rsa_server_ecdhe_rsa_server_custom,
+     client_ecdhe_rsa_server_ecdh_rsa_server_custom,
+     client_ecdhe_ecdsa_server_ecdhe_ecdsa_server_custom,
+     client_ecdhe_ecdsa_server_ecdhe_rsa_server_custom,
+     client_ecdhe_ecdsa_server_ecdhe_ecdsa_client_custom,    
+     client_ecdhe_rsa_server_ecdhe_ecdsa_client_custom
     ].
 
 %%--------------------------------------------------------------------
@@ -91,11 +92,10 @@ init_per_suite(Config0) ->
     try crypto:start() of
 	ok ->
 	    %% make rsa certs using oppenssl
-	    {ok, _} = make_certs:all(proplists:get_value(data_dir, Config0),
-				     proplists:get_value(priv_dir, Config0)),
-	    Config1 = ssl_test_lib:make_ecdsa_cert(Config0),
-	    Config2 = ssl_test_lib:make_ecdh_rsa_cert(Config1),
-	    ssl_test_lib:cert_options(Config2)
+	    Config1 = ssl_test_lib:make_rsa_cert(Config0),
+	    Config2 = ssl_test_lib:make_ecdsa_cert(Config1),
+            Config = ssl_test_lib:make_ecdh_rsa_cert(Config2),
+	    ssl_test_lib:cert_options(Config)
     catch _:_ ->
 	    {skip, "Crypto did not start"}
     end.
@@ -174,70 +174,58 @@ end_per_testcase(_TestCase, Config) ->
 %% Test Cases --------------------------------------------------------
 %%--------------------------------------------------------------------
 
-client_ecdh_server_ecdh(Config) when is_list(Config) ->
-    COpts =  proplists:get_value(client_ecdh_rsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdh_rsa_opts, Config),
-    basic_test(COpts, SOpts, Config).
-    
-client_ecdh_server_rsa(Config)  when is_list(Config) ->
-    COpts =  proplists:get_value(client_ecdh_rsa_opts, Config),
-    SOpts = proplists:get_value(server_opts, Config),
+%% Test diffrent certificate chain types, note that it is the servers
+%% chain that affect what cipher suit that will be choosen
+
+%% ECDH_RSA 
+client_ecdh_rsa_server_ecdh_rsa(Config) when is_list(Config) ->
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdh_rsa, ecdh_rsa, Config),
     basic_test(COpts, SOpts, Config).
-  
-client_rsa_server_ecdh(Config)  when is_list(Config) ->
-    COpts =  proplists:get_value(client_opts, Config),
-    SOpts = proplists:get_value(server_ecdh_rsa_opts, Config),
+
+client_ecdhe_rsa_server_ecdh_rsa(Config)  when is_list(Config) ->
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_rsa, ecdh_rsa, Config),
     basic_test(COpts, SOpts, Config).
    
-client_rsa_server_rsa(Config)  when is_list(Config) ->
-    COpts =  proplists:get_value(client_opts, Config),
-    SOpts = proplists:get_value(server_opts, Config),
+%% ECDHE_RSA    
+client_ecdh_rsa_server_ecdhe_rsa(Config)  when is_list(Config) ->
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdh_rsa, ecdhe_rsa, Config),
     basic_test(COpts, SOpts, Config).
-   
-client_ecdsa_server_ecdsa(Config)  when is_list(Config) ->
-    COpts =  proplists:get_value(client_ecdsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_opts, Config),
+
+client_ecdhe_rsa_server_ecdhe_rsa(Config)  when is_list(Config) ->
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_rsa, ecdhe_rsa, Config),
     basic_test(COpts, SOpts, Config).
 
-client_ecdsa_server_rsa(Config)  when is_list(Config) ->
-    COpts =  proplists:get_value(client_ecdsa_opts, Config),
-    SOpts = proplists:get_value(server_opts, Config),
+client_ecdhe_ecdsa_server_ecdhe_rsa(Config)  when is_list(Config) ->
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdh_ecdsa, ecdhe_rsa, Config),
+    basic_test(COpts, SOpts, Config).
+   
+%% ECDHE_ECDSA
+client_ecdhe_ecdsa_server_ecdhe_ecdsa(Config)  when is_list(Config) ->
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_ecdsa, ecdhe_ecdsa, Config),
     basic_test(COpts, SOpts, Config).
 
-client_rsa_server_ecdsa(Config)  when is_list(Config) ->
-    COpts =  proplists:get_value(client_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_opts, Config),
+client_ecdh_rsa_server_ecdhe_ecdsa(Config)  when is_list(Config) ->
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdh_rsa, ecdhe_ecdsa, Config),    
     basic_test(COpts, SOpts, Config).
 
 client_ecdsa_server_ecdsa_with_raw_key(Config)  when is_list(Config) ->
-    COpts =  proplists:get_value(client_ecdsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_opts, Config),
-    ServerCert = proplists:get_value(certfile, SOpts),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_ecdsa, ecdhe_ecdsa, Config),
     ServerKeyFile = proplists:get_value(keyfile, SOpts),
     {ok, PemBin} = file:read_file(ServerKeyFile),
     PemEntries = public_key:pem_decode(PemBin),
     {'ECPrivateKey', Key, not_encrypted} = proplists:lookup('ECPrivateKey', PemEntries),
     ServerKey = {'ECPrivateKey', Key},
-    ServerCA = proplists:get_value(cacertfile, SOpts),
-    ClientCert = proplists:get_value(certfile, COpts),
-    ClientKey = proplists:get_value(keyfile, COpts),
-    ClientCA = proplists:get_value(cacertfile, COpts),
     SType = proplists:get_value(server_type, Config),
     CType = proplists:get_value(client_type, Config),
     {Server, Port} = start_server_with_raw_key(SType,
-				  ClientCA, ServerCA,
-				  ServerCert,
-				  ServerKey,
-				  Config),
-    Client = start_client(CType, Port, ServerCA, ClientCA,
-			  ClientCert,
-			  ClientKey, Config),
+                                               [{key, ServerKey} | proplists:delete(keyfile, SOpts)],
+                                               Config),
+    Client = start_client(CType, Port, COpts, Config),
     check_result(Server, SType, Client, CType),
     close(Server, Client).
 
 ecc_default_order(Config) ->
-    COpts =  proplists:get_value(client_ecdsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_opts, Config),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_ecdsa, ecdhe_ecdsa, Config),   
     ECCOpts = [],
     case supported_eccs([{eccs, [sect571r1]}]) of
         true -> ecc_test(sect571r1, COpts, SOpts, [], ECCOpts, Config);
@@ -245,8 +233,7 @@ ecc_default_order(Config) ->
     end.
 
 ecc_default_order_custom_curves(Config) ->
-    COpts =  proplists:get_value(client_ecdsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_opts, Config),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_ecdsa, ecdhe_ecdsa, Config),   
     ECCOpts = [{eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
         true -> ecc_test(sect571r1, COpts, SOpts, [], ECCOpts, Config);
@@ -254,8 +241,7 @@ ecc_default_order_custom_curves(Config) ->
     end.
 
 ecc_client_order(Config) ->
-    COpts =  proplists:get_value(client_ecdsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_opts, Config),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_ecdsa, ecdhe_ecdsa, Config),   
     ECCOpts = [{honor_ecc_order, false}],
     case supported_eccs([{eccs, [sect571r1]}]) of
         true -> ecc_test(sect571r1, COpts, SOpts, [], ECCOpts, Config);
@@ -263,8 +249,7 @@ ecc_client_order(Config) ->
     end.
 
 ecc_client_order_custom_curves(Config) ->
-    COpts =  proplists:get_value(client_ecdsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_opts, Config),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_ecdsa, ecdhe_ecdsa, Config),   
     ECCOpts = [{honor_ecc_order, false}, {eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
         true -> ecc_test(sect571r1, COpts, SOpts, [], ECCOpts, Config);
@@ -272,89 +257,75 @@ ecc_client_order_custom_curves(Config) ->
     end.
 
 ecc_unknown_curve(Config) ->
-    COpts =  proplists:get_value(client_ecdsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_opts, Config),
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_ecdsa, ecdhe_ecdsa, Config),   
     ECCOpts = [{eccs, ['123_fake_curve']}],
     ecc_test_error(COpts, SOpts, [], ECCOpts, Config).
 
-%% We can only expect to see a named curve on a conn with
-%% a server supporting ecdsa. Otherwise the curve is selected
-%% but not used and communicated to the client?
-client_ecdh_server_ecdh_ecc_server_custom(Config) ->
-    COpts =  proplists:get_value(client_ecdh_rsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdh_rsa_opts, Config),
+client_ecdh_rsa_server_ecdhe_ecdsa_server_custom(Config) ->
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdh_rsa, ecdhe_ecdsa, Config),
     ECCOpts = [{honor_ecc_order, true}, {eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
-        true -> ecc_test(undefined, COpts, SOpts, [], ECCOpts, Config);
+        true -> ecc_test(secp256r1, COpts, SOpts, [], ECCOpts, Config);
         false -> {skip, "unsupported named curves"}
     end.
 
-client_ecdh_server_rsa_ecc_server_custom(Config) ->
-    COpts =  proplists:get_value(client_ecdh_rsa_opts, Config),
-    SOpts = proplists:get_value(server_opts, Config),
+client_ecdh_rsa_server_ecdhe_rsa_server_custom(Config) ->
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdh_rsa, ecdhe_rsa, Config),
     ECCOpts = [{honor_ecc_order, true}, {eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
         true -> ecc_test(undefined, COpts, SOpts, [], ECCOpts, Config);
         false -> {skip, "unsupported named curves"}
     end.
 
-client_rsa_server_ecdh_ecc_server_custom(Config) ->
-    COpts =  proplists:get_value(client_opts, Config),
-    SOpts = proplists:get_value(server_ecdh_rsa_opts, Config),
+client_ecdhe_rsa_server_ecdhe_ecdsa_server_custom(Config) ->
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_rsa, ecdhe_ecdsa, Config),
     ECCOpts = [{honor_ecc_order, true}, {eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
-        true -> ecc_test(undefined, COpts, SOpts, [], ECCOpts, Config);
+        true -> ecc_test(secp256r1, COpts, SOpts, [], ECCOpts, Config);
         false -> {skip, "unsupported named curves"}
     end.
 
-client_rsa_server_rsa_ecc_server_custom(Config) ->
-    COpts =  proplists:get_value(client_opts, Config),
-    SOpts = proplists:get_value(server_opts, Config),
+client_ecdhe_rsa_server_ecdhe_rsa_server_custom(Config) ->
+   {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_rsa, ecdhe_rsa, Config),
     ECCOpts = [{honor_ecc_order, true}, {eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
         true -> ecc_test(undefined, COpts, SOpts, [], ECCOpts, Config);
         false -> {skip, "unsupported named curves"}
     end.
-
-client_ecdsa_server_ecdsa_ecc_server_custom(Config) ->
-    COpts =  proplists:get_value(client_ecdsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_opts, Config),
+client_ecdhe_rsa_server_ecdh_rsa_server_custom(Config) ->
+   {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_rsa, ecdh_rsa, Config),
     ECCOpts = [{honor_ecc_order, true}, {eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
-        true -> ecc_test(secp256r1, COpts, SOpts, [], ECCOpts, Config);
+        true -> ecc_test(undefined, COpts, SOpts, [], ECCOpts, Config);
         false -> {skip, "unsupported named curves"}
     end.
 
-client_ecdsa_server_rsa_ecc_server_custom(Config) ->
-    COpts =  proplists:get_value(client_ecdsa_opts, Config),
-    SOpts = proplists:get_value(server_opts, Config),
+client_ecdhe_ecdsa_server_ecdhe_ecdsa_server_custom(Config) ->
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_ecdsa, ecdhe_ecdsa, Config),
     ECCOpts = [{honor_ecc_order, true}, {eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
-        true -> ecc_test(undefined, COpts, SOpts, [], ECCOpts, Config);
+        true -> ecc_test(secp256r1, COpts, SOpts, [], ECCOpts, Config);
         false -> {skip, "unsupported named curves"}
     end.
 
-client_rsa_server_ecdsa_ecc_server_custom(Config) ->
-    COpts =  proplists:get_value(client_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_opts, Config),
+client_ecdhe_ecdsa_server_ecdhe_rsa_server_custom(Config) ->
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_ecdsa, ecdhe_rsa, Config),
     ECCOpts = [{honor_ecc_order, true}, {eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
-        true -> ecc_test(secp256r1, COpts, SOpts, [], ECCOpts, Config);
+        true -> ecc_test(undefined, COpts, SOpts, [], ECCOpts, Config);
         false -> {skip, "unsupported named curves"}
     end.
 
-client_ecdsa_server_ecdsa_ecc_client_custom(Config) ->
-    COpts =  proplists:get_value(client_ecdsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_opts, Config),
+client_ecdhe_ecdsa_server_ecdhe_ecdsa_client_custom(Config) ->
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_ecdsa, ecdhe_ecdsa, Config),
     ECCOpts = [{eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
         true -> ecc_test(secp256r1, COpts, SOpts, ECCOpts, [], Config);
         false -> {skip, "unsupported named curves"}
     end.
 
-client_rsa_server_ecdsa_ecc_client_custom(Config) ->
-    COpts =  proplists:get_value(client_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_opts, Config),
+client_ecdhe_rsa_server_ecdhe_ecdsa_client_custom(Config) ->
+    {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains(ecdhe_rsa, ecdhe_ecdsa, Config),
     ECCOpts = [{eccs, [secp256r1, sect571r1]}],
     case supported_eccs(ECCOpts) of
         true -> ecc_test(secp256r1, COpts, SOpts, ECCOpts, [], Config);
@@ -365,57 +336,31 @@ client_rsa_server_ecdsa_ecc_client_custom(Config) ->
 %% Internal functions ------------------------------------------------
 %%--------------------------------------------------------------------
 basic_test(COpts, SOpts, Config) ->
-    basic_test(proplists:get_value(certfile, COpts), 
-	       proplists:get_value(keyfile, COpts), 
-	       proplists:get_value(cacertfile, COpts), 
-	       proplists:get_value(certfile, SOpts), 
-	       proplists:get_value(keyfile, SOpts), 
-	       proplists:get_value(cacertfile, SOpts), 
-	       Config).
-    
-basic_test(ClientCert, ClientKey, ClientCA, ServerCert, ServerKey, ServerCA, Config) ->
     SType = proplists:get_value(server_type, Config),
     CType = proplists:get_value(client_type, Config),
-    {Server, Port} = start_server(SType,
-				  ClientCA, ServerCA,
-				  ServerCert,
-				  ServerKey,
-				  Config),
-    Client = start_client(CType, Port, ServerCA, ClientCA,
-			  ClientCert,
-			  ClientKey, Config),
+    {Server, Port} = start_server(SType, SOpts, Config),
+    Client = start_client(CType, Port, COpts, Config),
     check_result(Server, SType, Client, CType),
     close(Server, Client).    
 
 
 ecc_test(Expect, COpts, SOpts, CECCOpts, SECCOpts, Config) ->
-    CCA = proplists:get_value(cacertfile, COpts),
-    CCert = proplists:get_value(certfile, COpts),
-    CKey = proplists:get_value(keyfile, COpts),
-    SCA = proplists:get_value(cacertfile, SOpts),
-    SCert = proplists:get_value(certfile, SOpts),
-    SKey = proplists:get_value(keyfile, SOpts),
-    {Server, Port} = start_server_ecc(erlang, CCA, SCA, SCert, SKey, Expect, SECCOpts, Config),
-    Client = start_client_ecc(erlang, Port, SCA, CCA, CCert, CKey, Expect, CECCOpts, Config),
+    {Server, Port} = start_server_ecc(erlang, SOpts, Expect, SECCOpts, Config),
+    Client = start_client_ecc(erlang, Port, COpts, Expect, CECCOpts, Config),
     ssl_test_lib:check_result(Server, ok, Client, ok),
     close(Server, Client).
 
 ecc_test_error(COpts, SOpts, CECCOpts, SECCOpts, Config) ->
-    CCA = proplists:get_value(cacertfile, COpts),
-    CCert = proplists:get_value(certfile, COpts),
-    CKey = proplists:get_value(keyfile, COpts),
-    SCA = proplists:get_value(cacertfile, SOpts),
-    SCert = proplists:get_value(certfile, SOpts),
-    SKey = proplists:get_value(keyfile, SOpts),
-    {Server, Port} = start_server_ecc_error(erlang, CCA, SCA, SCert, SKey, SECCOpts, Config),
-    Client = start_client_ecc_error(erlang, Port, SCA, CCA, CCert, CKey, CECCOpts, Config),
+    {Server, Port} = start_server_ecc_error(erlang, SOpts, SECCOpts, Config),
+    Client = start_client_ecc_error(erlang, Port, COpts, CECCOpts, Config),
     Error = {error, {tls_alert, "insufficient security"}},
     ssl_test_lib:check_result(Server, Error, Client, Error).
 
 
-start_client(openssl, Port, PeerCA, OwnCa, Cert, Key, Config) ->
-    PrivDir = proplists:get_value(priv_dir, Config),
-    CA = new_openssl_ca(filename:join(PrivDir, "openssl_client_ca.pem"), PeerCA, OwnCa),
+start_client(openssl, Port, ClientOpts, _Config) ->
+    Cert = proplists:get_value(certfile, ClientOpts),
+    Key = proplists:get_value(keyfile, ClientOpts),
+    CA = proplists:get_value(cacertfile, ClientOpts),
     Version = tls_record:protocol_version(tls_record:highest_protocol_version([])),
     Exe = "openssl",
     Args = ["s_client", "-verify", "2", "-port", integer_to_list(Port),
@@ -426,21 +371,17 @@ start_client(openssl, Port, PeerCA, OwnCa, Cert, Key, Config) ->
     OpenSslPort = ssl_test_lib:portable_open_port(Exe, Args), 
     true = port_command(OpenSslPort, "Hello world"),
     OpenSslPort;
-start_client(erlang, Port, PeerCA, OwnCa, Cert, Key, Config) ->
-    PrivDir = proplists:get_value(priv_dir, Config),
-    CA = new_ca(filename:join(PrivDir,"erlang_client_ca.pem"), PeerCA, OwnCa),
+
+start_client(erlang, Port, ClientOpts, Config) ->
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
     ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 			       {host, Hostname},
 			       {from, self()},
 			       {mfa, {ssl_test_lib, send_recv_result_active, []}},
-			       {options, [{verify, verify_peer}, 
-					  {cacertfile, CA},
-					  {certfile, Cert}, {keyfile, Key}]}]).
+			       {options, [{verify, verify_peer} | ClientOpts]}]).
 
 
-start_client_ecc(erlang, Port, PeerCA, OwnCa, Cert, Key, Expect, ECCOpts, Config) ->
-    CA = new_ca("erlang_client_ca", PeerCA, OwnCa),
+start_client_ecc(erlang, Port, ClientOpts, Expect, ECCOpts, Config) ->
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
     ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
                                {host, Hostname},
@@ -448,26 +389,22 @@ start_client_ecc(erlang, Port, PeerCA, OwnCa, Cert, Key, Expect, ECCOpts, Config
                                {mfa, {?MODULE, check_ecc, [client, Expect]}},
                                {options,
                                 ECCOpts ++
-                                [{verify, verify_peer},
-                                 {cacertfile, CA},
-                                 {certfile, Cert}, {keyfile, Key}]}]).
+                                [{verify, verify_peer} | ClientOpts]}]).
 
-start_client_ecc_error(erlang, Port, PeerCA, OwnCa, Cert, Key, ECCOpts, Config) ->
-    CA = new_ca("erlang_client_ca", PeerCA, OwnCa),
+start_client_ecc_error(erlang, Port, ClientOpts, ECCOpts, Config) ->
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
     ssl_test_lib:start_client_error([{node, ClientNode}, {port, Port},
                                      {host, Hostname},
                                      {from, self()},
                                      {options,
                                       ECCOpts ++
-                                      [{verify, verify_peer},
-                                       {cacertfile, CA},
-                                       {certfile, Cert}, {keyfile, Key}]}]).
+                                      [{verify, verify_peer} | ClientOpts]}]).
 
 
-start_server(openssl, PeerCA, OwnCa, Cert, Key, Config) ->
-    PrivDir = proplists:get_value(priv_dir, Config),
-    CA = new_openssl_ca(filename:join(PrivDir,"openssl_server_ca.pem"), PeerCA, OwnCa),
+start_server(openssl, ServerOpts, _Config) ->
+    Cert = proplists:get_value(certfile, ServerOpts),
+    Key = proplists:get_value(keyfile, ServerOpts),
+    CA = proplists:get_value(cacertfile, ServerOpts),
     Port = ssl_test_lib:inet_port(node()),
     Version = tls_record:protocol_version(tls_record:highest_protocol_version([])),
     Exe = "openssl",
@@ -477,23 +414,17 @@ start_server(openssl, PeerCA, OwnCa, Cert, Key, Config) ->
     OpenSslPort = ssl_test_lib:portable_open_port(Exe, Args),
     true = port_command(OpenSslPort, "Hello world"),
     {OpenSslPort, Port};
-start_server(erlang, PeerCA, OwnCa, Cert, Key, Config) ->
-     PrivDir = proplists:get_value(priv_dir, Config),
-    CA = new_ca(filename:join(PrivDir,"erlang_server_ca.pem"), PeerCA, OwnCa),    
+start_server(erlang, ServerOpts, Config) ->
     {_, ServerNode, _} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
-			       {from, self()},
-			       {mfa, {ssl_test_lib,
-				      send_recv_result_active,
-				      []}},
-			       {options,
-				[{verify, verify_peer}, {cacertfile, CA},
-				 {certfile, Cert}, {keyfile, Key}]}]),
+                                        {from, self()},
+                                        {mfa, {ssl_test_lib,
+                                               send_recv_result_active,
+                                               []}},
+                                        {options, [{verify, verify_peer} | ServerOpts]}]),
     {Server, ssl_test_lib:inet_port(Server)}.
 
-start_server_with_raw_key(erlang, PeerCA, OwnCa, Cert, Key, Config) ->
-    PrivDir = proplists:get_value(priv_dir, Config),
-    CA = new_ca(filename:join(PrivDir, "erlang_server_ca.pem"), PeerCA, OwnCa),
+start_server_with_raw_key(erlang, ServerOpts, Config) ->
     {_, ServerNode, _} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
 					{from, self()},
@@ -501,31 +432,26 @@ start_server_with_raw_key(erlang, PeerCA, OwnCa, Cert, Key, Config) ->
 					       send_recv_result_active,
 					       []}},
 					{options,
-					 [{verify, verify_peer}, {cacertfile, CA},
-					  {certfile, Cert}, {key, Key}]}]),
+					 [{verify, verify_peer} | ServerOpts]}]),
     {Server, ssl_test_lib:inet_port(Server)}.
 
-start_server_ecc(erlang, PeerCA, OwnCa, Cert, Key, Expect, ECCOpts, Config) ->
-    CA = new_ca("erlang_server_ca", PeerCA, OwnCa),
+start_server_ecc(erlang, ServerOpts, Expect, ECCOpts, Config) ->
     {_, ServerNode, _} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
                                         {from, self()},
                                         {mfa, {?MODULE, check_ecc, [server, Expect]}},
                                         {options,
                                          ECCOpts ++
-                                         [{verify, verify_peer}, {cacertfile, CA},
-                                          {certfile, Cert}, {keyfile, Key}]}]),
+                                         [{verify, verify_peer} | ServerOpts]}]),
     {Server, ssl_test_lib:inet_port(Server)}.
 
-start_server_ecc_error(erlang, PeerCA, OwnCa, Cert, Key, ECCOpts, Config) ->
-    CA = new_ca("erlang_server_ca", PeerCA, OwnCa),
+start_server_ecc_error(erlang, ServerOpts, ECCOpts, Config) ->
     {_, ServerNode, _} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
                                               {from, self()},
                                               {options,
                                                ECCOpts ++
-                                               [{verify, verify_peer}, {cacertfile, CA},
-                                                {certfile, Cert}, {keyfile, Key}]}]),
+                                               [{verify, verify_peer} | ServerOpts]}]),
     {Server, ssl_test_lib:inet_port(Server)}.
 
 check_result(Server, erlang, Client, erlang) ->
@@ -561,24 +487,6 @@ close(Client, Server)  ->
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client).
 
-new_ca(FileName, CA, OwnCa) ->
-    {ok, P1} = file:read_file(CA),
-    E1 = public_key:pem_decode(P1),
-    {ok, P2} = file:read_file(OwnCa),
-    E2 = public_key:pem_decode(P2),
-    Pem = public_key:pem_encode(E1 ++E2),
-    file:write_file(FileName,  Pem),
-    FileName.
-
-new_openssl_ca(FileName, CA, OwnCa) ->
-    {ok, P1} = file:read_file(CA),
-    E1 = public_key:pem_decode(P1),
-    {ok, P2} = file:read_file(OwnCa),
-    E2 = public_key:pem_decode(P2),
-    Pem = public_key:pem_encode(E2 ++E1),
-    file:write_file(FileName,  Pem),
-    FileName.
-
 supported_eccs(Opts) ->
     ToCheck = proplists:get_value(eccs, Opts, []),
     Supported = ssl:eccs(),
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index ae378037dd..302b5178a5 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -485,17 +485,52 @@ make_dsa_cert(Config) ->
 		       {certfile, ClientCertFile}, {keyfile, ClientKeyFile}]}
      | Config].
 
+
+make_ec_cert_chains(ClientChainType, ServerChainType, Config) ->
+    CryptoSupport = crypto:supports(),
+    KeyGenSpec = key_gen_info(ClientChainType, ServerChainType),
+    ClientFileBase = filename:join([proplists:get_value(priv_dir, Config), atom_to_list(ClientChainType)]),
+    ServerFileBase = filename:join([proplists:get_value(priv_dir, Config), atom_to_list(ServerChainType)]),
+    GenCertData = x509_test:gen_test_certs([{digest, appropriate_sha(CryptoSupport)} | KeyGenSpec]),
+    [{server_config, ServerConf}, 
+     {client_config, ClientConf}] = 
+        x509_test:gen_pem_config_files(GenCertData, ClientFileBase, ServerFileBase),               
+    {[{verify, verify_peer} | ClientConf],
+     [{reuseaddr, true}, {verify, verify_peer} | ServerConf]
+    }.
+
+key_gen_info(ClientChainType, ServerChainType) ->
+    key_gen_spec("client", ClientChainType) ++ key_gen_spec("server", ServerChainType).
+
+key_gen_spec(Role, ecdh_rsa) ->
+    CurveOid = hd(tls_v1:ecc_curves(0)),
+    [{list_to_atom(Role ++ "_key_gen"),  {namedCurve, CurveOid}},
+     {list_to_atom(Role ++ "_key_gen_chain"),  [hardcode_rsa_key(1),
+                                                {namedCurve, CurveOid}]}
+    ];
+key_gen_spec(Role, ecdhe_ecdsa) ->
+    CurveOid = hd(tls_v1:ecc_curves(0)),
+     [{list_to_atom(Role ++ "_key_gen"),  {namedCurve, CurveOid}},
+      {list_to_atom(Role ++ "_key_gen_chain"),  [{namedCurve, CurveOid},
+                                                 {namedCurve, CurveOid}]}
+    ];
+key_gen_spec(Role, ecdh_ecdsa) ->
+    CurveOid = hd(tls_v1:ecc_curves(0)),
+    [{list_to_atom(Role ++ "_key_gen"),  {namedCurve, CurveOid}},
+     {list_to_atom(Role ++ "_key_gen_chain"),  [{namedCurve, CurveOid},
+                                                {namedCurve, CurveOid}]}
+    ];
+key_gen_spec(Role, ecdhe_rsa) ->
+    [{list_to_atom(Role ++ "_key_gen"),  hardcode_rsa_key(1)},
+     {list_to_atom(Role ++ "_key_gen_chain"),  [hardcode_rsa_key(2),
+                                                hardcode_rsa_key(3)]}
+    ].
 make_ecdsa_cert(Config) ->
     CryptoSupport = crypto:supports(),
     case proplists:get_bool(ecdsa, proplists:get_value(public_keys, CryptoSupport)) of
         true ->
-	    %% {ServerCaCertFile, ServerCertFile, ServerKeyFile} = 
-	    %%     make_cert_files("server", Config, ec, ec, "", [{digest, appropriate_sha(CryptoSupport)}]),
-	    %% {ClientCaCertFile, ClientCertFile, ClientKeyFile} = 
-	    %%     make_cert_files("client", Config, ec, ec, "", [{digest, appropriate_sha(CryptoSupport)}]),
-            CertFileBase = filename:join([proplists:get_value(priv_dir, Config), "ecdsa_cert.pem"]),
-            KeyFileBase = filename:join([proplists:get_value(priv_dir, Config), "ecdsa_key.pem"]),
-            CaCertFileBase = filename:join([proplists:get_value(priv_dir, Config), "ecdsa_cacerts.pem"]),
+            ClientFileBase = filename:join([proplists:get_value(priv_dir, Config), "ecdsa"]),
+            ServerFileBase = filename:join([proplists:get_value(priv_dir, Config), "ecdsa"]),
             CurveOid = hd(tls_v1:ecc_curves(0)),
             GenCertData = x509_test:gen_test_certs([{server_key_gen, {namedCurve, CurveOid}}, 
                                                     {client_key_gen, {namedCurve, CurveOid}},
@@ -506,17 +541,41 @@ make_ecdsa_cert(Config) ->
                                                     {digest, appropriate_sha(CryptoSupport)}]),
             [{server_config, ServerConf}, 
              {client_config, ClientConf}] = 
-                x509_test:gen_pem_config_files(GenCertData, CertFileBase, KeyFileBase, CaCertFileBase),
+                x509_test:gen_pem_config_files(GenCertData, ClientFileBase, ServerFileBase),               
 	    [{server_ecdsa_opts, [{ssl_imp, new},{reuseaddr, true} | ServerConf]},
              
 	     {server_ecdsa_verify_opts, [{ssl_imp, new}, {reuseaddr, true},
 					 {verify, verify_peer} | ServerConf]},
-	     {client_ecdsa_opts, [{ssl_imp, new}, {reuseaddr, true}  | ClientConf]}
+	     {client_ecdsa_opts, ClientConf}
+	     | Config];
+	false ->
+	    Config
+    end.
+make_rsa_cert(Config) ->
+    CryptoSupport = crypto:supports(),
+    case proplists:get_bool(rsa, proplists:get_value(public_keys, CryptoSupport)) of
+        true ->
+            ClientFileBase = filename:join([proplists:get_value(priv_dir, Config), "rsa"]),
+            ServerFileBase = filename:join([proplists:get_value(priv_dir, Config), "rsa"]),
+            GenCertData = x509_test:gen_test_certs([{server_key_gen, hardcode_rsa_key(1)}, 
+                                                    {client_key_gen, hardcode_rsa_key(2)},
+                                                    {server_key_gen_chain, [hardcode_rsa_key(3),
+                                                                            hardcode_rsa_key(4)]},
+                                                    {client_key_gen_chain, [hardcode_rsa_key(5),
+                                                                            hardcode_rsa_key(6)]},
+                                                    {digest, appropriate_sha(CryptoSupport)}]),
+            [{server_config, ServerConf}, 
+             {client_config, ClientConf}] = 
+                x509_test:gen_pem_config_files(GenCertData, ClientFileBase, ServerFileBase),               
+	    [{server_rsa_opts, [{ssl_imp, new},{reuseaddr, true} | ServerConf]},
+             
+	     {server_rsa_verify_opts, [{ssl_imp, new}, {reuseaddr, true},
+					 {verify, verify_peer} | ServerConf]},
+	     {client_rsa_opts, ClientConf}
 	     | Config];
 	false ->
 	    Config
     end.
-
 appropriate_sha(CryptoSupport) ->
     case proplists:get_bool(sha256, CryptoSupport) of
 	true ->
@@ -533,21 +592,30 @@ make_ecdh_rsa_cert(Config) ->
     CryptoSupport = crypto:supports(),
     case proplists:get_bool(ecdh, proplists:get_value(public_keys, CryptoSupport)) of
 	true ->
-	    {ServerCaCertFile, ServerCertFile, ServerKeyFile} = 
-		make_cert_files("server", Config, rsa, ec, "rsa_", []),
-	    {ClientCaCertFile, ClientCertFile, ClientKeyFile} = 
-		make_cert_files("client", Config, rsa, ec, "rsa_",[]),
-	    [{server_ecdh_rsa_opts, [{ssl_imp, new},{reuseaddr, true},
-				     {cacertfile, ServerCaCertFile},
-				     {certfile, ServerCertFile}, {keyfile, ServerKeyFile}]},
-	     {server_ecdh_rsa_verify_opts, [{ssl_imp, new},{reuseaddr, true},
-					    {cacertfile, ClientCaCertFile},
-					    {certfile, ServerCertFile}, {keyfile, ServerKeyFile},
-					    {verify, verify_peer}]},
-	     {client_ecdh_rsa_opts, [{ssl_imp, new},
-				     {cacertfile, ClientCaCertFile},
-				     {certfile, ClientCertFile}, {keyfile, ClientKeyFile}]}
-	     | Config];
+            ClientFileBase = filename:join([proplists:get_value(priv_dir, Config), "ecdh_rsa"]),
+            ServerFileBase = filename:join([proplists:get_value(priv_dir, Config), "ecdh_rsa"]),
+            CurveOid = hd(tls_v1:ecc_curves(0)),
+            GenCertData = x509_test:gen_test_certs([{server_key_gen, {namedCurve, CurveOid}}, 
+                                                    {client_key_gen, {namedCurve, CurveOid}},
+                                                    {server_key_gen_chain, [hardcode_rsa_key(1),
+                                                                            {namedCurve, CurveOid}
+                                                                           ]},
+                                                    {client_key_gen_chain, [hardcode_rsa_key(2),
+                                                                            {namedCurve, CurveOid}
+                                                                           ]},
+                                                    {digest, appropriate_sha(CryptoSupport)}]),
+            [{server_config, ServerConf}, 
+             {client_config, ClientConf}] = 
+                x509_test:gen_pem_config_files(GenCertData, ClientFileBase, ServerFileBase),
+
+	    [{server_ecdh_rsa_opts, [{ssl_imp, new},{reuseaddr, true} | ServerConf]},
+				    
+	     {server_ecdh_rsa_verify_opts, [{ssl_imp, new},{reuseaddr, true}, 	 
+                                            {verify, verify_peer} | ServerConf]},
+					
+	     {client_ecdh_rsa_opts, ClientConf}
+				   
+             | Config];
 	_ ->
 	    Config
     end.
@@ -1326,7 +1394,7 @@ do_supports_ssl_tls_version(Port) ->
 		false ->
 		    do_supports_ssl_tls_version(Port)
 	    end
-    after 500 ->
+    after 1000 ->
 	    true
     end.
 
@@ -1410,6 +1478,76 @@ tls_version('dtlsv1.2' = Atom) ->
 tls_version(Atom) ->
     tls_record:protocol_version(Atom).
 
+hardcode_rsa_key(1) ->
+    {'RSAPrivateKey',0,
+                 23995666614853919027835084074500048897452890537492185072956789802729257783422306095699263934587064480357348855732149402060270996295002843755712064937715826848741191927820899197493902093529581182351132392364214171173881547273475904587683433713767834856230531387991145055273426806331200574039205571401702219159773947658558490957010003143162250693492642996408861265758000254664396313741422909188635443907373976005987612936763564996605457102336549804831742940035613780926178523017685712710473543251580072875247250504243621640157403744718833162626193206685233710319205099867303242759099560438381385658382486042995679707669,
+                 17,
+                 11292078406990079542510627799764728892919007311761028269626724613049062486316379339152594792746853873109340637991599718616598115903530750002688030558925094987642913848386305504703012749896273497577003478759630198199473669305165131570674557041773098755873191241407597673069847908861741446606684974777271632545629600685952292605647052193819136445675100211504432575554351515262198132231537860917084269870590492135731720141577986787033006338680118008484613510063003323516659048210893001173583018220214626635609151105287049126443102976056146630518124476470236027123782297108342869049542023328584384300970694412006494684657,
+                 169371138592582642967021557955633494538845517070305333860805485424261447791289944610138334410987654265476540480228705481960508520379619587635662291973699651583489223555422528867090299996446070521801757353675026048850480903160224210802452555900007597342687137394192939372218903554801584969667104937092080815197,
+                 141675062317286527042995673340952251894209529891636708844197799307963834958115010129693036021381525952081167155681637592199810112261679449166276939178032066869788822014115556349519329537177920752776047051833616197615329017439297361972726138285974555338480581117881706656603857310337984049152655480389797687577,
+                 119556097830058336212015217380447172615655659108450823901745048534772786676204666783627059584226579481512852103690850928442711896738555003036938088452023283470698275450886490965004917644550167427154181661417665446247398284583687678213495921811770068712485038160606780733330990744565824684470897602653233516609,
+                 41669135975672507953822256864985956439473391144599032012999352737636422046504414744027363535700448809435637398729893409470532385959317485048904982111185902020526124121798693043976273393287623750816484427009887116945685005129205106462566511260580751570141347387612266663707016855981760014456663376585234613993,
+                 76837684977089699359024365285678488693966186052769523357232308621548155587515525857011429902602352279058920284048929101483304120686557782043616693940283344235057989514310975192908256494992960578961614059245280827077951132083993754797053182279229469590276271658395444955906108899267024101096069475145863928441,
+                 asn1_NOVALUE};
+
+hardcode_rsa_key(2) ->
+{'RSAPrivateKey',0,
+                 21343679768589700771839799834197557895311746244621307033143551583788179817796325695589283169969489517156931770973490560582341832744966317712674900833543896521418422508485833901274928542544381247956820115082240721897193055368570146764204557110415281995205343662628196075590438954399631753508888358737971039058298703003743872818150364935790613286541190842600031570570099801682794056444451081563070538409720109449780410837763602317050353477918147758267825417201591905091231778937606362076129350476690460157227101296599527319242747999737801698427160817755293383890373574621116766934110792127739174475029121017282777887777,
+                 17,
+                 18832658619343853622211588088997845201745658451136447382185486691577805721584993260814073385267196632785528033211903435807948675951440868570007265441362261636545666919252206383477878125774454042314841278013741813438699754736973658909592256273895837054592950290554290654932740253882028017801960316533503857992358685308186680144968293076156011747178275038098868263178095174694099811498968993700538293188879611375604635940554394589807673542938082281934965292051746326331046224291377703201248790910007232374006151098976879987912446997911775904329728563222485791845480864283470332826504617837402078265424772379987120023773,
+                 146807662748886761089048448970170315054939768171908279335181627815919052012991509112344782731265837727551849787333310044397991034789843793140419387740928103541736452627413492093463231242466386868459637115999163097726153692593711599245170083315894262154838974616739452594203727376460632750934355508361223110419,
+                 145385325050081892763917667176962991350872697916072592966410309213561884732628046256782356731057378829876640317801978404203665761131810712267778698468684631707642938779964806354584156202882543264893826268426566901882487709510744074274965029453915224310656287149777603803201831202222853023280023478269485417083,
+                 51814469205489445090252393754177758254684624060673510353593515699736136004585238510239335081623236845018299924941168250963996835808180162284853901555621683602965806809675350150634081614988136541809283687999704622726877773856604093851236499993845033701707873394143336209718962603456693912094478414715725803677,
+                 51312467664734785681382706062457526359131540440966797517556579722433606376221663384746714140373192528191755406283051201483646739222992016094510128871300458249756331334105225772206172777487956446433115153562317730076172132768497908567634716277852432109643395464627389577600646306666889302334125933506877206029,
+                 30504662229874176232343608562807118278893368758027179776313787938167236952567905398252901545019583024374163153775359371298239336609182249464886717948407152570850677549297935773605431024166978281486607154204888016179709037883348099374995148481968169438302456074511782717758301581202874062062542434218011141540,
+ asn1_NOVALUE};
+
+hardcode_rsa_key(3) -> 
+{'RSAPrivateKey',0,
+                 25089040456112869869472694987833070928503703615633809313972554887193090845137746668197820419383804666271752525807484521370419854590682661809972833718476098189250708650325307850184923546875260207894844301992963978994451844985784504212035958130279304082438876764367292331581532569155681984449177635856426023931875082020262146075451989132180409962870105455517050416234175675478291534563995772675388370042873175344937421148321291640477650173765084699931690748536036544188863178325887393475703801759010864779559318631816411493486934507417755306337476945299570726975433250753415110141783026008347194577506976486290259135429,
+                 17,
+                 8854955455098659953931539407470495621824836570223697404931489960185796768872145882893348383311931058684147950284994536954265831032005645344696294253579799360912014817761873358888796545955974191021709753644575521998041827642041589721895044045980930852625485916835514940558187965584358347452650930302268008446431977397918214293502821599497633970075862760001650736520566952260001423171553461362588848929781360590057040212831994258783694027013289053834376791974167294527043946669963760259975273650548116897900664646809242902841107022557239712438496384819445301703021164043324282687280801738470244471443835900160721870265,
+                 171641816401041100605063917111691927706183918906535463031548413586331728772311589438043965564336865070070922328258143588739626712299625805650832695450270566547004154065267940032684307994238248203186986569945677705100224518137694769557564475390859269797990555863306972197736879644001860925483629009305104925823,
+                 146170909759497809922264016492088453282310383272504533061020897155289106805616042710009332510822455269704884883705830985184223718261139908416790475825625309815234508695722132706422885088219618698987115562577878897003573425367881351537506046253616435685549396767356003663417208105346307649599145759863108910523,
+                 60579464612132153154728441333538327425711971378777222246428851853999433684345266860486105493295364142377972586444050678378691780811632637288529186629507258781295583787741625893888579292084087601124818789392592131211843947578009918667375697196773859928702549128225990187436545756706539150170692591519448797349,
+                 137572620950115585809189662580789132500998007785886619351549079675566218169991569609420548245479957900898715184664311515467504676010484619686391036071176762179044243478326713135456833024206699951987873470661533079532774988581535389682358631768109586527575902839864474036157372334443583670210960715165278974609,
+                 15068630434698373319269196003209754243798959461311186548759287649485250508074064775263867418602372588394608558985183294561315208336731894947137343239541687540387209051236354318837334154993136528453613256169847839789803932725339395739618592522865156272771578671216082079933457043120923342632744996962853951612,
+ asn1_NOVALUE};
+hardcode_rsa_key(4) -> 
+{'RSAPrivateKey',0,
+                 28617237755030755643854803617273584643843067580642149032833640135949799721163782522787597288521902619948688786051081993247908700824196122780349730169173433743054172191054872553484065655968335396052034378669869864779940355219732200954630251223541048434478476115391643898092650304645086338265930608997389611376417609043761464100338332976874588396803891301015812818307951159858145399281035705713082131199940309445719678087542976246147777388465712394062188801177717719764254900022006288880246925156931391594131839991579403409541227225173269459173129377291869028712271737734702830877034334838181789916127814298794576266389,
+                 17,
+                 26933870828264240605980991639786903194205240075898493207372837775011576208154148256741268036255908348187001210401018346586267012540419880263858569570986761169933338532757527109161473558558433313931326474042230460969355628442100895016122589386862163232450330461545076609969553227901257730132640573174013751883368376011370428995523268034111482031427024082719896108094847702954695363285832195666458915142143884210891427766607838346722974883433132513540317964796373298134261669479023445911856492129270184781873446960437310543998533283339488055776892320162032014809906169940882070478200435536171854883284366514852906334641,
+                 177342190816702392178883147766999616783253285436834252111702533617098994535049411784501174309695427674025956656849179054202187436663487378682303508229883753383891163725167367039879190685255046547908384208614573353917213168937832054054779266431207529839577747601879940934691505396807977946728204814969824442867,
+                 161367340863680900415977542864139121629424927689088951345472941851682581254789586032968359551717004797621579428672968948552429138154521719743297455351687337112710712475376510559020211584326773715482918387500187602625572442687231345855402020688502483137168684570635690059254866684191216155909970061793538842967,
+                 62591361464718491357252875682470452982324688977706206627659717747211409835899792394529826226951327414362102349476180842659595565881230839534930649963488383547255704844176717778780890830090016428673547367746320007264898765507470136725216211681602657590439205035957626212244060728285168687080542875871702744541,
+                 28476589564178982426348978152495139111074987239250991413906989738532220221433456358759122273832412611344984605059935696803369847909621479954699550944415412431654831613301737157474154985469430655673456186029444871051571607533040825739188591886206320553618003159523945304574388238386685203984112363845918619347,
+                 34340318160575773065401929915821192439103777558577109939078671096408836197675640654693301707202885840826672396546056002756167635035389371579540325327619480512374920136684787633921441576901246290213545161954865184290700344352088099063404416346968182170720521708773285279884132629954461545103181082503707725012,
+ asn1_NOVALUE};
+hardcode_rsa_key(5) -> 
+{'RSAPrivateKey',0,
+                 26363170152814518327068346871197765236382539835597898797762992537312221863402655353436079974302838986536256364057947538018476963115004626096654613827403121905035011992899481598437933532388248462251770039307078647864188314916665766359828262009578648593031111569685489178543405615478739906285223620987558499488359880003693226535420421293716164794046859453204135383236667988765227190694994861629971618548127529849059769249520775574008363789050621665120207265361610436965088511042779948238320901918522125988916609088415989475825860046571847719492980547438560049874493788767083330042728150253120940100665370844282489982633,
+                 17,
+                 10855423004100095781734025182257903332628104638187370093196526338893267826106975733767797636477639582691399679317978398007608161282648963686857782164224814902073240232370374775827384395689278778574258251479385325591136364965685903795223402003944149420659869469870495544106108194608892902588033255700759382142132115013969680562678811046675523365751498355532768935784747314021422035957153013494814430893022253205880275287307995039363642554998244274484818208792520243113824379110193356010059999642946040953102866271737127640405568982049887176990990501963784502429481034227543991366980671390566584211881030995602076468001,
+                 163564135568104310461344551909369650951960301778977149705601170951529791054750122905880591964737953456660497440730575925978769763154927541340839715938951226089095007207042122512586007411328664679011914120351043948122025612160733403945093961374276707993674792189646478659304624413958625254578122842556295400709,
+                 161179405627326572739107057023381254841260287988433675196680483761672455172873134522398837271764104320975746111042211695289319249471386600030523328069395763313848583139553961129874895374324504709512019736703349829576024049432816885712623938437949550266365056310544300920756181033500610331519029869549723159637,
+                 115457036871603042678596154288966812436677860079277988027483179495197499568058910286503947269226790675289762899339230065396778656344654735064122152427494983121714122734382674714766593466820233891067233496718383963380253373289929461608301619793607087995535147427985749641862087821617853120878674947686796753441,
+                 142217122612346975946270932667689342506994371754500301644129838613240401623123353990351915239791856753802128921507833848784693455415929352968108818884760967629866396887841730408713142977345151214275311532385308673155315337734838428569962298621720191411498579097539089047726042088382891468987379296661520434973,
+                 40624877259097915043489529504071755460170951428490878553842519165800720914888257733191322215286203357356050737713125202129282154441426952501134581314792133018830748896123382106683994268028624341502298766844710276939303555637478596035491641473828661569958212421472263269629366559343208764012473880251174832392,
+ asn1_NOVALUE};
+hardcode_rsa_key(6) -> 
+{'RSAPrivateKey',0,
+                 22748888494866396715768692484866595111939200209856056370972713870125588774286266397044592487895293134537316190976192161177144143633669641697309689280475257429554879273045671863645233402796222694405634510241820106743648116753479926387434021380537483429927516962909367257212902212159798399531316965145618774905828756510318897899298783143203190245236381440043169622358239226123652592179006905016804587837199618842875361941208299410035232803124113612082221121192550063791073372276763648926636149384299189072950588522522800393261949880796214514243704858378436010975184294077063518776479282353562934591448646412389762167039,
+                 17,
+                 6690849557313646092873144848490175032923294179369428344403739373566349639495960705013115437616262686628622409110644753287395336362844012263914614494257428655751435080307550548130951000822418439531068973600535325512837681398082331290421770994275730420566916753796872722709677121223470117509210872101652580854566448661533030419787125312956120661097410038933324613372774190658239039998357548275441758790939430824924502690997433186652165055694361752689819209062683281242276039100201318203707142383491769671330743466041394101421674581185260900666085723130684175548215193875544802254923825103844262661010117443222587769713,
+                 164748737139489923768181260808494855987398781964531448608652166632780898215212977127034263859971474195908846263894581556691971503119888726148555271179103885786024920582830105413607436718060544856016793981261118694063993837665813285582095833772675610567592660039821387740255651489996976698808018635344299728063,
+                 138082323967104548254375818343885141517788525705334488282154811252858957969378263753268344088034079842223206527922445018725900110643394926788280539200323021781309918753249061620424428562366627334409266756720941754364262467100514166396917565961434203543659974860389803369482625510495464845206228470088664021953,
+                 19382204369351755737433089506881747763223386113474288071606137250915399790025056132592266336467232258342217207517009594904937823896457497193947678962247515974826461245038835931012639613889475865413740468383661022831058098548919210068481862796785365949128548239978986792971253116470232552800943368864035262125,
+                 48734937870742781736838524121371226418043009072470995864289933383361985165662916618800592031070851709019955245149098241903258862580021738866451955011878713569874088971734962924855680669070574353320917678842685325069739694270769705787147376221682660074232932303666989424523279591939575827719845342384234360689,
+                 81173034184183681160439870161505779100040258708276674532866007896310418779840630960490793104541748007902477778658270784073595697910785917474138815202903114440800310078464142273778315781957021015333260021813037604142367434117205299831740956310682461174553260184078272196958146289378701001596552915990080834227,
+                 asn1_NOVALUE}.
+
+
 dtls_hello() ->
     [1,
      <<0,1,4>>,
diff --git a/lib/ssl/test/ssl_to_openssl_SUITE.erl b/lib/ssl/test/ssl_to_openssl_SUITE.erl
index 48fd2b7eab..60faad3fe1 100644
--- a/lib/ssl/test/ssl_to_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_to_openssl_SUITE.erl
@@ -984,8 +984,6 @@ ssl2_erlang_server_openssl_client(Config) when is_list(Config) ->
 
     {_, ServerNode, _} = ssl_test_lib:run_where(Config),
     
-    Data = "From openssl to erlang",
-
     Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0}, 
 					      {from, self()}, 
 					      {options, ServerOpts}]),
@@ -996,7 +994,6 @@ ssl2_erlang_server_openssl_client(Config) when is_list(Config) ->
 	"-ssl2", "-msg"],
     
     OpenSslPort = ssl_test_lib:portable_open_port(Exe, Args),  
-    true = port_command(OpenSslPort, Data),
     
     ct:log("Ports ~p~n", [[erlang:port_info(P) || P <- erlang:ports()]]), 
     consume_port_exit(OpenSslPort),
diff --git a/lib/ssl/test/x509_test.erl b/lib/ssl/test/x509_test.erl
index 5cd5c8eca7..13f8dfdaa9 100644
--- a/lib/ssl/test/x509_test.erl
+++ b/lib/ssl/test/x509_test.erl
@@ -20,36 +20,36 @@
 
 %%
 
--module(x509_test).
+ -module(x509_test).
 
--include_lib("public_key/include/public_key.hrl").
+ -include_lib("public_key/include/public_key.hrl").
 
--export([gen_test_certs/1, gen_pem_config_files/4]).
+ -export([gen_test_certs/1, gen_pem_config_files/3]).
 
-gen_test_certs(Opts) ->
-    SRootKey = gen_key(proplists:get_value(server_key_gen, Opts)),
-    CRootKey = gen_key(proplists:get_value(client_key_gen, Opts)),
-    ServerRoot = root_cert("server", SRootKey, Opts),
-    ClientRoot = root_cert("client", CRootKey, Opts),
-    [{ServerCert, ServerKey} | ServerCAsKeys] = config(server, ServerRoot, SRootKey, Opts),
-    [{ClientCert, ClientKey} | ClientCAsKeys] = config(client, ClientRoot, CRootKey, Opts),
-    ServerCAs = ca_config(ClientRoot, ServerCAsKeys),
-    ClientCAs = ca_config(ServerRoot, ClientCAsKeys),
-    [{server_config, [{cert, ServerCert}, {key, ServerKey}, {cacerts, ServerCAs}]}, 
-     {client_config, [{cert, ClientCert}, {key, ClientKey}, {cacerts, ClientCAs}]}].
+ gen_test_certs(Opts) ->
+     SRootKey = gen_key(proplists:get_value(server_key_gen, Opts)),
+     CRootKey = gen_key(proplists:get_value(client_key_gen, Opts)),
+     ServerRoot = root_cert("server", SRootKey, Opts),
+     ClientRoot = root_cert("client", CRootKey, Opts),
+     [{ServerCert, ServerKey} | ServerCAsKeys] = config(server, ServerRoot, SRootKey, Opts),
+     [{ClientCert, ClientKey} | ClientCAsKeys] = config(client, ClientRoot, CRootKey, Opts),
+     ServerCAs = ca_config(ClientRoot, ServerCAsKeys),
+     ClientCAs = ca_config(ServerRoot, ClientCAsKeys),
+     [{server_config, [{cert, ServerCert}, {key, ServerKey}, {cacerts, ServerCAs}]}, 
+      {client_config, [{cert, ClientCert}, {key, ClientKey}, {cacerts, ClientCAs}]}].
 
-gen_pem_config_files(GenCertData, CertFileBase, KeyFileBase, CAFileBase) ->
+gen_pem_config_files(GenCertData, ClientBase, ServerBase) ->
     ServerConf = proplists:get_value(server_config, GenCertData),
     ClientConf = proplists:get_value(client_config, GenCertData),
     
-    ServerCaCertFile = filename:join("server_", CAFileBase),
-    ServerCertFile = filename:join("server_", CertFileBase),
-    ServerKeyFile = filename:join("server_", KeyFileBase),
-    
-    ClientCaCertFile = filename:join("client_", CAFileBase),
-    ClientCertFile = filename:join("client_", CertFileBase),
-    ClientKeyFile = filename:join("client_", KeyFileBase),
+    ServerCaCertFile = ServerBase ++ "_server_cacerts.pem",
+    ServerCertFile = ServerBase ++ "_server_cert.pem",
+    ServerKeyFile = ServerBase ++ "_server_key.pem",
     
+    ClientCaCertFile = ClientBase ++ "_client_cacerts.pem",
+    ClientCertFile =  ClientBase ++ "_client_cert.pem",
+    ClientKeyFile = ClientBase ++ "_client_key.pem",
+
     do_gen_pem_config_files(ServerConf,
                             ServerCertFile,
                             ServerKeyFile,
@@ -58,59 +58,60 @@ gen_pem_config_files(GenCertData, CertFileBase, KeyFileBase, CAFileBase) ->
                             ClientCertFile,
                             ClientKeyFile,
                             ClientCaCertFile),
-    [{server_config, [{certfile, ServerCertFile}, {keyfile, ServerKeyFile}, {cacertfile, ServerCaCertFile}]}, 
-     {client_config, [{certfile, ClientCertFile}, {keyfile, ClientKeyFile}, {cacertfile, ClientCaCertFile}]}].
+    [{server_config, [{certfile, ServerCertFile}, 
+                      {keyfile, ServerKeyFile}, {cacertfile, ServerCaCertFile}]}, 
+     {client_config, [{certfile, ClientCertFile}, 
+                      {keyfile, ClientKeyFile}, {cacertfile, ClientCaCertFile}]}].
 
-    
-do_gen_pem_config_files(Config, CertFile, KeyFile, CAFile) ->
-    CAs = proplists:get_value(cacerts, Config),
-    Cert = proplists:get_value(cert, Config),
-    Key = proplists:get_value(key, Config),
-    der_to_pem(CertFile, [cert_entry(Cert)]),
-    der_to_pem(KeyFile, [key_entry(Key)]),
-    der_to_pem(CAFile, ca_entries(CAs)).
-   
-cert_entry(Cert) ->
-    {'Certificate', Cert, not_encrypted}.
-
-key_entry(Key = #'RSAPrivateKey'{}) ->
-    Der = public_key:der_encode('RSAPrivateKey', Key),
-    {'RSAPrivateKey', Der, not_encrypted};
-key_entry(Key = #'DSAPrivateKey'{}) ->
-    Der =  public_key:der_encode('DSAPrivateKey', Key),
-    {'DSAPrivateKey', Der, not_encrypted};
-key_entry(Key = #'ECPrivateKey'{}) ->
-    Der =  public_key:der_encode('ECPrivateKey', Key),
-    {'ECPrivateKey', Der, not_encrypted}.
-
-ca_entries(CAs) ->
-    [{'Certificate', CACert, not_encrypted} || CACert <- CAs].
-
-gen_key(KeyGen) ->
-    case is_key(KeyGen) of
-        true ->
-            KeyGen;
-        false ->
-            public_key:generate_key(KeyGen)
-    end.
 
-root_cert(Role, PrivKey, Opts) ->
-    TBS = cert_template(),
-    Issuer = issuer("root", Role, " ROOT CA"),
-    OTPTBS = TBS#'OTPTBSCertificate'{
-               signature = sign_algorithm(PrivKey, Opts),
-               issuer = Issuer,
-               validity = validity(Opts),  
-               subject = Issuer,
-               subjectPublicKeyInfo = public_key(PrivKey),
-               extensions = extensions(Opts)
-              },
-    public_key:pkix_sign(OTPTBS, PrivKey).
+ do_gen_pem_config_files(Config, CertFile, KeyFile, CAFile) ->
+     CAs = proplists:get_value(cacerts, Config),
+     Cert = proplists:get_value(cert, Config),
+     Key = proplists:get_value(key, Config),
+     der_to_pem(CertFile, [cert_entry(Cert)]),
+     der_to_pem(KeyFile, [key_entry(Key)]),
+     der_to_pem(CAFile, ca_entries(CAs)).
+
+ cert_entry(Cert) ->
+     {'Certificate', Cert, not_encrypted}.
+
+ key_entry(Key = #'RSAPrivateKey'{}) ->
+     Der = public_key:der_encode('RSAPrivateKey', Key),
+     {'RSAPrivateKey', Der, not_encrypted};
+ key_entry(Key = #'DSAPrivateKey'{}) ->
+     Der =  public_key:der_encode('DSAPrivateKey', Key),
+     {'DSAPrivateKey', Der, not_encrypted};
+ key_entry(Key = #'ECPrivateKey'{}) ->
+     Der =  public_key:der_encode('ECPrivateKey', Key),
+     {'ECPrivateKey', Der, not_encrypted}.
+
+ ca_entries(CAs) ->
+     [{'Certificate', CACert, not_encrypted} || CACert <- CAs].
+
+ gen_key(KeyGen) ->
+     case is_key(KeyGen) of
+         true ->
+             KeyGen;
+         false ->
+             public_key:generate_key(KeyGen)
+     end.
+
+ root_cert(Role, PrivKey, Opts) ->
+     TBS = cert_template(),
+     Issuer = issuer("root", Role, " ROOT CA"),
+     OTPTBS = TBS#'OTPTBSCertificate'{
+                signature = sign_algorithm(PrivKey, Opts),
+                issuer = Issuer,
+                validity = validity(Opts),  
+                subject = Issuer,
+                subjectPublicKeyInfo = public_key(PrivKey),
+                extensions = extensions(Opts)
+               },
+     public_key:pkix_sign(OTPTBS, PrivKey).
 
 config(Role, Root, Key, Opts) ->
-    KeyGenOpt = list_to_atom(atom_to_list(Role) ++ "key_gen_chain"),
-    KeyGens = proplists:get_value(KeyGenOpt, Opts, [{namedCurve, hd(tls_v1:ecc_curves(0))}, 
-                                                    {namedCurve, hd(tls_v1:ecc_curves(0))}]),
+    KeyGenOpt = list_to_atom(atom_to_list(Role) ++ "_key_gen_chain"),
+    KeyGens = proplists:get_value(KeyGenOpt, Opts, default_key_gen()),
     Keys = lists:map(fun gen_key/1, KeyGens),
     cert_chain(Role, Root, Key, Opts, Keys).
 
@@ -276,7 +277,8 @@ cert_chain(Role, Root, RootKey, Opts, Keys) ->
     cert_chain(Role, Root, RootKey, Opts, Keys, 0, []).
 
 cert_chain(Role, IssuerCert, IssuerKey, Opts, [Key], _, Acc) ->
-    Cert = cert(Role, public_key:pkix_decode_cert(IssuerCert, otp), IssuerKey, Key, "admin", " Peer cert", Opts),
+    Cert = cert(Role, public_key:pkix_decode_cert(IssuerCert, otp), 
+                IssuerKey, Key, "admin", " Peer cert", Opts),
     [{Cert, Key}, {IssuerCert, IssuerKey} | Acc];
 cert_chain(Role, IssuerCert, IssuerKey, Opts, [Key | Keys], N, Acc) ->
     Cert = cert(Role, public_key:pkix_decode_cert(IssuerCert, otp), IssuerKey, Key, "webadmin", 
@@ -308,3 +310,12 @@ is_key(_) ->
 der_to_pem(File, Entries) ->
     PemBin = public_key:pem_encode(Entries),
     file:write_file(File, PemBin).
+
+default_key_gen() ->
+    case tls_v1:ecc_curves(0) of
+        [] ->
+            [{rsa, 2048, 17}, {rsa, 2048, 17}];
+        [_|_] ->
+            [{namedCurve, hd(tls_v1:ecc_curves(0))},
+             {namedCurve, hd(tls_v1:ecc_curves(0))}]
+    end.