Merge branch 'lars/crypto/load-engine/OTP-14567' into maint

* lars/crypto/load-engine/OTP-14567:
  [crypto] Add support for loading an alternative Engine

12 files changed, 1782 insertions, 109 deletions

diff --git a/lib/crypto/c_src/Makefile.in b/lib/crypto/c_src/Makefile.in
index af7c209c75..31124ba477 100644
--- a/lib/crypto/c_src/Makefile.in
+++ b/lib/crypto/c_src/Makefile.in
@@ -1,7 +1,7 @@
 #
 # %CopyrightBegin%
 #
-# Copyright Ericsson AB 1999-2016. All Rights Reserved.
+# Copyright Ericsson AB 1999-2017. All Rights Reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -78,12 +78,16 @@ CRYPTO_STATIC_OBJS = $(OBJDIR)/crypto_static$(TYPEMARKER).o\
 
 NIF_ARCHIVE = $(LIBDIR)/crypto$(TYPEMARKER).a
 
+TEST_ENGINE_OBJS = $(OBJDIR)/otp_test_engine$(TYPEMARKER).o
+
 ifeq ($(findstring win32,$(TARGET)), win32)
 NIF_LIB = $(LIBDIR)/crypto$(TYPEMARKER).dll
 CALLBACK_LIB = $(LIBDIR)/crypto_callback$(TYPEMARKER).dll
+TEST_ENGINE_LIB = $(LIBDIR)/otp_test_engine$(TYPEMARKER).dll
 else
 NIF_LIB = $(LIBDIR)/crypto$(TYPEMARKER).so
 CALLBACK_LIB = $(LIBDIR)/crypto_callback$(TYPEMARKER).so
+TEST_ENGINE_LIB = $(LIBDIR)/otp_test_engine$(TYPEMARKER).so
 endif
 
 ifeq ($(HOST_OS),)
@@ -129,10 +133,22 @@ ALL_STATIC_CFLAGS = $(DED_STATIC_CFLAGS) $(INCLUDES)
 
 _create_dirs := $(shell mkdir -p $(OBJDIR) $(LIBDIR))
 
-debug opt valgrind: $(NIF_LIB) $(CALLBACK_LIB)
+debug opt valgrind: $(NIF_LIB) $(CALLBACK_LIB) $(TEST_ENGINE_LIB) 
 
 static_lib: $(NIF_ARCHIVE)
 
+$(OBJDIR)/otp_test_engine$(TYPEMARKER).o: otp_test_engine.c
+	$(V_at)$(INSTALL_DIR) $(OBJDIR)
+	$(V_CC) -c -o $@ $(ALL_CFLAGS) $<
+
+$(LIBDIR)/otp_test_engine$(TYPEMARKER).so: $(TEST_ENGINE_OBJS)
+	$(V_at)$(INSTALL_DIR) $(LIBDIR)
+	$(V_LD) $(LDFLAGS) -o $@ $^ $(LDLIBS) $(CRYPTO_LINK_LIB)
+
+$(LIBDIR)/otp_test_engine$(TYPEMARKER).dll: $(TEST_ENGINE_OBJS)
+	$(V_at)$(INSTALL_DIR) $(LIBDIR)
+	$(V_LD) $(LDFLAGS) -o $@  $(SSL_DED_LD_RUNTIME_LIBRARY_PATH) -L$(SSL_LIBDIR) $(TEST_ENGINE_OBJS) -l$(SSL_CRYPTO_LIBNAME) -l$(SSL_SSL_LIBNAME)
+
 $(OBJDIR)/%$(TYPEMARKER).o: %.c
 	$(V_at)$(INSTALL_DIR) $(OBJDIR)
 	$(V_CC) -c -o $@ $(ALL_CFLAGS) $<
@@ -170,6 +186,7 @@ ifeq ($(findstring win32,$(TARGET)), win32)
 	rm -f $(LIBDIR)/crypto.debug.dll
 	rm -f $(LIBDIR)/crypto_callback.dll
 	rm -f $(LIBDIR)/crypto_callback.debug.dll
+	rm -f $(LIBDIR)/otp_test_engine.dll
 else
 	rm -f $(LIBDIR)/crypto.so
 	rm -f $(LIBDIR)/crypto.debug.so
@@ -177,6 +194,7 @@ else
 	rm -f $(LIBDIR)/crypto_callback.so
 	rm -f $(LIBDIR)/crypto_callback.debug.so
 	rm -f $(LIBDIR)/crypto_callback.valgrind.so
+	rm -f $(LIBDIR)/otp_test_engine.so
 endif
 	rm -f $(OBJDIR)/crypto.o
 	rm -f $(OBJDIR)/crypto_static.o
@@ -187,6 +205,7 @@ endif
 	rm -f $(OBJDIR)/crypto_callback.o
 	rm -f $(OBJDIR)/crypto_callback.debug.o
 	rm -f $(OBJDIR)/crypto_callback.valgrind.o
+	rm -f $(OBJDIR)/otp_test_engine.o
 	rm -f core *~
 
 docs:
@@ -206,6 +225,8 @@ ifeq ($(DYNAMIC_CRYPTO_LIB),yes)
 	$(INSTALL_PROGRAM) $(CALLBACK_OBJS) "$(RELSYSDIR)/priv/obj"
 	$(INSTALL_PROGRAM) $(CALLBACK_LIB) "$(RELSYSDIR)/priv/lib"
 endif
+	$(INSTALL_PROGRAM) $(TEST_ENGINE_OBJS) "$(RELSYSDIR)/priv/obj"
+	$(INSTALL_PROGRAM) $(TEST_ENGINE_LIB) "$(RELSYSDIR)/priv/lib"
 
 release_docs_spec:
 
diff --git a/lib/crypto/c_src/crypto.c b/lib/crypto/c_src/crypto.c
index c4e80e3153..0f07a862d2 100644
--- a/lib/crypto/c_src/crypto.c
+++ b/lib/crypto/c_src/crypto.c
@@ -1,4 +1,4 @@
-/* 
+/*
  * %CopyrightBegin%
  *
  * Copyright Ericsson AB 2010-2017. All Rights Reserved.
@@ -19,8 +19,8 @@
  */
 
 /*
- * Purpose:  Dynamically loadable NIF library for cryptography. 
- * Based on OpenSSL. 
+ * Purpose:  Dynamically loadable NIF library for cryptography.
+ * Based on OpenSSL.
  */
 
 #ifdef __WIN32__
@@ -60,6 +60,8 @@
 #include <openssl/rand.h>
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
+#include <openssl/engine.h>
+#include <openssl/err.h>
 
 /* Helper macro to construct a OPENSSL_VERSION_NUMBER.
  * See openssl/opensslv.h
@@ -79,9 +81,9 @@
  *
  * Therefor works tests like this as intendend:
  *     OPENSSL_VERSION_NUMBER >= PACKED_OPENSSL_VERSION_PLAIN(1,0,0)
- * (The test is for example "2.4.2" >= "1.0.0" although the test 
+ * (The test is for example "2.4.2" >= "1.0.0" although the test
  *  with the cloned OpenSSL test would be "1.0.1" >= "1.0.0")
- *     
+ *
  * But tests like this gives wrong result:
  *     OPENSSL_VERSION_NUMBER < PACKED_OPENSSL_VERSION_PLAIN(1,1,0)
  * (The test is false since "2.4.2" < "1.1.0".  It should have been
@@ -119,6 +121,10 @@
 #include <openssl/modes.h>
 #endif
 
+#if OPENSSL_VERSION_NUMBER >= PACKED_OPENSSL_VERSION(0,9,8,'h')
+#define HAS_ENGINE_SUPPORT
+#endif
+
 #include "crypto_callback.h"
 
 #if OPENSSL_VERSION_NUMBER >= PACKED_OPENSSL_VERSION_PLAIN(0,9,8)	\
@@ -240,7 +246,7 @@
 
 /* This shall correspond to the similar macro in crypto.erl */
 /* Current value is: erlang:system_info(context_reductions) * 10 */
-#define MAX_BYTES_TO_NIF 20000 
+#define MAX_BYTES_TO_NIF 20000
 
 #define CONSUME_REDS(NifEnv, Ibin)			\
 do {							\
@@ -466,6 +472,22 @@ static ERL_NIF_TERM aes_gcm_decrypt_NO_EVP(ErlNifEnv* env, int argc, const ERL_N
 static ERL_NIF_TERM chacha20_poly1305_encrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM chacha20_poly1305_decrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 
+static int get_engine_load_cmd_list(ErlNifEnv* env, const ERL_NIF_TERM term, char **cmds, int i);
+static ERL_NIF_TERM engine_by_id_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM engine_init_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM engine_finish_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM engine_free_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM engine_load_dynamic_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM engine_ctrl_cmd_strings_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM engine_register_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM engine_unregister_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM engine_add_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM engine_remove_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM engine_get_first_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM engine_get_next_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM engine_get_id_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM engine_get_all_methods_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+
 /* helpers */
 static void init_algorithms_types(ErlNifEnv*);
 static void init_digest_types(ErlNifEnv* env);
@@ -529,12 +551,27 @@ static ErlNifFunc nif_funcs[] = {
     {"aes_gcm_decrypt", 5, aes_gcm_decrypt},
 
     {"chacha20_poly1305_encrypt", 4, chacha20_poly1305_encrypt},
-    {"chacha20_poly1305_decrypt", 5, chacha20_poly1305_decrypt}
+    {"chacha20_poly1305_decrypt", 5, chacha20_poly1305_decrypt},
+
+    {"engine_by_id_nif", 1, engine_by_id_nif},
+    {"engine_init_nif", 1, engine_init_nif},
+    {"engine_finish_nif", 1, engine_finish_nif},
+    {"engine_free_nif", 1, engine_free_nif},
+    {"engine_load_dynamic_nif", 0, engine_load_dynamic_nif},
+    {"engine_ctrl_cmd_strings_nif", 2, engine_ctrl_cmd_strings_nif},
+    {"engine_register_nif", 2, engine_register_nif},
+    {"engine_unregister_nif", 2, engine_unregister_nif},
+    {"engine_add_nif", 1, engine_add_nif},
+    {"engine_remove_nif", 1, engine_remove_nif},
+    {"engine_get_first_nif", 0, engine_get_first_nif},
+    {"engine_get_next_nif", 1, engine_get_next_nif},
+    {"engine_get_id_nif", 1, engine_get_id_nif},
+    {"engine_get_all_methods_nif", 0, engine_get_all_methods_nif}
+
 };
 
 ERL_NIF_INIT(crypto,nif_funcs,load,NULL,upgrade,unload)
 
-
 #define MD5_CTX_LEN       (sizeof(MD5_CTX))
 #define MD4_CTX_LEN       (sizeof(MD4_CTX))
 #define RIPEMD160_CTX_LEN (sizeof(RIPEMD160_CTX))
@@ -603,8 +640,30 @@ static ERL_NIF_TERM atom_sha512;
 static ERL_NIF_TERM atom_md5;
 static ERL_NIF_TERM atom_ripemd160;
 
-
-
+#ifdef HAS_ENGINE_SUPPORT
+static ERL_NIF_TERM atom_bad_engine;
+static ERL_NIF_TERM atom_bad_engine_method;
+static ERL_NIF_TERM atom_bad_engine_id;
+static ERL_NIF_TERM atom_ctrl_cmd_failed;
+static ERL_NIF_TERM atom_engine_init_failed;
+static ERL_NIF_TERM atom_register_engine_failed;
+static ERL_NIF_TERM atom_add_engine_failed;
+static ERL_NIF_TERM atom_remove_engine_failed;
+static ERL_NIF_TERM atom_engine_method_not_supported;
+
+static ERL_NIF_TERM atom_engine_method_rsa;
+static ERL_NIF_TERM atom_engine_method_dsa;
+static ERL_NIF_TERM atom_engine_method_dh;
+static ERL_NIF_TERM atom_engine_method_rand;
+static ERL_NIF_TERM atom_engine_method_ecdh;
+static ERL_NIF_TERM atom_engine_method_ecdsa;
+static ERL_NIF_TERM atom_engine_method_ciphers;
+static ERL_NIF_TERM atom_engine_method_digests;
+static ERL_NIF_TERM atom_engine_method_store;
+static ERL_NIF_TERM atom_engine_method_pkey_meths;
+static ERL_NIF_TERM atom_engine_method_pkey_asn1_meths;
+static ERL_NIF_TERM atom_engine_method_ec;
+#endif
 static ErlNifResourceType* hmac_context_rtype;
 struct hmac_context
 {
@@ -728,11 +787,13 @@ static struct cipher_type_t cipher_types[] =
 
 static struct cipher_type_t* get_cipher_type(ERL_NIF_TERM type, size_t key_len);
 
+
 /*
 #define PRINTF_ERR0(FMT) enif_fprintf(stderr, FMT "\n")
 #define PRINTF_ERR1(FMT, A1) enif_fprintf(stderr, FMT "\n", A1)
 #define PRINTF_ERR2(FMT, A1, A2) enif_fprintf(stderr, FMT "\n", A1, A2)
 */
+
 #define PRINTF_ERR0(FMT)
 #define PRINTF_ERR1(FMT,A1)
 #define PRINTF_ERR2(FMT,A1,A2)
@@ -758,6 +819,23 @@ static void evp_cipher_ctx_dtor(ErlNifEnv* env, struct evp_cipher_ctx* ctx) {
 }
 #endif
 
+// Engine
+#ifdef HAS_ENGINE_SUPPORT
+static ErlNifResourceType* engine_ctx_rtype;
+struct engine_ctx {
+    ENGINE *engine;
+    char *id;
+};
+static void engine_ctx_dtor(ErlNifEnv* env, struct engine_ctx* ctx) {
+    PRINTF_ERR0("engine_ctx_dtor");
+    if(ctx->id) {
+        PRINTF_ERR1("  non empty ctx->id=%s", ctx->id);
+        enif_free(ctx->id);
+    } else
+         PRINTF_ERR0("  empty ctx->id=NULL");
+}
+#endif
+
 static int verify_lib_version(void)
 {
     const unsigned long libv = SSLeay();
@@ -793,7 +871,7 @@ static char crypto_callback_name[] = "crypto_callback";
 static int change_basename(ErlNifBinary* bin, char* buf, int bufsz, const char* newfile)
 {
     int i;
-    
+
     for (i = bin->size; i > 0; i--) {
 	if (bin->data[i-1] == '/')
 	    break;
@@ -869,12 +947,23 @@ static int initialize(ErlNifEnv* env, ERL_NIF_TERM load_info)
         return __LINE__;
     }
 #endif
+#ifdef HAS_ENGINE_SUPPORT
+    engine_ctx_rtype = enif_open_resource_type(env, NULL, "ENGINE_CTX",
+                                                   (ErlNifResourceDtor*) engine_ctx_dtor,
+                                                   ERL_NIF_RT_CREATE|ERL_NIF_RT_TAKEOVER,
+                                                   NULL);
+    if (!engine_ctx_rtype) {
+        PRINTF_ERR0("CRYPTO: Could not open resource type 'ENGINE_CTX'");
+        return __LINE__;
+    }
+
     if (library_refc > 0) {
 	/* Repeated loading of this library (module upgrade).
 	 * Atoms and callbacks are already set, we are done.
 	 */
 	return 0;
     }
+#endif 
 
     atom_true  = enif_make_atom(env,"true");
     atom_false = enif_make_atom(env,"false");
@@ -952,6 +1041,30 @@ static int initialize(ErlNifEnv* env, ERL_NIF_TERM load_info)
     atom_md5 = enif_make_atom(env,"md5");
     atom_ripemd160 = enif_make_atom(env,"ripemd160");
 
+#ifdef HAS_ENGINE_SUPPORT
+    atom_bad_engine = enif_make_atom(env,"bad_engine");
+    atom_bad_engine_method = enif_make_atom(env,"bad_engine_method");
+    atom_bad_engine_id = enif_make_atom(env,"bad_engine_id");
+    atom_ctrl_cmd_failed = enif_make_atom(env,"ctrl_cmd_failed");
+    atom_engine_init_failed = enif_make_atom(env,"engine_init_failed");
+    atom_engine_method_not_supported = enif_make_atom(env,"engine_method_not_supported");
+    atom_add_engine_failed = enif_make_atom(env,"add_engine_failed");
+    atom_remove_engine_failed = enif_make_atom(env,"remove_engine_failed");
+
+    atom_engine_method_rsa = enif_make_atom(env,"engine_method_rsa");
+    atom_engine_method_dsa = enif_make_atom(env,"engine_method_dsa");
+    atom_engine_method_dh = enif_make_atom(env,"engine_method_dh");
+    atom_engine_method_rand = enif_make_atom(env,"engine_method_rand");
+    atom_engine_method_ecdh = enif_make_atom(env,"engine_method_ecdh");
+    atom_engine_method_ecdsa = enif_make_atom(env,"engine_method_ecdsa");
+    atom_engine_method_store = enif_make_atom(env,"engine_method_store");
+    atom_engine_method_ciphers = enif_make_atom(env,"engine_method_ciphers");
+    atom_engine_method_digests = enif_make_atom(env,"engine_method_digests");
+    atom_engine_method_pkey_meths = enif_make_atom(env,"engine_method_pkey_meths");
+    atom_engine_method_pkey_asn1_meths = enif_make_atom(env,"engine_method_pkey_asn1_meths");
+    atom_engine_method_ec = enif_make_atom(env,"engine_method_ec");
+#endif
+
     init_digest_types(env);
     init_cipher_types(env);
     init_algorithms_types(env);
@@ -973,24 +1086,24 @@ static int initialize(ErlNifEnv* env, ERL_NIF_TERM load_info)
 #else /* !HAVE_DYNAMIC_CRYPTO_LIB */
     funcp = &get_crypto_callbacks;
 #endif
-    
+
 #ifdef OPENSSL_THREADS
     enif_system_info(&sys_info, sizeof(sys_info));
     if (sys_info.scheduler_threads > 1) {
-	nlocks = CRYPTO_num_locks(); 
+	nlocks = CRYPTO_num_locks();
     }
     /* else no need for locks */
 #endif
-    
+
     ccb = (*funcp)(nlocks);
-    
+
     if (!ccb || ccb->sizeof_me != sizeof(*ccb)) {
 	PRINTF_ERR0("Invalid 'crypto_callbacks'");
 	return __LINE__;
     }
-    
+
     CRYPTO_set_mem_functions(ccb->crypto_alloc, ccb->crypto_realloc, ccb->crypto_free);
-    
+
 #ifdef OPENSSL_THREADS
     if (nlocks > 0) {
 	CRYPTO_set_locking_callback(ccb->locking_function);
@@ -1186,11 +1299,11 @@ static ERL_NIF_TERM info_lib(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]
      * Version string is still from library though.
      */
 
-    memcpy(enif_make_new_binary(env, name_sz, &name_term), libname, name_sz);    
+    memcpy(enif_make_new_binary(env, name_sz, &name_term), libname, name_sz);
     memcpy(enif_make_new_binary(env, ver_sz, &ver_term), ver, ver_sz);
 
     return enif_make_list1(env, enif_make_tuple3(env, name_term,
-						 enif_make_int(env, ver_num),						 
+						 enif_make_int(env, ver_num),
 						 ver_term));
 }
 
@@ -1225,6 +1338,8 @@ static ERL_NIF_TERM enable_fips_mode(ErlNifEnv* env, int argc, const ERL_NIF_TER
     }
 }
 
+
+#if defined(HAVE_EC)
 static ERL_NIF_TERM make_badarg_maybe(ErlNifEnv* env)
 {
     ERL_NIF_TERM reason;
@@ -1233,6 +1348,7 @@ static ERL_NIF_TERM make_badarg_maybe(ErlNifEnv* env)
     else
 	return enif_make_badarg(env);
 }
+#endif
 
 static ERL_NIF_TERM hash_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {/* (Type, Data) */
@@ -1668,7 +1784,7 @@ static ERL_NIF_TERM hmac_update_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM
 {/* (Context, Data) */
     ErlNifBinary data;
     struct hmac_context* obj;
-    
+
     if (!enif_get_resource(env, argv[0], hmac_context_rtype, (void**)&obj)
 	|| !enif_inspect_iolist_as_binary(env, argv[1], &data)) {
 	return enif_make_badarg(env);
@@ -1704,13 +1820,13 @@ static ERL_NIF_TERM hmac_final_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM
 	enif_mutex_unlock(obj->mtx);
 	return enif_make_badarg(env);
     }
-    
+
     HMAC_Final(obj->ctx, mac_buf, &mac_len);
     HMAC_CTX_free(obj->ctx);
     obj->alive = 0;
     enif_mutex_unlock(obj->mtx);
 
-    if (argc == 2 && req_len < mac_len) { 
+    if (argc == 2 && req_len < mac_len) {
         /* Only truncate to req_len bytes if asked. */
         mac_len = req_len;
     }
@@ -2021,7 +2137,7 @@ static ERL_NIF_TERM aes_ctr_stream_init(ErlNifEnv* env, int argc, const ERL_NIF_
 }
 
 static ERL_NIF_TERM aes_ctr_stream_encrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
-{/* ({Key, IVec, ECount, Num}, Data) */    
+{/* ({Key, IVec, ECount, Num}, Data) */
     ErlNifBinary key_bin, ivec_bin, text_bin, ecount_bin;
     AES_KEY aes_key;
     unsigned int num;
@@ -2042,14 +2158,14 @@ static ERL_NIF_TERM aes_ctr_stream_encrypt(ErlNifEnv* env, int argc, const ERL_N
         return enif_make_badarg(env);
     }
 
-    ivec2_buf = enif_make_new_binary(env, ivec_bin.size, &ivec2_term); 
+    ivec2_buf = enif_make_new_binary(env, ivec_bin.size, &ivec2_term);
     ecount2_buf = enif_make_new_binary(env, ecount_bin.size, &ecount2_term);
-    
+
     memcpy(ivec2_buf, ivec_bin.data, 16);
     memcpy(ecount2_buf, ecount_bin.data, ecount_bin.size);
 
     AES_ctr128_encrypt((unsigned char *) text_bin.data,
-		       enif_make_new_binary(env, text_bin.size, &cipher_term), 
+		       enif_make_new_binary(env, text_bin.size, &cipher_term),
 		       text_bin.size, &aes_key, ivec2_buf, ecount2_buf, &num);
 
     num2_term = enif_make_uint(env, num);
@@ -2352,7 +2468,7 @@ out_err:
 }
 
 static ERL_NIF_TERM strong_rand_bytes_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
-{/* (Bytes) */     
+{/* (Bytes) */
     unsigned bytes;
     unsigned char* data;
     ERL_NIF_TERM ret;
@@ -2446,7 +2562,7 @@ static ERL_NIF_TERM rand_uniform_nif(ErlNifEnv* env, int argc, const ERL_NIF_TER
 
     bn_to = BN_new();
     BN_sub(bn_to, bn_rand, bn_from);
-    BN_pseudo_rand_range(bn_rand, bn_to);      
+    BN_pseudo_rand_range(bn_rand, bn_to);
     BN_add(bn_rand, bn_rand, bn_from);
     dlen = BN_num_bytes(bn_rand);
     data = enif_make_new_binary(env, dlen+4, &ret);
@@ -2464,7 +2580,7 @@ static ERL_NIF_TERM mod_exp_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM arg
     BIGNUM *bn_base=NULL, *bn_exponent=NULL, *bn_modulo=NULL, *bn_result;
     BN_CTX *bn_ctx;
     unsigned char* ptr;
-    unsigned dlen;      
+    unsigned dlen;
     unsigned bin_hdr; /* return type: 0=plain binary, 4: mpint */
     unsigned extra_byte;
     ERL_NIF_TERM ret;
@@ -2485,7 +2601,7 @@ static ERL_NIF_TERM mod_exp_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM arg
     dlen = BN_num_bytes(bn_result);
     extra_byte = bin_hdr && BN_is_bit_set(bn_result, dlen*8-1);
     ptr = enif_make_new_binary(env, bin_hdr+extra_byte+dlen, &ret);
-    if (bin_hdr) {	
+    if (bin_hdr) {
 	put_int32(ptr, extra_byte+dlen);
 	ptr[4] = 0; /* extra zeroed byte to ensure a positive mpint */
 	ptr += bin_hdr + extra_byte;
@@ -2545,6 +2661,7 @@ static struct cipher_type_t* get_cipher_type(ERL_NIF_TERM type, size_t key_len)
     return NULL;
 }
 
+
 static ERL_NIF_TERM do_exor(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {/* (Data1, Data2) */
     ErlNifBinary d1, d2;
@@ -2578,7 +2695,7 @@ static ERL_NIF_TERM rc4_set_key(ErlNifEnv* env, int argc, const ERL_NIF_TERM arg
 	return enif_make_badarg(env);
     }
     RC4_set_key((RC4_KEY*)enif_make_new_binary(env, sizeof(RC4_KEY), &ret),
-		key.size, key.data);        
+		key.size, key.data);
     return ret;
 #else
     return enif_raise_exception(env, atom_notsup);
@@ -2871,7 +2988,7 @@ static ERL_NIF_TERM dh_generate_parameters_nif(ErlNifEnv* env, int argc, const E
     BN_bn2bin(dh_g, g_ptr);
     ERL_VALGRIND_MAKE_MEM_DEFINED(p_ptr, p_len);
     ERL_VALGRIND_MAKE_MEM_DEFINED(g_ptr, g_len);
-    return enif_make_list2(env, ret_p, ret_g);    
+    return enif_make_list2(env, ret_p, ret_g);
 }
 
 static ERL_NIF_TERM dh_check(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
@@ -2881,9 +2998,9 @@ static ERL_NIF_TERM dh_check(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]
     ERL_NIF_TERM ret, head, tail;
     BIGNUM *dh_p, *dh_g;
 
-    if (!enif_get_list_cell(env, argv[0], &head, &tail)   
+    if (!enif_get_list_cell(env, argv[0], &head, &tail)
 	|| !get_bn_from_bin(env, head, &dh_p)
-	|| !enif_get_list_cell(env, tail, &head, &tail)   
+	|| !enif_get_list_cell(env, tail, &head, &tail)
 	|| !get_bn_from_bin(env, head, &dh_g)
 	|| !enif_is_empty_list(env,tail)) {
 
@@ -2900,12 +3017,12 @@ static ERL_NIF_TERM dh_check(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]
 	else if (i & DH_NOT_SUITABLE_GENERATOR)	ret = atom_not_suitable_generator;
 	else ret = enif_make_tuple2(env, atom_unknown, enif_make_uint(env, i));
     }
-    else { /* Check Failed */       
+    else { /* Check Failed */
 	ret = enif_make_tuple2(env, atom_error, atom_check_failed);
     }
     DH_free(dh_params);
     return ret;
-}   
+}
 
 static ERL_NIF_TERM dh_generate_key_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {/* (PrivKey|undefined, DHParams=[P,G], Mpint, Len|0) */
@@ -3007,7 +3124,7 @@ static ERL_NIF_TERM dh_compute_key_nif(ErlNifEnv* env, int argc, const ERL_NIF_T
 	i = DH_compute_key(ret_bin.data, other_pub_key, dh_params);
 	if (i > 0) {
 	    if (i != ret_bin.size) {
-		enif_realloc_binary(&ret_bin, i); 
+		enif_realloc_binary(&ret_bin, i);
 	    }
 	    ret = enif_make_binary(env, &ret_bin);
 	}
@@ -3965,7 +4082,7 @@ printf("\r\n");
     }
 
 #ifdef HAS_EVP_PKEY_CTX
-/* printf("EVP interface\r\n"); 
+/* printf("EVP interface\r\n");
  */
     ctx = EVP_PKEY_CTX_new(pkey, NULL);
     if (!ctx) goto badarg;
@@ -4095,7 +4212,7 @@ static ERL_NIF_TERM pkey_verify_nif(ErlNifEnv *env, int argc, const ERL_NIF_TERM
     }
 
 #ifdef HAS_EVP_PKEY_CTX
-/* printf("EVP interface\r\n"); 
+/* printf("EVP interface\r\n");
  */
     ctx = EVP_PKEY_CTX_new(pkey, NULL);
     if (!ctx) goto badarg;
@@ -4554,3 +4671,598 @@ static ERL_NIF_TERM rand_seed_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM a
     RAND_seed(seed_bin.data,seed_bin.size);
     return atom_ok;
 }
+
+/*================================================================*/
+/* Engine */
+/*================================================================*/
+static ERL_NIF_TERM engine_by_id_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (EngineId) */
+#ifdef HAS_ENGINE_SUPPORT
+    ERL_NIF_TERM ret;
+    ErlNifBinary engine_id_bin;
+    unsigned int engine_id_len = 0;
+    char *engine_id;
+    ENGINE *engine;
+    struct engine_ctx *ctx;
+
+    // Get Engine Id
+    if(!enif_inspect_binary(env, argv[0], &engine_id_bin)) {
+        PRINTF_ERR0("engine_by_id_nif Leaved: badarg");
+        return enif_make_badarg(env);
+    } else {
+        engine_id_len = engine_id_bin.size+1;
+        engine_id = enif_alloc(engine_id_len);
+        (void) memcpy(engine_id, engine_id_bin.data, engine_id_len);
+        engine_id[engine_id_len-1] = '\0';
+    }
+
+    engine = ENGINE_by_id(engine_id);
+    if(!engine) {
+        PRINTF_ERR0("engine_by_id_nif Leaved: {error, bad_engine_id}");
+        return enif_make_tuple2(env, atom_error, atom_bad_engine_id);
+    }
+
+    ctx = enif_alloc_resource(engine_ctx_rtype, sizeof(struct engine_ctx));
+    ctx->engine = engine;
+    ctx->id = engine_id;
+
+    ret = enif_make_resource(env, ctx);
+    enif_release_resource(ctx);
+
+    return enif_make_tuple2(env, atom_ok, ret);
+#else
+    return atom_notsup;
+#endif
+}
+
+static ERL_NIF_TERM engine_init_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (Engine) */
+#ifdef HAS_ENGINE_SUPPORT
+    ERL_NIF_TERM ret = atom_ok;
+    struct engine_ctx *ctx;
+
+    // Get Engine
+    if (!enif_get_resource(env, argv[0], engine_ctx_rtype, (void**)&ctx)) {
+        PRINTF_ERR0("engine_init_nif Leaved: Parameter not an engine resource object");
+        return enif_make_badarg(env);
+    }
+    if (!ENGINE_init(ctx->engine)) {
+        //ERR_print_errors_fp(stderr);
+        PRINTF_ERR0("engine_init_nif Leaved: {error, engine_init_failed}");
+        return enif_make_tuple2(env, atom_error, atom_engine_init_failed);
+    }
+
+    return ret;
+#else
+    return atom_notsup;
+#endif
+}
+
+static ERL_NIF_TERM engine_free_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (Engine) */
+#ifdef HAS_ENGINE_SUPPORT
+    struct engine_ctx *ctx;
+
+    // Get Engine
+    if (!enif_get_resource(env, argv[0], engine_ctx_rtype, (void**)&ctx)) {
+        PRINTF_ERR0("engine_free_nif Leaved: Parameter not an engine resource object");
+        return enif_make_badarg(env);
+    }
+
+    ENGINE_free(ctx->engine);
+    return atom_ok;
+#else
+    return atom_notsup;
+#endif
+}
+
+static ERL_NIF_TERM engine_finish_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (Engine) */
+#ifdef HAS_ENGINE_SUPPORT
+    struct engine_ctx *ctx;
+
+    // Get Engine
+    if (!enif_get_resource(env, argv[0], engine_ctx_rtype, (void**)&ctx)) {
+        PRINTF_ERR0("engine_finish_nif Leaved: Parameter not an engine resource object");
+        return enif_make_badarg(env);
+    }
+
+    ENGINE_finish(ctx->engine);
+    return atom_ok;
+#else
+    return atom_notsup;
+#endif
+}
+
+static ERL_NIF_TERM engine_load_dynamic_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* () */
+#ifdef HAS_ENGINE_SUPPORT
+    ENGINE_load_dynamic();
+    return atom_ok;
+#else
+    return atom_notsup;
+#endif
+}
+
+static ERL_NIF_TERM engine_ctrl_cmd_strings_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (Engine, Commands) */
+#ifdef HAS_ENGINE_SUPPORT
+    ERL_NIF_TERM ret = atom_ok;
+    unsigned int cmds_len = 0;
+    char **cmds = NULL;
+    struct engine_ctx *ctx;
+    int i;
+
+    // Get Engine
+    if (!enif_get_resource(env, argv[0], engine_ctx_rtype, (void**)&ctx)) {
+        PRINTF_ERR0("engine_ctrl_cmd_strings_nif Leaved: Parameter not an engine resource object");
+        return enif_make_badarg(env);
+    }
+
+    PRINTF_ERR1("Engine Id:  %s\r\n", ENGINE_get_id(ctx->engine));
+
+    // Get Command List
+    if(!enif_get_list_length(env, argv[1], &cmds_len)) {
+        PRINTF_ERR0("engine_ctrl_cmd_strings_nif Leaved: Bad Command List");
+        return enif_make_badarg(env);
+    } else {
+        cmds_len *= 2; // Key-Value list from erlang
+        cmds = enif_alloc((cmds_len+1)*sizeof(char*));
+        if(get_engine_load_cmd_list(env, argv[1], cmds, 0)) {
+            PRINTF_ERR0("engine_ctrl_cmd_strings_nif Leaved: Couldn't read Command List");
+            ret = enif_make_badarg(env);
+            goto error;
+        }
+    }
+
+    for(i = 0; i < cmds_len; i+=2) {
+        PRINTF_ERR2("Cmd:  %s:%s\r\n",
+                   cmds[i] ? cmds[i] : "(NULL)",
+                   cmds[i+1] ? cmds[i+1] : "(NULL)");
+        if(!ENGINE_ctrl_cmd_string(ctx->engine, cmds[i], cmds[i+1], 0)) {
+            PRINTF_ERR2("Command failed:  %s:%s\r\n",
+                        cmds[i] ? cmds[i] : "(NULL)",
+                        cmds[i+1] ? cmds[i+1] : "(NULL)");
+            //ENGINE_free(ctx->engine);
+            ret = enif_make_tuple2(env, atom_error, atom_ctrl_cmd_failed);
+            PRINTF_ERR0("engine_ctrl_cmd_strings_nif Leaved: {error, ctrl_cmd_failed}");
+            goto error;
+        }
+}
+
+ error:
+    for(i = 0; cmds != NULL && cmds[i] != NULL; i++)
+        enif_free(cmds[i]);
+    return ret;
+#else
+    return atom_notsup;
+#endif
+}
+
+static ERL_NIF_TERM engine_add_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (Engine) */
+#ifdef HAS_ENGINE_SUPPORT
+    struct engine_ctx *ctx;
+
+    // Get Engine
+    if (!enif_get_resource(env, argv[0], engine_ctx_rtype, (void**)&ctx)) {
+        PRINTF_ERR0("engine_add_nif Leaved: Parameter not an engine resource object");
+        return enif_make_badarg(env);
+    }
+
+    if (!ENGINE_add(ctx->engine)) {
+        PRINTF_ERR0("engine_add_nif Leaved: {error, add_engine_failed}");
+        return enif_make_tuple2(env, atom_error, atom_add_engine_failed);
+    }
+    return atom_ok;
+#else
+    return atom_notsup;
+#endif
+}
+
+static ERL_NIF_TERM engine_remove_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (Engine) */
+#ifdef HAS_ENGINE_SUPPORT
+    struct engine_ctx *ctx;
+
+    // Get Engine
+    if (!enif_get_resource(env, argv[0], engine_ctx_rtype, (void**)&ctx)) {
+        PRINTF_ERR0("engine_remove_nif Leaved: Parameter not an engine resource object");
+        return enif_make_badarg(env);
+    }
+
+    if (!ENGINE_remove(ctx->engine)) {
+        PRINTF_ERR0("engine_remove_nif Leaved: {error, remove_engine_failed}");
+        return enif_make_tuple2(env, atom_error, atom_remove_engine_failed);
+    }
+    return atom_ok;
+#else
+    return atom_notsup;
+#endif
+}
+
+static ERL_NIF_TERM engine_register_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (Engine, EngineMethod) */
+#ifdef HAS_ENGINE_SUPPORT
+    struct engine_ctx *ctx;
+    unsigned int method;
+
+    // Get Engine
+    if (!enif_get_resource(env, argv[0], engine_ctx_rtype, (void**)&ctx)) {
+        PRINTF_ERR0("engine_register_nif Leaved: Parameter not an engine resource object");
+        return enif_make_badarg(env);
+    }
+    // Get Method
+    if (!enif_get_uint(env, argv[1], &method)) {
+        PRINTF_ERR0("engine_register_nif Leaved: Parameter Method not an uint");
+        return enif_make_badarg(env);
+    }
+
+    switch(method)
+    {
+#ifdef ENGINE_METHOD_RSA
+    case ENGINE_METHOD_RSA:
+        if (!ENGINE_register_RSA(ctx->engine))
+            return enif_make_tuple2(env, atom_error, atom_register_engine_failed);
+        break;
+#endif
+#ifdef ENGINE_METHOD_DSA
+    case ENGINE_METHOD_DSA:
+        if (!ENGINE_register_DSA(ctx->engine))
+            return enif_make_tuple2(env, atom_error, atom_register_engine_failed);
+        break;
+#endif
+#ifdef ENGINE_METHOD_DH
+    case ENGINE_METHOD_DH:
+        if (!ENGINE_register_DH(ctx->engine))
+            return enif_make_tuple2(env, atom_error, atom_register_engine_failed);
+        break;
+#endif
+#ifdef ENGINE_METHOD_RAND
+    case ENGINE_METHOD_RAND:
+        if (!ENGINE_register_RAND(ctx->engine))
+            return enif_make_tuple2(env, atom_error, atom_register_engine_failed);
+        break;
+#endif
+#ifdef ENGINE_METHOD_ECDH
+    case ENGINE_METHOD_ECDH:
+        if (!ENGINE_register_ECDH(ctx->engine))
+            return enif_make_tuple2(env, atom_error, atom_register_engine_failed);
+        break;
+#endif
+#ifdef ENGINE_METHOD_ECDSA
+    case ENGINE_METHOD_ECDSA:
+        if (!ENGINE_register_ECDSA(ctx->engine))
+            return enif_make_tuple2(env, atom_error, atom_register_engine_failed);
+        break;
+#endif
+#ifdef ENGINE_METHOD_STORE
+    case ENGINE_METHOD_STORE:
+        if (!ENGINE_register_STORE(ctx->engine))
+            return enif_make_tuple2(env, atom_error, atom_register_engine_failed);
+        break;
+#endif
+#ifdef ENGINE_METHOD_CIPHERS
+    case ENGINE_METHOD_CIPHERS:
+        if (!ENGINE_register_ciphers(ctx->engine))
+            return enif_make_tuple2(env, atom_error, atom_register_engine_failed);
+        break;
+#endif
+#ifdef ENGINE_METHOD_DIGESTS
+    case ENGINE_METHOD_DIGESTS:
+        if (!ENGINE_register_digests(ctx->engine))
+            return enif_make_tuple2(env, atom_error, atom_register_engine_failed);
+        break;
+#endif
+#ifdef ENGINE_METHOD_PKEY_METHS
+    case ENGINE_METHOD_PKEY_METHS:
+        if (!ENGINE_register_pkey_meths(ctx->engine))
+            return enif_make_tuple2(env, atom_error, atom_register_engine_failed);
+        break;
+#endif
+#ifdef ENGINE_METHOD_PKEY_ASN1_METHS
+    case ENGINE_METHOD_PKEY_ASN1_METHS:
+        if (!ENGINE_register_pkey_asn1_meths(ctx->engine))
+            return enif_make_tuple2(env, atom_error, atom_register_engine_failed);
+        break;
+#endif
+#ifdef ENGINE_METHOD_EC
+    case ENGINE_METHOD_EC:
+        if (!ENGINE_register_EC(ctx->engine))
+            return enif_make_tuple2(env, atom_error, atom_register_engine_failed);
+        break;
+#endif
+    default:
+        return  enif_make_tuple2(env, atom_error, atom_engine_method_not_supported);
+        break;
+    }
+    return atom_ok;
+#else
+    return atom_notsup;
+#endif
+}
+
+static ERL_NIF_TERM engine_unregister_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (Engine, EngineMethod) */
+#ifdef HAS_ENGINE_SUPPORT
+    struct engine_ctx *ctx;
+    unsigned int method;
+
+    // Get Engine
+    if (!enif_get_resource(env, argv[0], engine_ctx_rtype, (void**)&ctx)) {
+        PRINTF_ERR0("engine_unregister_nif Leaved: Parameter not an engine resource object");
+        return enif_make_badarg(env);
+    }
+    // Get Method
+    if (!enif_get_uint(env, argv[1], &method)) {
+        PRINTF_ERR0("engine_unregister_nif Leaved: Parameter Method not an uint");
+        return enif_make_badarg(env);
+    }
+
+    switch(method)
+    {
+#ifdef ENGINE_METHOD_RSA
+    case ENGINE_METHOD_RSA:
+        ENGINE_unregister_RSA(ctx->engine);
+        break;
+#endif
+#ifdef ENGINE_METHOD_DSA
+    case ENGINE_METHOD_DSA:
+        ENGINE_unregister_DSA(ctx->engine);
+        break;
+#endif
+#ifdef ENGINE_METHOD_DH
+    case ENGINE_METHOD_DH:
+        ENGINE_unregister_DH(ctx->engine);
+        break;
+#endif
+#ifdef ENGINE_METHOD_RAND
+    case ENGINE_METHOD_RAND:
+        ENGINE_unregister_RAND(ctx->engine);
+        break;
+#endif
+#ifdef ENGINE_METHOD_ECDH
+    case ENGINE_METHOD_ECDH:
+        ENGINE_unregister_ECDH(ctx->engine);
+        break;
+#endif
+#ifdef ENGINE_METHOD_ECDSA
+    case ENGINE_METHOD_ECDSA:
+        ENGINE_unregister_ECDSA(ctx->engine);
+        break;
+#endif
+#ifdef ENGINE_METHOD_STORE
+    case ENGINE_METHOD_STORE:
+        ENGINE_unregister_STORE(ctx->engine);
+        break;
+#endif
+#ifdef ENGINE_METHOD_CIPHERS
+    case ENGINE_METHOD_CIPHERS:
+        ENGINE_unregister_ciphers(ctx->engine);
+        break;
+#endif
+#ifdef ENGINE_METHOD_DIGESTS
+    case ENGINE_METHOD_DIGESTS:
+        ENGINE_unregister_digests(ctx->engine);
+        break;
+#endif
+#ifdef ENGINE_METHOD_PKEY_METHS
+    case ENGINE_METHOD_PKEY_METHS:
+        ENGINE_unregister_pkey_meths(ctx->engine);
+        break;
+#endif
+#ifdef ENGINE_METHOD_PKEY_ASN1_METHS
+    case ENGINE_METHOD_PKEY_ASN1_METHS:
+        ENGINE_unregister_pkey_asn1_meths(ctx->engine);
+        break;
+#endif
+#ifdef ENGINE_METHOD_EC
+    case ENGINE_METHOD_EC:
+        ENGINE_unregister_EC(ctx->engine);
+        break;
+#endif
+    default:
+        break;
+    }
+    return atom_ok;
+#else
+    return atom_notsup;
+#endif
+}
+
+static ERL_NIF_TERM engine_get_first_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (Engine) */
+#ifdef HAS_ENGINE_SUPPORT
+    ERL_NIF_TERM ret;
+    ENGINE *engine;
+    ErlNifBinary engine_bin;
+    struct engine_ctx *ctx;
+
+    engine = ENGINE_get_first();
+    if(!engine) {
+        enif_alloc_binary(0, &engine_bin);
+        engine_bin.size = 0;
+        return enif_make_tuple2(env, atom_ok, enif_make_binary(env, &engine_bin));
+    }
+
+    ctx = enif_alloc_resource(engine_ctx_rtype, sizeof(struct engine_ctx));
+    ctx->engine = engine;
+    ctx->id = NULL;
+
+    ret = enif_make_resource(env, ctx);
+    enif_release_resource(ctx);
+
+    return enif_make_tuple2(env, atom_ok, ret);
+#else
+    return atom_notsup;
+#endif
+}
+
+static ERL_NIF_TERM engine_get_next_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (Engine) */
+#ifdef HAS_ENGINE_SUPPORT
+    ERL_NIF_TERM ret;
+    ENGINE *engine;
+    ErlNifBinary engine_bin;
+    struct engine_ctx *ctx, *next_ctx;
+
+    // Get Engine
+    if (!enif_get_resource(env, argv[0], engine_ctx_rtype, (void**)&ctx)) {
+        PRINTF_ERR0("engine_get_next_nif Leaved: Parameter not an engine resource object");
+        return enif_make_badarg(env);
+    }
+    engine = ENGINE_get_next(ctx->engine);
+    if (!engine) {
+        enif_alloc_binary(0, &engine_bin);
+        engine_bin.size = 0;
+        return enif_make_tuple2(env, atom_ok, enif_make_binary(env, &engine_bin));
+    }
+
+    next_ctx = enif_alloc_resource(engine_ctx_rtype, sizeof(struct engine_ctx));
+    next_ctx->engine = engine;
+    next_ctx->id = NULL;
+
+    ret = enif_make_resource(env, next_ctx);
+    enif_release_resource(next_ctx);
+
+    return enif_make_tuple2(env, atom_ok, ret);
+#else
+    return atom_notsup;
+#endif
+}
+
+static ERL_NIF_TERM engine_get_id_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (Engine) */
+#ifdef HAS_ENGINE_SUPPORT
+    ErlNifBinary engine_id_bin;
+    const char *engine_id;
+    int size;
+    struct engine_ctx *ctx;
+
+    // Get Engine
+    if (!enif_get_resource(env, argv[0], engine_ctx_rtype, (void**)&ctx)) {
+        PRINTF_ERR0("engine_get_id_nif Leaved: Parameter not an engine resource object");
+        return enif_make_badarg(env);
+    }
+
+    engine_id = ENGINE_get_id(ctx->engine);
+    if (!engine_id) {
+        enif_alloc_binary(0, &engine_id_bin);
+        engine_id_bin.size = 0;
+        return enif_make_tuple2(env, atom_ok, enif_make_binary(env, &engine_id_bin));
+    }
+
+    size = strlen(engine_id);
+    enif_alloc_binary(size, &engine_id_bin);
+    engine_id_bin.size = size;
+    memcpy(engine_id_bin.data, engine_id, size);
+
+    return enif_make_tuple2(env, atom_ok, enif_make_binary(env, &engine_id_bin));
+#else
+    return atom_notsup;
+#endif
+}
+
+static int get_engine_load_cmd_list(ErlNifEnv* env, const ERL_NIF_TERM term, char **cmds, int i)
+{
+#ifdef HAS_ENGINE_SUPPORT
+    ERL_NIF_TERM head, tail;
+    const ERL_NIF_TERM *tmp_tuple;
+    ErlNifBinary tmpbin;
+    int arity;
+    char* tmpstr;
+    int tmplen = 0;
+
+    if(!enif_is_empty_list(env, term)) {
+        if(!enif_get_list_cell(env, term, &head, &tail)) {
+            cmds[i] = NULL;
+            return -1;
+        } else {
+            if(!enif_get_tuple(env, head, &arity, &tmp_tuple)  || arity != 2) {
+                cmds[i] = NULL;
+                return -1;
+            } else {
+                if(!enif_inspect_binary(env, tmp_tuple[0], &tmpbin)) {
+                    cmds[i] = NULL;
+                    return -1;
+                } else {
+                    tmplen = tmpbin.size+1;
+                    tmpstr = enif_alloc(tmplen);
+                    (void) memcpy(tmpstr, tmpbin.data, tmplen);
+                    tmpstr[tmplen-1] = '\0';
+                    cmds[i++] = tmpstr;
+                }
+                if(!enif_inspect_binary(env, tmp_tuple[1], &tmpbin)) {
+                    cmds[i] = NULL;
+                    return -1;
+                } else {
+                    if(tmpbin.size == 0)
+                        cmds[i++] = NULL;
+                    else {
+                        tmplen = tmpbin.size+1;
+                        tmpstr = enif_alloc(tmplen);
+                        (void) memcpy(tmpstr, tmpbin.data, tmplen);
+                        tmpstr[tmplen-1] = '\0';
+                        cmds[i++] = tmpstr;
+                    }
+                }
+                return get_engine_load_cmd_list(env, tail, cmds, i);
+            }
+        }
+    } else {
+        cmds[i] = NULL;
+        return 0;
+    }
+#else
+    return atom_notsup;
+#endif
+}
+
+static ERL_NIF_TERM engine_get_all_methods_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* () */
+#ifdef HAS_ENGINE_SUPPORT
+    ERL_NIF_TERM method_array[12];
+    int i = 0;
+
+#ifdef ENGINE_METHOD_RSA
+    method_array[i++] = atom_engine_method_rsa;
+#endif
+#ifdef ENGINE_METHOD_DSA
+    method_array[i++] = atom_engine_method_dsa;
+#endif
+#ifdef ENGINE_METHOD_DH
+    method_array[i++] = atom_engine_method_dh;
+#endif
+#ifdef ENGINE_METHOD_RAND
+    method_array[i++] = atom_engine_method_rand;
+#endif
+#ifdef ENGINE_METHOD_ECDH
+    method_array[i++] = atom_engine_method_ecdh;
+#endif
+#ifdef ENGINE_METHOD_ECDSA
+    method_array[i++] = atom_engine_method_ecdsa;
+#endif
+#ifdef ENGINE_METHOD_STORE
+    method_array[i++] = atom_engine_method_store;
+#endif
+#ifdef ENGINE_METHOD_CIPHERS
+    method_array[i++] = atom_engine_method_ciphers;
+#endif
+#ifdef ENGINE_METHOD_DIGESTS
+    method_array[i++] = atom_engine_method_digests;
+#endif
+#ifdef ENGINE_METHOD_PKEY_METHS
+    method_array[i++] = atom_engine_method_pkey_meths;
+#endif
+#ifdef ENGINE_METHOD_PKEY_ASN1_METHS
+    method_array[i++] = atom_engine_method_pkey_asn1_meths;
+#endif
+#ifdef ENGINE_METHOD_EC
+    method_array[i++] = atom_engine_method_ec;
+#endif
+
+    return enif_make_list_from_array(env, method_array, i);
+#else
+    return atom_notsup;
+#endif
+}
diff --git a/lib/crypto/c_src/otp_test_engine.c b/lib/crypto/c_src/otp_test_engine.c
new file mode 100644
index 0000000000..414e89c0f6
--- /dev/null
+++ b/lib/crypto/c_src/otp_test_engine.c
@@ -0,0 +1,177 @@
+/*
+ * %CopyrightBegin%
+ *
+ * Copyright Ericsson AB 2017-2017. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * %CopyrightEnd%
+ */
+
+#ifdef _WIN32
+#define OPENSSL_OPT_WINDLL
+#endif
+#include <stdio.h>
+#include <string.h>
+
+#include <openssl/engine.h>
+#include <openssl/md5.h>
+
+#define PACKED_OPENSSL_VERSION(MAJ, MIN, FIX, P)	\
+    ((((((((MAJ << 8) | MIN) << 8 ) | FIX) << 8) | (P-'a'+1)) << 4) | 0xf)
+
+#define PACKED_OPENSSL_VERSION_PLAIN(MAJ, MIN, FIX) \
+    PACKED_OPENSSL_VERSION(MAJ,MIN,FIX,('a'-1))
+
+#if OPENSSL_VERSION_NUMBER < PACKED_OPENSSL_VERSION_PLAIN(1,1,0) \
+    || defined(LIBRESSL_VERSION_NUMBER)
+#define OLD
+#endif
+
+static const char *test_engine_id = "MD5";
+static const char *test_engine_name = "MD5 test engine";
+
+static int test_init(ENGINE *e) {
+    printf("OTP Test Engine Initializatzion!\r\n");
+    return 111;
+}
+
+static void add_test_data(unsigned char *md, unsigned int len)
+{
+    unsigned int i;
+
+    for (i=0; i<len; i++) {
+        md[i] = (unsigned char)(i & 0xff);
+    }
+}
+
+/* MD5 part */
+#undef data
+#ifdef OLD
+#define data(ctx) ((MD5_CTX *)ctx->md_data)
+#endif
+
+static int test_engine_md5_init(EVP_MD_CTX *ctx) {
+    fprintf(stderr, "MD5 initialized\r\n");
+#ifdef OLD
+    return MD5_Init(data(ctx));
+#else
+    return 1;
+#endif
+}
+
+static int test_engine_md5_update(EVP_MD_CTX *ctx,const void *data, size_t count)
+{
+    fprintf(stderr, "MD5 update\r\n");
+#ifdef OLD
+    return MD5_Update(data(ctx), data, (size_t)count);
+#else
+    return 1;
+#endif
+}
+
+static int test_engine_md5_final(EVP_MD_CTX *ctx,unsigned char *md) {
+#ifdef OLD
+    int ret;
+
+    fprintf(stderr, "MD5 final size of EVP_MD: %lu\r\n", sizeof(EVP_MD));
+    ret = MD5_Final(md, data(ctx));
+
+    if (ret > 0) {
+         add_test_data(md, MD5_DIGEST_LENGTH);
+    }
+    return ret;
+#else
+    fprintf(stderr, "MD5 final\r\n");
+    add_test_data(md, MD5_DIGEST_LENGTH);
+    return 1;
+#endif
+}
+
+#ifdef OLD
+static EVP_MD test_engine_md5_method=  {
+        NID_md5,                      /* The name ID for MD5 */
+        NID_undef,                    /* IGNORED: MD5 with private key encryption NID */
+        MD5_DIGEST_LENGTH,            /* Size of MD5 result, in bytes */
+        0,                            /* Flags */
+        test_engine_md5_init,         /* digest init */
+        test_engine_md5_update,       /* digest update */
+        test_engine_md5_final,        /* digest final */
+        NULL,                         /* digest copy */
+        NULL,                         /* digest cleanup */
+        EVP_PKEY_NULL_method,         /* IGNORED: pkey methods */
+        MD5_CBLOCK,                   /* Internal blocksize, see rfc1321/md5.h */
+        sizeof(EVP_MD *) + sizeof(MD5_CTX),
+        NULL,                          /* IGNORED: control function */
+};
+#endif
+
+static int test_digest_ids[] = {NID_md5};
+
+static int test_engine_digest_selector(ENGINE *e, const EVP_MD **digest,
+        const int **nids, int nid) {
+    int ok = 1;
+    if (!digest) {
+        *nids = test_digest_ids;
+        fprintf(stderr, "Digest is empty! Nid:%d\r\n", nid);
+        return 2;
+    }
+    fprintf(stderr, "Digest no %d requested\r\n",nid);
+    if (nid == NID_md5) {
+#ifdef OLD
+        *digest = &test_engine_md5_method;
+#else
+        EVP_MD *md = EVP_MD_meth_new(NID_md5, NID_undef);
+        if (!md ||
+            !EVP_MD_meth_set_result_size(md, MD5_DIGEST_LENGTH) ||
+            !EVP_MD_meth_set_flags(md, 0) ||
+            !EVP_MD_meth_set_init(md,  test_engine_md5_init) ||
+            !EVP_MD_meth_set_update(md,  test_engine_md5_update) ||
+            !EVP_MD_meth_set_final(md,  test_engine_md5_final) ||
+            !EVP_MD_meth_set_copy(md,  NULL) ||
+            !EVP_MD_meth_set_cleanup(md,  NULL) ||
+            !EVP_MD_meth_set_input_blocksize(md, MD5_CBLOCK) ||
+            !EVP_MD_meth_set_app_datasize(md, sizeof(EVP_MD *) + sizeof(MD5_CTX)) ||
+            !EVP_MD_meth_set_ctrl(md, NULL))
+            {
+                ok = 0;
+                *digest = NULL;
+            } else
+            {
+                *digest = md;
+            }
+#endif
+    }
+    else {
+        ok = 0;
+        *digest = NULL;
+    }
+    return ok;
+}
+
+
+static int bind_helper(ENGINE * e, const char *id)
+{
+    if (!ENGINE_set_id(e, test_engine_id) ||
+        !ENGINE_set_name(e, test_engine_name) ||
+        !ENGINE_set_init_function(e, test_init) ||
+        !ENGINE_set_digests(e, &test_engine_digest_selector)
+        )
+        return 0;
+
+    return 1;
+}
+
+IMPLEMENT_DYNAMIC_CHECK_FN();
+
+IMPLEMENT_DYNAMIC_BIND_FN(bind_helper);
diff --git a/lib/crypto/doc/src/Makefile b/lib/crypto/doc/src/Makefile
index 9c503b8fe0..937bb1419f 100644
--- a/lib/crypto/doc/src/Makefile
+++ b/lib/crypto/doc/src/Makefile
@@ -9,11 +9,11 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-# 
+#
 # The Initial Developer of the Original Code is Ericsson Utvecklings AB.
 # Portions created by Ericsson are Copyright 1999, Ericsson Utvecklings
 # AB. All Rights Reserved.''
-# 
+#
 #     $Id$
 #
 include $(ERL_TOP)/make/target.mk
@@ -39,12 +39,12 @@ XML_REF3_FILES = crypto.xml
 XML_REF6_FILES = crypto_app.xml
 
 XML_PART_FILES = release_notes.xml usersguide.xml
-XML_CHAPTER_FILES = notes.xml licenses.xml fips.xml
+XML_CHAPTER_FILES = notes.xml licenses.xml fips.xml engine_load.xml
 
 BOOK_FILES = book.xml
 
 XML_FILES = $(BOOK_FILES) $(XML_APPLICATION_FILES) $(XML_REF3_FILES)  $(XML_REF6_FILES) \
-            $(XML_PART_FILES) $(XML_CHAPTER_FILES) 
+            $(XML_PART_FILES) $(XML_CHAPTER_FILES)
 
 GIF_FILES =
 
@@ -63,9 +63,9 @@ HTML_REF_MAN_FILE = $(HTMLDIR)/index.html
 TOP_PDF_FILE = $(PDFDIR)/$(APPLICATION)-$(VSN).pdf
 
 # ----------------------------------------------------
-# FLAGS 
+# FLAGS
 # ----------------------------------------------------
-XML_FLAGS += 
+XML_FLAGS +=
 
 # ----------------------------------------------------
 # Targets
@@ -73,7 +73,6 @@ XML_FLAGS +=
 $(HTMLDIR)/%.gif: %.gif
 	$(INSTALL_DATA) $< $@
 
-
 docs: pdf html man
 
 $(TOP_PDF_FILE): $(XML_FILES)
@@ -86,7 +85,7 @@ man: $(MAN3_FILES) $(MAN6_FILES)
 
 gifs: $(GIF_FILES:%=$(HTMLDIR)/%)
 
-debug opt valgrind: 
+debug opt valgrind:
 
 clean clean_docs clean_tex:
 	rm -rf $(HTMLDIR)/*
@@ -97,7 +96,7 @@ clean clean_docs clean_tex:
 
 # ----------------------------------------------------
 # Release Target
-# ---------------------------------------------------- 
+# ----------------------------------------------------
 include $(ERL_TOP)/make/otp_release_targets.mk
 
 release_docs_spec: docs
@@ -114,4 +113,3 @@ release_docs_spec: docs
 
 
 release_spec:
-
diff --git a/lib/crypto/doc/src/crypto.xml b/lib/crypto/doc/src/crypto.xml
index 5b2c46a004..c0f85945a7 100644
--- a/lib/crypto/doc/src/crypto.xml
+++ b/lib/crypto/doc/src/crypto.xml
@@ -11,7 +11,7 @@
       Licensed under the Apache License, Version 2.0 (the "License");
       you may not use this file except in compliance with the License.
       You may obtain a copy of the License at
- 
+
           http://www.apache.org/licenses/LICENSE-2.0
 
       Unless required by applicable law or agreed to in writing, software
@@ -19,7 +19,6 @@
       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
       See the License for the specific language governing permissions and
       limitations under the License.
-
     </legalnotice>
 
     <title>crypto</title>
@@ -68,11 +67,11 @@
 
  <section>
     <title>DATA TYPES </title>
-    
-    <code>key_value()  = integer() | binary() </code>
+
+    <code>key_value() = integer() | binary() </code>
     <p>Always <c>binary()</c> when used as return value</p>
 
-    <code>rsa_public()  = [key_value()] = [E, N]  </code>
+    <code>rsa_public() = [key_value()] = [E, N]  </code>
     <p> Where E is the public exponent and N is public modulus. </p>
 
     <code>rsa_private() = [key_value()] = [E, N, D] | [E, N, D, P1, P2, E1, E2, C] </code>
@@ -85,7 +84,7 @@
     <code>dss_public() = [key_value()] = [P, Q, G, Y] </code>
     <p>Where P, Q and G are the dss parameters and Y is the public key.</p>
 
-    <code>dss_private() =  [key_value()] = [P, Q, G, X] </code>
+    <code>dss_private() = [key_value()] = [P, Q, G, X] </code>
     <p>Where P, Q and G are the dss parameters and X is the private key.</p>
 
     <code>srp_public() = key_value() </code>
@@ -109,15 +108,16 @@
 
     <code>ecdh_private() = key_value() </code>
 
-    <code>ecdh_params() =  ec_named_curve() | ec_explicit_curve()</code>
+    <code>ecdh_params() = ec_named_curve() | ec_explicit_curve()</code>
 
     <code>ec_explicit_curve() =
-    {ec_field(), Prime :: key_value(), Point :: key_value(), Order :: integer(), CoFactor :: none | integer()} </code>
+    {ec_field(), Prime :: key_value(), Point :: key_value(), Order :: integer(),
+     CoFactor :: none | integer()} </code>
 
     <code>ec_field() = {prime_field, Prime :: integer()} |
     {characteristic_two_field, M :: integer(), Basis :: ec_basis()}</code>
 
-    <code>ec_basis() =  {tpbasis, K :: non_neg_integer()} |
+    <code>ec_basis() = {tpbasis, K :: non_neg_integer()} |
     {ppbasis, K1 :: non_neg_integer(), K2 :: non_neg_integer(), K3 :: non_neg_integer()} |
     onbasis</code>
 
@@ -138,14 +138,14 @@
 
      <code>stream_cipher() = rc4 | aes_ctr </code>
 
-     <code>block_cipher() =  aes_cbc | aes_cfb8 | aes_cfb128 | aes_ige256 | blowfish_cbc |
+     <code>block_cipher() = aes_cbc | aes_cfb8 | aes_cfb128 | aes_ige256 | blowfish_cbc |
      blowfish_cfb64 | des_cbc | des_cfb | des3_cbc | des3_cfb | des_ede3 | rc2_cbc </code>
 
-     <code>aead_cipher() =  aes_gcm | chacha20_poly1305 </code>
+     <code>aead_cipher() = aes_gcm | chacha20_poly1305 </code>
 
-     <code>stream_key() =  aes_key() | rc4_key() </code>
+     <code>stream_key() = aes_key() | rc4_key() </code>
 
-     <code>block_key() =  aes_key() |  blowfish_key() | des_key()| des3_key() </code>
+     <code>block_key() = aes_key() |  blowfish_key() | des_key()| des3_key() </code>
 
      <code>aes_key() = iodata() </code> <p>Key length is 128, 192 or 256 bits</p>
 
@@ -174,13 +174,17 @@
      Note that both md4 and md5 are recommended only for compatibility with existing applications.
      </p>
      <code> cipher_algorithms() = aes_cbc | aes_cfb8 | aes_cfb128 | aes_ctr | aes_gcm |
-     aes_ige256 | blowfish_cbc | blowfish_cfb64 | chacha20_poly1305 | des_cbc | des_cfb |
-     des3_cbc | des3_cfb | des_ede3 | rc2_cbc | rc4 </code>
-     <code> mac_algorithms() =   hmac | cmac</code>
-     <code> public_key_algorithms() =   rsa |dss | ecdsa | dh | ecdh | ec_gf2m</code>
+     aes_ige256 | blowfish_cbc | blowfish_cfb64 | chacha20_poly1305 | des_cbc |
+     des_cfb | des3_cbc | des3_cfb | des_ede3 | rc2_cbc | rc4 </code>
+     <code> mac_algorithms() = hmac | cmac</code>
+     <code> public_key_algorithms() = rsa |dss | ecdsa | dh | ecdh | ec_gf2m</code>
      <p>Note that ec_gf2m is not strictly a public key algorithm, but a restriction on what curves are supported
      with ecdsa and ecdh.
      </p>
+     <code>engine_method_type() = engine_method_rsa | engine_method_dsa | engine_method_dh |
+     engine_method_rand | engine_method_ecdh | engine_method_ecdsa |
+     engine_method_ciphers | engine_method_digests | engine_method_store |
+     engine_method_pkey_meths | engine_method_pkey_asn1_meths</code>
 
  </section>
 
@@ -261,13 +265,13 @@
 	is not supported by the underlying OpenSSL implementation.</p>
       </desc>
     </func>
-    
+
      <func>
       <name>bytes_to_integer(Bin) -> Integer </name>
       <fsummary>Convert binary representation, of an integer, to an Erlang integer.</fsummary>
       <type>
 	<v>Bin = binary() - as returned by crypto functions</v>
-	
+
         <v>Integer = integer() </v>
       </type>
       <desc>
@@ -439,7 +443,7 @@
       </type>
       <desc>
         <p>Updates the HMAC represented by <c>Context</c> using the given <c>Data</c>. <c>Context</c>
-        must have been generated using an HMAC init function (such as 
+        must have been generated using an HMAC init function (such as
         <seealso marker="#hmac_init-2">hmac_init</seealso>). <c>Data</c> can be any length. <c>NewContext</c>
         must be passed into the next call to <c>hmac_update</c>
 	or to one of the functions <seealso marker="#hmac_final-1">hmac_final</seealso> and
@@ -594,7 +598,7 @@
 	</p>
       </desc>
     </func>
-    
+
     <func>
       <name>private_encrypt(Type, PlainText, PrivateKey, Padding) -> CipherText</name>
       <fsummary>Encrypts PlainText using the private Key.</fsummary>
@@ -905,6 +909,124 @@ _FloatValue = rand:uniform().     % [0.0; 1.0[</pre>
       </desc>
     </func>
 
+    <!-- Engine functions -->
+    <func>
+      <name>engine_get_all_methods() -> Result</name>
+      <fsummary>Return list of all possible engine methods</fsummary>
+      <type>
+	<v>Result = [EngineMethod::atom()]</v>
+      </type>
+      <desc>
+	<p>
+	  Returns a list of all possible engine methods.
+	</p>
+	<p>	  
+	  May throw exception notsup in case there is 
+	  no engine support in the underlying OpenSSL implementation.
+	</p>
+	<p>
+	  See also the chapter <seealso marker="crypto:engine_load#engine_load">Engine Load</seealso>
+	  in the User's Guide.
+	</p>
+      </desc>
+    </func>
+
+    <func>
+      <name>engine_load(EngineId, PreCmds, PostCmds) -> Result</name>
+      <fsummary>Dynamical load an encryption engine</fsummary>
+      <type>
+	<v>EngineId = unicode:chardata()</v>
+	<v>PreCmds, PostCmds = [{unicode:chardata(), unicode:chardata()}]</v>
+	<v>Result = {ok, Engine::term()} | {error, Reason::term()}</v>
+      </type>
+      <desc>
+	<p>
+	  Loads the OpenSSL engine given by <c>EngineId</c> if it is available and then returns ok and
+	  an engine handle. This function is the same as calling <c>engine_load/4</c> with 
+	  <c>EngineMethods</c> set to a list of all the possible methods.  An error tuple is 
+	  returned if the engine can't be loaded.
+	</p>
+	<p>
+	  The function throws a badarg if the parameters are in wrong format.
+	  It may also throw the exception notsup in case there is 
+	  no engine support in the underlying OpenSSL implementation.
+	</p>
+	<p>
+	  See also the chapter <seealso marker="crypto:engine_load#engine_load">Engine Load</seealso>
+	  in the User's Guide.
+	</p>
+      </desc>
+    </func>
+
+    <func>
+      <name>engine_load(EngineId, PreCmds, PostCmds, EngineMethods) -> Result</name>
+      <fsummary>Dynamical load an encryption engine</fsummary>
+      <type>
+	<v>EngineId = unicode:chardata()</v>
+	<v>PreCmds, PostCmds = [{unicode:chardata(), unicode:chardata()}]</v>
+	<v>EngineMethods = [engine_method_type()]</v>
+	<v>Result = {ok, Engine::term()} | {error, Reason::term()}</v>
+      </type>
+      <desc>
+	<p>
+	  Loads the OpenSSL engine given by <c>EngineId</c> if it is available and then returns ok and
+	  an engine handle. An error tuple is returned if the engine can't be loaded.
+	</p>
+	<p>
+	  The function throws a badarg if the parameters are in wrong format.
+	  It may also throw the exception notsup in case there is 
+	  no engine support in the underlying OpenSSL implementation.
+	</p>
+	<p>
+	  See also the chapter <seealso marker="crypto:engine_load#engine_load">Engine Load</seealso>
+	  in the User's Guide.
+	</p>
+      </desc>
+    </func>
+
+    <func>
+      <name>engine_unload(Engine) -> Result</name>
+      <fsummary>Dynamical load an encryption engine</fsummary>
+      <type>
+	<v>Engine = term()</v>
+	<v>Result = ok | {error, Reason::term()}</v>
+      </type>
+      <desc>
+	<p>
+	  Unloads the OpenSSL engine given by <c>EngineId</c>.
+	  An error tuple is returned if the engine can't be unloaded.
+	</p>
+	<p>
+	  The function throws a badarg if the parameter is in wrong format.
+	  It may also throw the exception notsup in case there is 
+	  no engine support in the underlying OpenSSL implementation.
+	</p>
+	<p>
+	  See also the chapter <seealso marker="crypto:engine_load#engine_load">Engine Load</seealso>
+	  in the User's Guide.
+	</p>
+      </desc>
+    </func>
+
+    <func>
+      <name>engine_list() -> Result</name>
+      <fsummary>List the known engine ids</fsummary>
+      <type>
+	<v>Result = [EngineId::unicode:chardata()]</v>
+      </type>
+      <desc>
+	<p>List the id's of all engines in OpenSSL's internal list.</p>
+	<p>
+	  It may also throw the exception notsup in case there is 
+	  no engine support in the underlying OpenSSL implementation.
+	</p>
+	<p>
+	  See also the chapter <seealso marker="crypto:engine_load#engine_load">Engine Load</seealso> 
+	  in the User's Guide.
+	</p>
+      </desc>
+    </func>
+
  </funcs>
 
   <!-- Maybe put this in the users guide -->
@@ -979,4 +1101,3 @@ _FloatValue = rand:uniform().     % [0.0; 1.0[</pre>
   <!--   </p> -->
   <!-- </section> -->
 </erlref>
-
diff --git a/lib/crypto/doc/src/engine_load.xml b/lib/crypto/doc/src/engine_load.xml
new file mode 100644
index 0000000000..e5c3f5d561
--- /dev/null
+++ b/lib/crypto/doc/src/engine_load.xml
@@ -0,0 +1,110 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!DOCTYPE chapter SYSTEM "chapter.dtd">
+
+<chapter>
+  <header>
+    <copyright>
+      <year>2017</year><year>2017</year>
+      <holder>Ericsson AB. All Rights Reserved.</holder>
+    </copyright>
+    <legalnotice>
+      The contents of this file are subject to the Erlang Public License,
+      Version 1.1, (the "License"); you may not use this file except in
+      compliance with the License. You should have received a copy of the
+      Erlang Public License along with this software. If not, it can be
+      retrieved online at http://www.erlang.org/.
+
+      Software distributed under the License is distributed on an "AS IS"
+      basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+      the License for the specific language governing rights and limitations
+      under the License.
+    </legalnotice>
+    <title>Engine Load</title>
+    <prepared>Lars Thorsén</prepared>
+    <date>2017-08-22</date>
+    <file>engine_load.xml</file>
+  </header>
+  <p>
+    <marker id="engine_load"></marker>
+    This chapter describes the support for loading encryption engines in the crypto application.
+  </p>
+
+  <section>
+    <title>Background</title>
+    <p>
+      OpenSSL exposes an Engine API, which makes it possible to plug in alternative
+      implementations for some or all of the cryptographic operations implemented by OpenSSL.
+      When configured appropriately, OpenSSL calls the engine's implementation of these
+      operations instead of its own.
+    </p>
+    <p>
+      Typically, OpenSSL engines provide a hardware implementation of specific cryptographic
+      operations. The hardware implementation usually offers improved performance over its
+      software-based counterpart, which is known as cryptographic acceleration.
+    </p>
+  </section>
+
+  <section>
+    <title>Use Cases</title>
+    <section>
+      <title>Dynamically load an engine from default directory</title>
+      <p>
+	If the engine is located in the OpenSSL/LibreSSL installation <c>engines</c> directory.
+      </p>
+      <code>
+1> {ok, Engine} = crypto:engine_load(&lt;&lt;"otp_test_engine">>, [], []).
+ {ok, #Ref}</code>
+       <note>
+	<p>The file name requirement on the engine dynamic library can differ between SSL versions.</p>
+      </note>
+    </section>
+
+    <section>
+      <title>Load an engine with the dynamic engine</title>
+      <p>
+	Load an engine with the help of the dynamic engine by giving the path to the library.
+      </p>
+      <code>
+ 2> {ok, Engine} = crypto:engine_load(&lt;&lt;"dynamic">>,
+                                      [{&lt;&lt;"SO_PATH">>,
+                                        &lt;&lt;"/some/path/otp_test_engine.so">>},
+                                       {&lt;&lt;"ID">>, &lt;&lt;"MD5">>},
+                                       &lt;&lt;"LOAD">>],
+                                      []).
+ {ok, #Ref}</code>
+      <note>
+	<p>The dynamic engine is not supported in LibreSSL from version 2.2.1</p>
+      </note>
+    </section>
+
+    <section>
+      <title>Load an engine and replace some methods</title>
+      <p>
+	Load an engine with the help of the dynamic engine and just
+	replace some engine methods.
+      </p>
+      <code>
+ 3> Methods = crypto:engine_get_all_methods() -- [engine_method_dh,engine_method_rand,
+engine_method_ciphers,engine_method_digests, engine_method_store,
+engine_method_pkey_meths, engine_method_pkey_asn1_meths].
+[engine_method_rsa,engine_method_dsa,
+ engine_method_ecdh,engine_method_ecdsa]
+ 4> {ok, Engine} = crypto:engine_load(&lt;&lt;"dynamic">>,
+                                      [{&lt;&lt;"SO_PATH">>,
+                                        &lt;&lt;"/some/path/otp_test_engine.so">>},
+                                       {&lt;&lt;"ID">>, &lt;&lt;"MD5">>},
+                                       &lt;&lt;"LOAD">>],
+                                      [],
+		                      Methods).
+ {ok, #Ref}</code>
+    </section>
+
+    <section>
+      <title>List all engines currently loaded</title>
+      <code>
+ 5> crypto:engine_list().
+[&lt;&lt;"dynamic">>, &lt;&lt;"MD5">>]</code>
+    </section>
+
+  </section>
+</chapter>
diff --git a/lib/crypto/doc/src/usersguide.xml b/lib/crypto/doc/src/usersguide.xml
index 7971aefff4..f637a1db79 100644
--- a/lib/crypto/doc/src/usersguide.xml
+++ b/lib/crypto/doc/src/usersguide.xml
@@ -11,7 +11,7 @@
       Licensed under the Apache License, Version 2.0 (the "License");
       you may not use this file except in compliance with the License.
       You may obtain a copy of the License at
- 
+
           http://www.apache.org/licenses/LICENSE-2.0
 
       Unless required by applicable law or agreed to in writing, software
@@ -19,7 +19,7 @@
       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
       See the License for the specific language governing permissions and
       limitations under the License.
-    
+
     </legalnotice>
 
     <title>Crypto User's Guide</title>
@@ -48,5 +48,5 @@
   </description>
   <xi:include href="licenses.xml"/>
   <xi:include href="fips.xml"/>
+  <xi:include href="engine_load.xml"/>
 </part>
-
diff --git a/lib/crypto/src/Makefile b/lib/crypto/src/Makefile
index aea8a5a71c..edad0e6b61 100644
--- a/lib/crypto/src/Makefile
+++ b/lib/crypto/src/Makefile
@@ -39,8 +39,7 @@ MODULES= \
 	crypto \
 	crypto_ec_curves
 
-HRL_FILES= 
-
+HRL_FILES=
 ERL_FILES= $(MODULES:%=%.erl)
 
 TARGET_FILES= $(MODULES:%=$(EBIN)/%.$(EMULATOR))
@@ -56,16 +55,16 @@ APPUP_TARGET= $(EBIN)/$(APPUP_FILE)
 # ----------------------------------------------------
 # FLAGS
 # ----------------------------------------------------
-ERL_COMPILE_FLAGS += -DCRYPTO_VSN=\"$(VSN)\" -Werror
+ERL_COMPILE_FLAGS += -DCRYPTO_VSN=\"$(VSN)\" -Werror -I../include
 
 # ----------------------------------------------------
 # Targets
 # ----------------------------------------------------
 
-debug opt valgrind: $(TARGET_FILES) $(APP_TARGET) $(APPUP_TARGET) 
+debug opt valgrind: $(TARGET_FILES) $(APP_TARGET) $(APPUP_TARGET)
 
 clean:
-	rm -f $(TARGET_FILES) $(APP_TARGET) $(APPUP_TARGET) 
+	rm -f $(TARGET_FILES) $(APP_TARGET) $(APPUP_TARGET)
 	rm -f errs core *~
 
 $(APP_TARGET): $(APP_SRC) ../vsn.mk
@@ -78,7 +77,7 @@ docs:
 
 # ----------------------------------------------------
 # Release Target
-# ---------------------------------------------------- 
+# ----------------------------------------------------
 include $(ERL_TOP)/make/otp_release_targets.mk
 
 release_spec: opt
@@ -89,10 +88,3 @@ release_spec: opt
 		$(APPUP_TARGET) "$(RELSYSDIR)/ebin"
 
 release_docs_spec:
-
-
-
-
-
-
-
diff --git a/lib/crypto/src/crypto.erl b/lib/crypto/src/crypto.erl
index f9c4f7b71d..9eba4561e1 100644
--- a/lib/crypto/src/crypto.erl
+++ b/lib/crypto/src/crypto.erl
@@ -44,10 +44,18 @@
 -export([dh_generate_parameters/2, dh_check/1]). %% Testing see
 -export([ec_curve/1, ec_curves/0]).
 -export([rand_seed/1]).
+%% Engine
+-export([
+         engine_get_all_methods/0,
+         engine_load/3,
+         engine_load/4,
+         engine_unload/1,
+         engine_list/0
+        ]).
 
-%% Private. For tests.
--export([packed_openssl_version/4]).
 
+%% Private. For tests.
+-export([packed_openssl_version/4, engine_methods_convert_to_bitmask/2, get_test_engine/0]).
 
 -deprecated({rand_uniform, 2, next_major_release}).
 
@@ -568,10 +576,143 @@ compute_key(ecdh, Others, My, Curve) ->
 			 nif_curve_params(Curve),
 			 ensure_int_as_bin(My)).
 
+%%======================================================================
+%% Engine functions
+%%======================================================================
+%%----------------------------------------------------------------------
+%% Function: engine_get_all_methods/0
+%%----------------------------------------------------------------------
+-type engine_method_type() :: engine_method_rsa | engine_method_dsa | engine_method_dh |
+                              engine_method_rand | engine_method_ecdh | engine_method_ecdsa |
+                              engine_method_ciphers | engine_method_digests | engine_method_store |
+                              engine_method_pkey_meths | engine_method_pkey_asn1_meths | 
+                              engine_method_ec.
+
+-spec engine_get_all_methods() ->
+    [engine_method_type()].
+engine_get_all_methods() ->
+     notsup_to_error(engine_get_all_methods_nif()).
+
+%%----------------------------------------------------------------------
+%% Function: engine_load/3
+%%----------------------------------------------------------------------
+-spec engine_load(EngineId::unicode:chardata(),
+                  PreCmds::[{unicode:chardata(), unicode:chardata()}],
+                  PostCmds::[{unicode:chardata(), unicode:chardata()}]) ->
+    {ok, Engine::term()} | {error, Reason::term()}.
+engine_load(EngineId, PreCmds, PostCmds) when is_list(PreCmds), is_list(PostCmds) ->
+    engine_load(EngineId, PreCmds, PostCmds, engine_get_all_methods()).
+
+%%----------------------------------------------------------------------
+%% Function: engine_load/4
+%%----------------------------------------------------------------------
+-spec engine_load(EngineId::unicode:chardata(),
+                  PreCmds::[{unicode:chardata(), unicode:chardata()}],
+                  PostCmds::[{unicode:chardata(), unicode:chardata()}],
+                  EngineMethods::[engine_method_type()]) ->
+    {ok, Engine::term()} | {error, Reason::term()}.
+engine_load(EngineId, PreCmds, PostCmds, EngineMethods) when is_list(PreCmds),
+                                                             is_list(PostCmds) ->
+    try
+        ok = notsup_to_error(engine_load_dynamic_nif()),
+        case notsup_to_error(engine_by_id_nif(ensure_bin_chardata(EngineId))) of
+            {ok, Engine} ->
+                ok = engine_load_1(Engine, PreCmds, PostCmds, EngineMethods),
+                {ok, Engine};
+            {error, Error1} ->
+                {error, Error1}
+        end
+    catch
+       throw:Error2 ->
+          Error2
+    end.
+
+engine_load_1(Engine, PreCmds, PostCmds, EngineMethods) ->
+    try
+        ok = engine_nif_wrapper(engine_ctrl_cmd_strings_nif(Engine, ensure_bin_cmds(PreCmds))),
+        ok = engine_nif_wrapper(engine_add_nif(Engine)),
+        ok = engine_nif_wrapper(engine_init_nif(Engine)),
+        engine_load_2(Engine, PostCmds, EngineMethods),
+        ok
+    catch
+       throw:Error ->
+          %% The engine couldn't initialise, release the structural reference
+          ok = engine_free_nif(Engine),
+          throw(Error)
+    end.
+
+engine_load_2(Engine, PostCmds, EngineMethods) ->
+    try
+        ok = engine_nif_wrapper(engine_ctrl_cmd_strings_nif(Engine, ensure_bin_cmds(PostCmds))),
+        [ok = engine_nif_wrapper(engine_register_nif(Engine, engine_method_atom_to_int(Method))) ||
+            Method <- EngineMethods],
+        ok
+    catch
+       throw:Error ->
+          %% The engine registration failed, release the functional reference
+          ok = engine_finish_nif(Engine),
+          throw(Error)
+    end.
+
+%%----------------------------------------------------------------------
+%% Function: engine_unload/1
+%%----------------------------------------------------------------------
+-spec engine_unload(Engine::term()) ->
+    ok | {error, Reason::term()}.
+engine_unload(Engine) ->
+    engine_unload(Engine, engine_get_all_methods()).
+
+-spec engine_unload(Engine::term(), EngineMethods::[engine_method_type()]) ->
+    ok | {error, Reason::term()}.
+engine_unload(Engine, EngineMethods) ->
+    try
+        [ok = engine_nif_wrapper(engine_unregister_nif(Engine, engine_method_atom_to_int(Method))) ||
+            Method <- EngineMethods],
+        ok = engine_nif_wrapper(engine_remove_nif(Engine)),
+        %% Release the functional reference from engine_init_nif
+        ok = engine_nif_wrapper(engine_finish_nif(Engine)),
+        %% Release the structural reference from engine_by_id_nif
+        ok = engine_nif_wrapper(engine_free_nif(Engine))
+    catch
+       throw:Error ->
+          Error
+    end.
+
+%%----------------------------------------------------------------------
+%% Function: engine_list/0
+%%----------------------------------------------------------------------
+-spec engine_list() ->
+    [EngineId::binary()].
+engine_list() ->
+    case notsup_to_error(engine_get_first_nif()) of
+        {ok, <<>>} ->
+            [];
+        {ok, Engine} ->
+            case notsup_to_error(engine_get_id_nif(Engine)) of
+                {ok, <<>>} ->
+                    engine_list(Engine, []);
+                {ok, EngineId} ->
+                    engine_list(Engine, [EngineId])
+            end
+    end.
+
+engine_list(Engine0, IdList) ->
+    case notsup_to_error(engine_get_next_nif(Engine0)) of
+        {ok, <<>>} ->
+            lists:reverse(IdList);
+        {ok, Engine1} ->
+            case notsup_to_error(engine_get_id_nif(Engine1)) of
+                {ok, <<>>} ->
+                    engine_list(Engine1, IdList);
+                {ok, EngineId} ->
+                    engine_list(Engine1, [EngineId |IdList])
+            end
+    end.
+
+
 %%--------------------------------------------------------------------
 %%% On load
 %%--------------------------------------------------------------------
-
 on_load() ->
     LibBaseName = "crypto",
     PrivDir = code:priv_dir(crypto),
@@ -631,12 +772,12 @@ path2bin(Path) when is_list(Path) ->
     end.
 
 %%--------------------------------------------------------------------
-%%% Internal functions 
+%%% Internal functions
 %%--------------------------------------------------------------------
 max_bytes() ->
     ?MAX_BYTES_TO_NIF.
 
-notsup_to_error(notsup) ->
+notsup_to_error(notsup) -> 
     erlang:error(notsup);
 notsup_to_error(Other) ->
     Other.
@@ -760,7 +901,7 @@ do_stream_decrypt({rc4, State0}, Data) ->
 
 
 %%
-%% AES - in counter mode (CTR) with state maintained for multi-call streaming 
+%% AES - in counter mode (CTR) with state maintained for multi-call streaming
 %%
 -type ctr_state() :: { iodata(), binary(), binary(), integer() } | binary().
 
@@ -769,11 +910,11 @@ do_stream_decrypt({rc4, State0}, Data) ->
 				 { ctr_state(), binary() }.
 -spec aes_ctr_stream_decrypt(ctr_state(), binary()) ->
 				 { ctr_state(), binary() }.
- 
+
 aes_ctr_stream_init(_Key, _IVec) -> ?nif_stub.
 aes_ctr_stream_encrypt(_State, _Data) -> ?nif_stub.
 aes_ctr_stream_decrypt(_State, _Cipher) -> ?nif_stub.
-     
+
 %%
 %% RC4 - symmetric stream cipher
 %%
@@ -858,22 +999,22 @@ pkey_verify_nif(_Algorithm, _Type, _Data, _Signature, _Key, _Options) -> ?nif_st
 rsa_generate_key_nif(_Bits, _Exp) -> ?nif_stub.
 
 %% DH Diffie-Hellman functions
-%% 
+%%
 
 %% Generate (and check) Parameters is not documented because they are implemented
 %% for testing (and offline parameter generation) only.
-%% From the openssl doc: 
+%% From the openssl doc:
 %%  DH_generate_parameters() may run for several hours before finding a suitable prime.
-%% Thus dh_generate_parameters may in this implementation block 
+%% Thus dh_generate_parameters may in this implementation block
 %% the emulator for several hours.
 %%
-%% usage: dh_generate_parameters(1024, 2 or 5) -> 
+%% usage: dh_generate_parameters(1024, 2 or 5) ->
 %%    [Prime=mpint(), SharedGenerator=mpint()]
 dh_generate_parameters(PrimeLen, Generator) ->
     case dh_generate_parameters_nif(PrimeLen, Generator) of
 	error -> erlang:error(generation_failed, [PrimeLen,Generator]);
 	Ret -> Ret
-    end.  
+    end.
 
 dh_generate_parameters_nif(_PrimeLen, _Generator) -> ?nif_stub.
 
@@ -985,7 +1126,7 @@ pkey_crypt_nif(_Algorithm, _In, _Key, _Options, _IsPrivate, _IsEncrypt) -> ?nif_
 %% MP representaion  (SSH2)
 mpint(X) when X < 0 -> mpint_neg(X);
 mpint(X) -> mpint_pos(X).
- 
+
 -define(UINT32(X),   X:32/unsigned-big-integer).
 
 
@@ -993,7 +1134,7 @@ mpint_neg(X) ->
     Bin = int_to_bin_neg(X, []),
     Sz = byte_size(Bin),
     <<?UINT32(Sz), Bin/binary>>.
-    
+
 mpint_pos(X) ->
     Bin = int_to_bin_pos(X, []),
     <<MSB,_/binary>> = Bin,
@@ -1015,7 +1156,6 @@ erlint(<<MPIntSize:32/integer,MPIntValue/binary>>) ->
 %%
 mod_exp_nif(_Base,_Exp,_Mod,_bin_hdr) -> ?nif_stub.
 
-
 %%%----------------------------------------------------------------
 %% 9470495 == V(0,9,8,zh).
 %% 268435615 == V(1,0,0,i).
@@ -1026,3 +1166,92 @@ packed_openssl_version(MAJ, MIN, FIX, P0) ->
     P1 = atom_to_list(P0),
     P = lists:sum([C-$a||C<-P1]),
     ((((((((MAJ bsl 8) bor MIN) bsl 8 ) bor FIX) bsl 8) bor (P+1)) bsl 4) bor 16#f).
+
+%%--------------------------------------------------------------------
+%% Engine nifs
+engine_by_id_nif(_EngineId) -> ?nif_stub.
+engine_init_nif(_Engine) -> ?nif_stub.
+engine_finish_nif(_Engine) -> ?nif_stub.
+engine_free_nif(_Engine) -> ?nif_stub.
+engine_load_dynamic_nif() -> ?nif_stub.
+engine_ctrl_cmd_strings_nif(_Engine, _Cmds) -> ?nif_stub.
+engine_add_nif(_Engine)  -> ?nif_stub.
+engine_remove_nif(_Engine)  -> ?nif_stub.
+engine_register_nif(_Engine, _EngineMethod) -> ?nif_stub.
+engine_unregister_nif(_Engine, _EngineMethod) -> ?nif_stub.
+engine_get_first_nif() -> ?nif_stub.
+engine_get_next_nif(_Engine) -> ?nif_stub.
+engine_get_id_nif(_Engine) -> ?nif_stub.
+engine_get_all_methods_nif() -> ?nif_stub.
+
+%%--------------------------------------------------------------------
+%% Engine internals
+engine_nif_wrapper(ok) ->
+    ok;
+engine_nif_wrapper(notsup) ->
+    erlang:error(notsup);
+engine_nif_wrapper({error, Error}) ->
+    throw({error, Error}).
+
+ensure_bin_chardata(CharData) when is_binary(CharData) ->
+    CharData;
+ensure_bin_chardata(CharData) ->
+    unicode:characters_to_binary(CharData).
+
+ensure_bin_cmds(CMDs) ->
+    ensure_bin_cmds(CMDs, []).
+
+ensure_bin_cmds([], Acc) ->
+    lists:reverse(Acc);
+ensure_bin_cmds([{Key, Value} |CMDs], Acc) ->
+    ensure_bin_cmds(CMDs, [{ensure_bin_chardata(Key), ensure_bin_chardata(Value)} | Acc]);
+ensure_bin_cmds([Key | CMDs], Acc) ->
+    ensure_bin_cmds(CMDs, [{ensure_bin_chardata(Key), <<"">>} | Acc]).
+
+engine_methods_convert_to_bitmask([], BitMask) ->
+    BitMask;
+engine_methods_convert_to_bitmask(engine_method_all, _BitMask) ->
+    16#FFFF;
+engine_methods_convert_to_bitmask(engine_method_none, _BitMask) ->
+    16#0000;
+engine_methods_convert_to_bitmask([M |Ms], BitMask) ->
+    engine_methods_convert_to_bitmask(Ms, BitMask bor engine_method_atom_to_int(M)).
+
+engine_method_atom_to_int(engine_method_rsa) -> 16#0001;
+engine_method_atom_to_int(engine_method_dsa) -> 16#0002;
+engine_method_atom_to_int(engine_method_dh) -> 16#0004;
+engine_method_atom_to_int(engine_method_rand) -> 16#0008;
+engine_method_atom_to_int(engine_method_ecdh) -> 16#0010;
+engine_method_atom_to_int(engine_method_ecdsa) -> 16#0020;
+engine_method_atom_to_int(engine_method_ciphers) -> 16#0040;
+engine_method_atom_to_int(engine_method_digests) -> 16#0080;
+engine_method_atom_to_int(engine_method_store) -> 16#0100;
+engine_method_atom_to_int(engine_method_pkey_meths) -> 16#0200;
+engine_method_atom_to_int(engine_method_pkey_asn1_meths) -> 16#0400;
+engine_method_atom_to_int(engine_method_ec) -> 16#0800;
+engine_method_atom_to_int(X) ->
+    erlang:error(badarg, [X]).
+
+get_test_engine() ->
+    Type = erlang:system_info(system_architecture),
+    LibDir = filename:join([code:priv_dir(crypto), "lib"]),
+    ArchDir = filename:join([LibDir, Type]),
+    case filelib:is_dir(ArchDir) of        
+	true  -> check_otp_test_engine(ArchDir);
+	false -> check_otp_test_engine(LibDir)
+    end.
+
+check_otp_test_engine(LibDir) ->
+    case filelib:wildcard("otp_test_engine*", LibDir) of
+        [] ->
+            {error, notexist};
+        [LibName] ->
+            LibPath = filename:join(LibDir,LibName),
+            case filelib:is_file(LibPath) of
+                true ->
+                    {ok, unicode:characters_to_binary(LibPath)};
+                false ->
+                    {error, notexist}
+            end
+    end.
+            
diff --git a/lib/crypto/test/Makefile b/lib/crypto/test/Makefile
index 138081d386..e046a25338 100644
--- a/lib/crypto/test/Makefile
+++ b/lib/crypto/test/Makefile
@@ -7,7 +7,8 @@ include $(ERL_TOP)/make/$(TARGET)/otp.mk
 
 MODULES = \
 	blowfish_SUITE \
-	crypto_SUITE
+	crypto_SUITE \
+	engine_SUITE
 
 ERL_FILES= $(MODULES:%=%.erl)
 
@@ -27,7 +28,7 @@ RELSYSDIR = $(RELEASE_PATH)/crypto_test
 # FLAGS
 # ----------------------------------------------------
 ERL_MAKE_FLAGS += 
-ERL_COMPILE_FLAGS +=
+ERL_COMPILE_FLAGS += +nowarn_export_all
 
 EBIN = .
 MAKE_EMAKE = $(wildcard $(ERL_TOP)/make/make_emakefile)
@@ -77,7 +78,7 @@ release_spec:
 release_tests_spec: $(TEST_TARGET)
 	$(INSTALL_DIR) "$(RELSYSDIR)"
 	$(INSTALL_DATA) crypto.spec crypto.cover $(RELTEST_FILES) "$(RELSYSDIR)"
-	@tar cfh - crypto_SUITE_data | (cd "$(RELSYSDIR)"; tar xf -)
+	@tar cfh - *_SUITE_data | (cd "$(RELSYSDIR)"; tar xf -)
 	chmod -R u+w "$(RELSYSDIR)"
 
 release_docs_spec:
diff --git a/lib/crypto/test/crypto_SUITE.erl b/lib/crypto/test/crypto_SUITE.erl
index 69f02d3da6..6dab459df6 100644
--- a/lib/crypto/test/crypto_SUITE.erl
+++ b/lib/crypto/test/crypto_SUITE.erl
@@ -198,7 +198,7 @@ init_per_suite(Config) ->
 		    %% This is NOT how you want to do seeding, it is just here
 		    %% to make the tests pass. Check your OS manual for how you
 		    %% really want to seed.
-		    {H,M,L} = erlang:now(),
+		    {H,M,L} = erlang:timestamp(),
 		    Bin = <<H:24,M:20,L:20>>,
 		    crypto:rand_seed(<< <<Bin/binary>> || _ <- lists:seq(1,16) >>),
 		    Config
diff --git a/lib/crypto/test/engine_SUITE.erl b/lib/crypto/test/engine_SUITE.erl
new file mode 100644
index 0000000000..5f74304fe7
--- /dev/null
+++ b/lib/crypto/test/engine_SUITE.erl
@@ -0,0 +1,312 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2017-2017. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%%
+%% %CopyrightEnd%
+%%
+%%
+
+-module(engine_SUITE).
+
+-include_lib("common_test/include/ct.hrl").
+
+%% Note: This directive should only be used in test suites.
+-compile(export_all).
+
+%%--------------------------------------------------------------------
+%% Common Test interface functions -----------------------------------
+%%--------------------------------------------------------------------
+suite() ->
+    [{ct_hooks,[ts_install_cth]},
+     {timetrap,{seconds, 10}}
+    ].
+
+all() ->
+    [
+     get_all_possible_methods,
+     engine_load_all_methods,
+     engine_load_some_methods,
+     bad_arguments,
+     unknown_engine,
+     pre_command_fail_bad_value,
+     pre_command_fail_bad_key,
+     failed_engine_init
+    ].
+
+init_per_suite(Config) ->    
+    try crypto:start() of
+	ok ->
+            Config;
+        {error,{already_started,crypto}} ->
+            Config
+    catch _:_ ->
+	    {skip, "Crypto did not start"}
+    end.
+end_per_suite(_Config) ->
+    ok.
+
+%%--------------------------------------------------------------------
+init_per_group(_Group, Config0) ->
+    Config0.
+
+end_per_group(_, _) ->
+    ok.
+
+%%--------------------------------------------------------------------
+init_per_testcase(_Case, Config) ->
+    Config.
+end_per_testcase(_Case, _Config) ->
+    ok.
+
+%%-------------------------------------------------------------------------
+%% Test cases starts here.
+%%-------------------------------------------------------------------------
+get_all_possible_methods() ->
+    [{doc, "Just fetch all possible engine methods supported."}].
+
+get_all_possible_methods(Config) when is_list(Config) ->
+    try
+        List = crypto:engine_get_all_methods(),
+        ct:log("crypto:engine_get_all_methods() -> ~p\n", [List]),
+        ok
+    catch
+        error:notsup ->
+            {skip, "Engine not supported on this OpenSSL version"}
+    end.
+
+engine_load_all_methods()->
+    [{doc, "Use a dummy md5 engine that does not implement md5"
+      "but rather returns a static binary to test that crypto:engine_load "
+      "functions works."}].
+
+engine_load_all_methods(Config) when is_list(Config) ->
+    case crypto:get_test_engine() of
+        {error, notexist} ->
+            {skip, "OTP Test engine not found"};
+        {ok, Engine} ->
+            try 
+                Md5Hash1 =  <<106,30,3,246,166,222,229,158,244,217,241,179,50,232,107,109>>,
+                Md5Hash1 = crypto:hash(md5, "Don't panic"),
+                Md5Hash2 =  <<0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15>>,
+                case crypto:engine_load(<<"dynamic">>,
+                                        [{<<"SO_PATH">>, Engine},
+                                         {<<"ID">>, <<"MD5">>},
+                                         <<"LOAD">>],
+                                        []) of
+                    {ok, E} ->
+                        case crypto:hash(md5, "Don't panic") of
+                            Md5Hash1 ->
+                                ct:fail(fail_to_load_still_original_engine);
+                            Md5Hash2 ->
+                                ok;
+                            _ ->
+                                ct:fail(fail_to_load_engine)
+                        end,
+                        ok = crypto:engine_unload(E),
+                        case crypto:hash(md5, "Don't panic") of
+                            Md5Hash2 ->
+                                ct:fail(fail_to_unload_still_test_engine);
+                            Md5Hash1 ->
+                                ok;
+                            _ ->
+                                ct:fail(fail_to_unload_engine)
+                        end;
+                    {error, bad_engine_id} ->
+                        {skip, "Dynamic Engine not supported"}
+                end
+           catch
+               error:notsup ->
+                  {skip, "Engine not supported on this OpenSSL version"}
+           end
+    end.
+
+engine_load_some_methods()->
+    [{doc, "Use a dummy md5 engine that does not implement md5"
+      "but rather returns a static binary to test that crypto:engine_load "
+      "functions works."}].
+
+engine_load_some_methods(Config) when is_list(Config) ->
+    case crypto:get_test_engine() of
+        {error, notexist} ->
+            {skip, "OTP Test engine not found"};
+        {ok, Engine} ->
+            try 
+                Md5Hash1 =  <<106,30,3,246,166,222,229,158,244,217,241,179,50,232,107,109>>,
+                Md5Hash1 = crypto:hash(md5, "Don't panic"),
+                Md5Hash2 =  <<0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15>>,
+                EngineMethods = crypto:engine_get_all_methods() --
+                    [engine_method_dh,engine_method_rand,
+                     engine_method_ciphers, engine_method_store,
+                     engine_method_pkey_meths, engine_method_pkey_asn1_meths],
+                case crypto:engine_load(<<"dynamic">>,
+                                        [{<<"SO_PATH">>, Engine},
+                                         {<<"ID">>, <<"MD5">>},
+                                         <<"LOAD">>],
+                                        [],
+                                        EngineMethods) of
+                    {ok, E} ->        
+                        case crypto:hash(md5, "Don't panic") of
+                            Md5Hash1 ->
+                                ct:fail(fail_to_load_engine_still_original);
+                            Md5Hash2 ->
+                                ok;
+                            _ ->
+                                ct:fail(fail_to_load_engine)
+                        end,
+                        ok = crypto:engine_unload(E),
+                        case crypto:hash(md5, "Don't panic") of
+                            Md5Hash2 ->
+                                ct:fail(fail_to_unload_still_test_engine);
+                            Md5Hash1 ->
+                                ok;
+                            _ ->
+                                ct:fail(fail_to_unload_engine)
+                        end;
+                    {error, bad_engine_id} ->
+                    {skip, "Dynamic Engine not supported"}
+                end
+           catch
+               error:notsup ->
+                  {skip, "Engine not supported on this OpenSSL version"}
+           end
+    end.
+
+%%-------------------------------------------------------------------------
+%% Error cases
+bad_arguments()->
+    [{doc, "Test different arguments in bad format."}].
+
+bad_arguments(Config) when is_list(Config) ->
+    case crypto:get_test_engine() of
+        {error, notexist} ->
+            {skip, "OTP Test engine not found"};
+        {ok, Engine} ->
+            try 
+                try
+                    crypto:engine_load(fail_engine, [], [])
+                catch
+                    error:badarg ->
+                       ok
+                end,
+                try
+                    crypto:engine_load(<<"dynamic">>,
+                                       [{<<"SO_PATH">>, Engine},
+                                        1,
+                                        {<<"ID">>, <<"MD5">>},
+                                        <<"LOAD">>],
+                                       [])
+                catch
+                    error:badarg ->
+                       ok
+                end,
+                try
+                    crypto:engine_load(<<"dynamic">>,
+                                       [{<<"SO_PATH">>, Engine},
+                                        {'ID', <<"MD5">>},
+                                        <<"LOAD">>],
+                                       [])
+                catch
+                    error:badarg ->
+                       ok
+                end
+          catch
+              error:notsup ->
+                 {skip, "Engine not supported on this OpenSSL version"}
+          end
+    end.
+
+unknown_engine() ->
+    [{doc, "Try to load a non existent engine."}].
+
+unknown_engine(Config) when is_list(Config) ->
+    try
+        {error, bad_engine_id} = crypto:engine_load(<<"fail_engine">>, [], []),
+        ok
+    catch
+        error:notsup ->
+           {skip, "Engine not supported on this OpenSSL version"}
+    end.
+
+pre_command_fail_bad_value() ->
+    [{doc, "Test pre command due to bad value"}].
+
+pre_command_fail_bad_value(Config) when is_list(Config) ->
+    DataDir = unicode:characters_to_binary(code:priv_dir(crypto)),
+    try
+        case crypto:engine_load(<<"dynamic">>,
+                                [{<<"SO_PATH">>,
+                                  <<DataDir/binary, <<"/libfail_engine.so">>/binary >>},
+                                 {<<"ID">>, <<"MD5">>},
+                                 <<"LOAD">>],
+                                []) of
+            {error, ctrl_cmd_failed} ->
+                ok;
+            {error, bad_engine_id} ->
+                {skip, "Dynamic Engine not supported"}
+        end
+    catch
+        error:notsup ->
+           {skip, "Engine not supported on this OpenSSL version"}
+    end.
+
+pre_command_fail_bad_key() ->
+    [{doc, "Test pre command due to bad key"}].
+
+pre_command_fail_bad_key(Config) when is_list(Config) ->
+    try
+        case crypto:get_test_engine() of
+            {error, notexist} ->
+                {skip, "OTP Test engine not found"};
+            {ok, Engine} ->
+                case crypto:engine_load(<<"dynamic">>,
+                                        [{<<"SO_WRONG_PATH">>, Engine},
+                                         {<<"ID">>, <<"MD5">>},
+                                         <<"LOAD">>],
+                                        []) of
+                    {error, ctrl_cmd_failed} ->
+                        ok;
+                    {error, bad_engine_id} ->
+                        {skip, "Dynamic Engine not supported"}
+                end
+        end
+   catch 
+       error:notsup ->
+          {skip, "Engine not supported on this OpenSSL version"}
+   end.
+
+failed_engine_init()->
+    [{doc, "Test failing engine init due to missed pre command"}].
+
+failed_engine_init(Config) when is_list(Config) ->
+    try
+        case crypto:get_test_engine() of
+            {error, notexist} ->
+                {skip, "OTP Test engine not found"};
+            {ok, Engine} ->
+                case crypto:engine_load(<<"dynamic">>,
+                                        [{<<"SO_PATH">>, Engine},
+                                         {<<"ID">>, <<"MD5">>}],
+                                        []) of
+                    {error, add_engine_failed} ->
+                        ok;
+                    {error, bad_engine_id} ->
+                        {skip, "Dynamic Engine not supported"}
+                end
+        end
+   catch 
+       error:notsup ->
+          {skip, "Engine not supported on this OpenSSL version"}
+   end.