Merge branch 'ia/ssl/bottlenecks/OTP-10113' into maint

* ia/ssl/bottlenecks/OTP-10113:
  ssl: Test case fixes
  ssl: Avoid second bottleneck in supervisor
  ssl: File handling optimization
  ssl: Simpler PEM cache
  ssl: Refactored for readability
  ssl: Use md5 as file ref id instead of filenames
  ssl: Move ets:select bottleneck in server
  ssl: Renegotiate updates session id in gen_fsm state
  ssl: Use ordered_set in cache
  ssl: Move and avoid ets:select bottleneck in client
  ssl: Reuse session check optimization
  ssl: Avoid supervior bottleneck

7 files changed, 461 insertions, 402 deletions

diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 0bcdffbeff..5e3ced144a 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -30,7 +30,7 @@
 	 controlling_process/2, listen/2, pid/1, peername/1, peercert/1,
 	 recv/2, recv/3, send/2, getopts/2, setopts/2, sockname/1,
 	 versions/0, session_info/1, format_error/1,
-	 renegotiate/1, prf/5]).
+	 renegotiate/1, prf/5, clear_pem_cache/0]).
 
 -deprecated({pid, 1, next_major_release}).
 
@@ -431,6 +431,15 @@ prf(#sslsocket{pid = Pid, fd = new_ssl},
     Secret, Label, Seed, WantedLength) ->
     ssl_connection:prf(Pid, Secret, Label, Seed, WantedLength).
 
+
+%%--------------------------------------------------------------------
+-spec clear_pem_cache() -> ok.
+%%
+%% Description: Clear the PEM cache
+%%--------------------------------------------------------------------
+clear_pem_cache() ->
+    ssl_manager:clear_pem_cache().
+
 %%---------------------------------------------------------------
 -spec format_error({error, term()}) -> list().
 %%
@@ -532,7 +541,7 @@ handle_options(Opts0, _Role) ->
 		throw({error, {eoptions, {verify, Value}}})
 	end,
 
-    CertFile = handle_option(certfile, Opts, ""),
+    CertFile = handle_option(certfile, Opts, <<>>),
     
     SSLOptions = #ssl_options{
       versions   = handle_option(versions, Opts, []),
@@ -619,8 +628,12 @@ validate_option(depth, Value) when is_integer(Value),
 validate_option(cert, Value) when Value == undefined;
                                  is_binary(Value) ->
     Value;
-validate_option(certfile, Value) when Value == undefined; is_list(Value) ->
+validate_option(certfile, undefined = Value) ->
     Value;
+validate_option(certfile, Value) when is_binary(Value) ->
+    Value;
+validate_option(certfile, Value) when is_list(Value) ->
+    list_to_binary(Value);
 
 validate_option(key, undefined) ->
     undefined;
@@ -631,8 +644,13 @@ validate_option(key, {KeyType, Value}) when is_binary(Value),
 					    KeyType == 'DSAPrivateKey';
 					    KeyType == 'PrivateKeyInfo' ->
     {KeyType, Value};
-validate_option(keyfile, Value) when is_list(Value) ->
+
+validate_option(keyfile, undefined) ->
+   <<>>;
+validate_option(keyfile, Value) when is_binary(Value) ->
     Value;
+validate_option(keyfile, Value) when is_list(Value), Value =/= "" ->
+    list_to_binary(Value);
 validate_option(password, Value) when is_list(Value) ->
     Value;
 
@@ -642,16 +660,20 @@ validate_option(cacerts, Value) when Value == undefined;
 %% certfile must be present in some cases otherwhise it can be set
 %% to the empty string.
 validate_option(cacertfile, undefined) ->
-    "";
-validate_option(cacertfile, Value) when is_list(Value), Value =/= "" ->
+   <<>>;
+validate_option(cacertfile, Value) when is_binary(Value) ->
     Value;
+validate_option(cacertfile, Value) when is_list(Value), Value =/= ""->
+    list_to_binary(Value);
 validate_option(dh, Value) when Value == undefined;
 				is_binary(Value) ->
     Value;
 validate_option(dhfile, undefined = Value)  ->
     Value;
-validate_option(dhfile, Value) when is_list(Value), Value =/= "" ->
+validate_option(dhfile, Value) when is_binary(Value) ->
     Value;
+validate_option(dhfile, Value) when is_list(Value), Value =/= "" ->
+    list_to_binary(Value);
 validate_option(ciphers, Value)  when is_list(Value) ->
     Version = ssl_record:highest_protocol_version([]),
     try cipher_suites(Version, Value)
diff --git a/lib/ssl/src/ssl_certificate_db.erl b/lib/ssl/src/ssl_certificate_db.erl
index cb2473576a..01ddf056c9 100644
--- a/lib/ssl/src/ssl_certificate_db.erl
+++ b/lib/ssl/src/ssl_certificate_db.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2007-2011. All Rights Reserved.
+%% Copyright Ericsson AB 2007-2012. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -24,12 +24,13 @@
 -module(ssl_certificate_db).
 -include("ssl_internal.hrl").
 -include_lib("public_key/include/public_key.hrl").
+-include_lib("kernel/include/file.hrl").
 
 -export([create/0, remove/1, add_trusted_certs/3, 
-	 remove_trusted_certs/2, lookup_trusted_cert/4, foldl/3, 
-	 lookup_cached_certs/2, cache_pem_file/4, uncache_pem_file/2, lookup/2]).
-
--type time()      :: {non_neg_integer(), non_neg_integer(), non_neg_integer()}.
+	 remove_trusted_certs/2, insert/3, remove/2, clear/1, db_size/1,
+	 ref_count/3, lookup_trusted_cert/4, foldl/3,
+	 lookup_cached_pem/2, cache_pem_file/2, cache_pem_file/3,
+	 lookup/2]).
 
 %%====================================================================
 %% Internal application API
@@ -43,9 +44,14 @@
 %% the process that called create may call the other functions.
 %%--------------------------------------------------------------------
 create() ->
-    [ets:new(ssl_otp_certificate_db, [set, protected]),
-     ets:new(ssl_file_to_ref, [set, protected]),
-     ets:new(ssl_pid_to_file, [bag, private])]. 
+    [%% Let connection process delete trusted certs
+     %% that can only belong to one connection. (Supplied directly
+     %% on DER format to ssl:connect/listen.)
+     ets:new(ssl_otp_cacertificate_db, [set, public]),
+     %% Let connection processes call ref_count/3 directly
+     ets:new(ssl_otp_ca_file_ref, [set, public]),
+     ets:new(ssl_otp_pem_cache, [set, protected])
+    ].
 
 %%--------------------------------------------------------------------
 -spec remove([db_handle()]) -> term().
@@ -53,7 +59,9 @@ create() ->
 %% Description: Removes database db  
 %%--------------------------------------------------------------------
 remove(Dbs) ->
-    lists:foreach(fun(Db) -> true = ets:delete(Db) end, Dbs).
+    lists:foreach(fun(Db) ->
+			  true = ets:delete(Db)
+		  end, Dbs).
 
 %%--------------------------------------------------------------------
 -spec lookup_trusted_cert(db_handle(), certdb_ref(), serialnumber(), issuer()) ->
@@ -72,11 +80,14 @@ lookup_trusted_cert(DbHandle, Ref, SerialNumber, Issuer) ->
 	    {ok, Certs}
     end.
 
-lookup_cached_certs(DbHandle, File) ->
-    ets:lookup(DbHandle, {file, File}).
+lookup_cached_pem([_, _, PemChache], MD5) ->
+    lookup_cached_pem(PemChache, MD5);
+lookup_cached_pem(PemChache, MD5) ->
+    lookup(MD5, PemChache).
 
 %%--------------------------------------------------------------------
--spec add_trusted_certs(pid(), string() | {der, list()}, [db_handle()]) -> {ok, [db_handle()]}.
+-spec add_trusted_certs(pid(), {erlang:timestamp(), string()} |
+			{der, list()}, [db_handle()]) -> {ok, [db_handle()]}.
 %%
 %% Description: Adds the trusted certificates from file <File> to the
 %% runtime database. Returns Ref that should be handed to lookup_trusted_cert
@@ -86,82 +97,55 @@ add_trusted_certs(_Pid, {der, DerList}, [CerDb, _,_]) ->
     NewRef = make_ref(),
     add_certs_from_der(DerList, NewRef, CerDb),
     {ok, NewRef};
-add_trusted_certs(Pid, File, [CertsDb, FileToRefDb, PidToFileDb]) ->
-    Ref = case lookup(File, FileToRefDb) of
-	      undefined ->
-		  NewRef = make_ref(),
-		  add_certs_from_file(File, NewRef, CertsDb),
-		  insert(File, NewRef, 1, FileToRefDb),
-		  NewRef;
-	      [OldRef] ->
-		  ref_count(File,FileToRefDb,1),
-		  OldRef
-	  end,
-    insert(Pid, File, PidToFileDb),
-    {ok, Ref}.
+
+add_trusted_certs(_Pid, File, [CertsDb, RefDb, PemChache] = Db) ->
+    MD5 = crypto:md5(File),
+    case lookup_cached_pem(Db, MD5) of
+	[{_Content, Ref}] ->
+	    ref_count(Ref, RefDb, 1),
+	    {ok, Ref};
+	[Content] ->
+	    Ref = make_ref(),
+	    insert(Ref, [], 1, RefDb),
+	    insert(MD5, {Content, Ref}, PemChache),
+	    add_certs_from_pem(Content, Ref, CertsDb),
+	    {ok, Ref};
+	undefined ->
+	    new_trusted_cert_entry({MD5, File}, Db)
+    end.
 %%--------------------------------------------------------------------
--spec cache_pem_file(pid(), string(), time(), [db_handle()]) -> term().
+-spec cache_pem_file(string(), [db_handle()]) -> term().
+-spec cache_pem_file(reference(), string(), [db_handle()]) -> term().
 %%
 %% Description: Cache file as binary in DB
 %%--------------------------------------------------------------------
-cache_pem_file(Pid, File, Time, [CertsDb, _FileToRefDb, PidToFileDb]) ->
-    {ok, PemBin} = file:read_file(File), 
+cache_pem_file({MD5, File}, [_CertsDb, _RefDb, PemChache]) ->
+    {ok, PemBin} = file:read_file(File),
     Content = public_key:pem_decode(PemBin),
-    insert({file, File}, {Time, Content}, CertsDb),
-    insert(Pid, File, PidToFileDb),
+    insert(MD5, Content, PemChache),
     {ok, Content}.
 
-%--------------------------------------------------------------------
--spec uncache_pem_file(string(), [db_handle()]) -> no_return().
-%%
-%% Description: If a cached file is no longer valid (changed on disk)
-%% we must terminate the connections using the old file content, and
-%% when those processes are finish the cache will be cleaned. It is
-%% a rare but possible case a new ssl client/server is started with
-%% a filename with the same name as previously started client/server
-%% but with different content.
-%% --------------------------------------------------------------------
-uncache_pem_file(File, [_CertsDb, _FileToRefDb, PidToFileDb]) ->
-    Pids = select(PidToFileDb, [{{'$1', File},[],['$$']}]),
-    lists:foreach(fun([Pid]) ->
-			  exit(Pid, shutdown)
-		  end, Pids).
-
-%%--------------------------------------------------------------------
--spec remove_trusted_certs(pid(), [db_handle()]) -> term().
-				  
-%%
-%% Description: Removes trusted certs originating from 
-%% the file associated to Pid from the runtime database.  
-%%--------------------------------------------------------------------
-remove_trusted_certs(Pid, [CertsDb, FileToRefDb, PidToFileDb]) ->
-    Files = lookup(Pid, PidToFileDb),
-    delete(Pid, PidToFileDb),
-    Clear = fun(File) ->
-		    delete({file,File}, CertsDb),
-		    try
-			0 = ref_count(File, FileToRefDb, -1),
-			case lookup(File, FileToRefDb) of
-			    [Ref] when is_reference(Ref) ->
-				remove_certs(Ref, CertsDb);
-			    _ -> ok
-			end,
-			delete(File, FileToRefDb)
-		    catch _:_ ->
-			    ok
-		    end
-	    end,
-    case Files of 
-	undefined -> ok;
-	_ -> 
-	    [Clear(File) || File <- Files],
-	    ok
-    end.
+cache_pem_file(Ref, {MD5, File}, [_CertsDb, _RefDb, PemChache]) ->
+    {ok, PemBin} = file:read_file(File),
+    Content = public_key:pem_decode(PemBin),
+    insert(MD5, {Content, Ref}, PemChache),
+    {ok, Content}.
+
+remove_trusted_certs(Ref, CertsDb) ->
+    remove_certs(Ref, CertsDb).
+
+%%--------------------------------------------------------------------
+-spec remove(term(), db_handle()) -> term().
+%%
+%% Description: Removes an element in a <Db>.
+%%--------------------------------------------------------------------
+remove(Key, Db) ->
+    _ = ets:delete(Db, Key).
 
 %%--------------------------------------------------------------------
 -spec lookup(term(), db_handle()) -> term() | undefined.
 %%
-%% Description: Looks up an element in a certificat <Db>.
+%% Description: Looks up an element in a <Db>.
 %%--------------------------------------------------------------------
 lookup(Key, Db) ->
     case ets:lookup(Db, Key) of
@@ -184,25 +168,47 @@ lookup(Key, Db) ->
 %%--------------------------------------------------------------------
 foldl(Fun, Acc0, Cache) ->
     ets:foldl(Fun, Acc0, Cache).
-  
+
 %%--------------------------------------------------------------------
-%%% Internal functions
+-spec ref_count(term(), db_handle(), integer()) -> integer().
+%%
+%% Description: Updates a reference counter in a <Db>.
+%%--------------------------------------------------------------------
+ref_count(Key, Db, N) ->
+    ets:update_counter(Db,Key,N).
+
+%%--------------------------------------------------------------------
+-spec clear(db_handle()) -> term().
+%%
+%% Description: Clears the cache
+%%--------------------------------------------------------------------
+clear(Db) ->
+    ets:delete_all_objects(Db).
+
+%%--------------------------------------------------------------------
+-spec db_size(db_handle()) -> integer().
+%%
+%% Description: Returns the size of the db
+%%--------------------------------------------------------------------
+db_size(Db) ->
+    ets:info(Db, size).
+
+%%--------------------------------------------------------------------
+%%-spec insert(Key::term(), Data::term(), Db::db_handle()) -> no_return().
+%%
+%% Description: Inserts data into <Db>
 %%--------------------------------------------------------------------
 insert(Key, Data, Db) ->
     true = ets:insert(Db, {Key, Data}).
 
+%%--------------------------------------------------------------------
+%%% Internal functions
+%%--------------------------------------------------------------------
+insert(Key, [], Count, Db) ->
+    true = ets:insert(Db, {Key, Count});
 insert(Key, Data, Count, Db) ->
     true = ets:insert(Db, {Key, Count, Data}).
 
-ref_count(Key, Db,N) ->
-    ets:update_counter(Db,Key,N).
-
-delete(Key, Db) ->
-    _ = ets:delete(Db, Key).
-
-select(Db, MatchSpec)->
-    ets:select(Db, MatchSpec).
-
 remove_certs(Ref, CertsDb) ->
     ets:match_delete(CertsDb, {{Ref, '_', '_'}, '_'}).
 
@@ -210,10 +216,8 @@ add_certs_from_der(DerList, Ref, CertsDb) ->
     Add = fun(Cert) -> add_certs(Cert, Ref, CertsDb) end,
      [Add(Cert) || Cert <- DerList].
 
-add_certs_from_file(File, Ref, CertsDb) ->   
+add_certs_from_pem(PemEntries, Ref, CertsDb) ->
     Add = fun(Cert) -> add_certs(Cert, Ref, CertsDb) end,
-    {ok, PemBin} = file:read_file(File),
-    PemEntries = public_key:pem_decode(PemBin),
     [Add(Cert) || {'Certificate', Cert, not_encrypted} <- PemEntries].
     
 add_certs(Cert, Ref, CertsDb) ->
@@ -229,3 +233,10 @@ add_certs(Cert, Ref, CertsDb) ->
 				   "it could not be correctly decoded.~n", []),
 	    error_logger:info_report(Report)
     end.
+
+new_trusted_cert_entry(FileRef, [CertsDb, RefDb, _] = Db) ->
+    Ref = make_ref(),
+    insert(Ref, [], 1, RefDb),
+    {ok, Content} = cache_pem_file(Ref, FileRef, Db),
+    add_certs_from_pem(Content, Ref, CertsDb),
+    {ok, Ref}.
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index 6c06baff98..0f436a6caf 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -47,8 +47,8 @@
 -export([start_link/7]). 
 
 %% gen_fsm callbacks
--export([init/1, hello/2, certify/2, cipher/2, connection/2, 
-	 abbreviated/2, handle_event/3,
+-export([init/1, hello/2, certify/2, cipher/2,
+	 abbreviated/2, connection/2, handle_event/3,
          handle_sync_event/4, handle_info/3, terminate/3, code_change/4]).
 
 -record(state, {
@@ -83,7 +83,8 @@
 	  diffie_hellman_params, % PKIX: #'DHParameter'{} relevant for server side
 	  diffie_hellman_keys, % {PublicKey, PrivateKey}
           premaster_secret,    %
-          cert_db_ref,         % ets_table()
+	  file_ref_db,         % ets()
+          cert_db_ref,         % ref()
           from,                % term(), where to reply
           bytes_to_read,       % integer(), # bytes to read in passive mode
           user_data_buffer,    % binary()
@@ -297,39 +298,30 @@ prf(ConnectionPid, Secret, Label, Seed, WantedLength) ->
 %% does not return until Module:init/1 has returned.  
 %%--------------------------------------------------------------------
 start_link(Role, Host, Port, Socket, Options, User, CbInfo) ->
-    gen_fsm:start_link(?MODULE, [Role, Host, Port, Socket, Options,
-				 User, CbInfo], []).
+    {ok, proc_lib:spawn_link(?MODULE, init, [[Role, Host, Port, Socket, Options, User, CbInfo]])}.
 
-%%====================================================================
-%% gen_fsm callbacks
-%%====================================================================
-%%--------------------------------------------------------------------
-%% Description:Whenever a gen_fsm is started using gen_fsm:start/[3,4] or
-%% gen_fsm:start_link/3,4, this function is called by the new process to 
-%% initialize. 
-%%--------------------------------------------------------------------
-init([Role, Host, Port, Socket, {SSLOpts0, _} = Options, 
-      User, CbInfo]) ->
+init([Role, Host, Port, Socket, {SSLOpts0, _} = Options,  User, CbInfo]) ->
     State0 = initial_state(Role, Host, Port, Socket, Options, User, CbInfo),
     Hashes0 = ssl_handshake:init_hashes(),    
     TimeStamp = calendar:datetime_to_gregorian_seconds({date(), time()}),
     try ssl_init(SSLOpts0, Role) of
-	{ok, Ref, CertDbHandle, CacheHandle, OwnCert, Key, DHParams} ->
+	{ok, Ref, CertDbHandle, FileRefHandle, CacheHandle, OwnCert, Key, DHParams} ->
 	    Session = State0#state.session,
 	    State = State0#state{tls_handshake_hashes = Hashes0,
 				 session = Session#session{own_certificate = OwnCert,
 							   time_stamp = TimeStamp},
+				 file_ref_db = FileRefHandle,
 				 cert_db_ref = Ref,
 				 cert_db = CertDbHandle,
 				 session_cache = CacheHandle,
 				 private_key = Key,
 				 diffie_hellman_params = DHParams},
-	    {ok, hello, State, get_timeout(State)}
-    catch   
+	    gen_fsm:enter_loop(?MODULE, [], hello, State, get_timeout(State))
+    catch
 	throw:Error ->
-	    {stop, Error}
+	    gen_fsm:enter_loop(?MODULE, [], error, {Error,State0}, get_timeout(State0))
     end.
-   
+
 %%--------------------------------------------------------------------
 %% Description:There should be one instance of this function for each
 %% possible state name. Whenever a gen_fsm receives an event sent
@@ -337,6 +329,7 @@ init([Role, Host, Port, Socket, {SSLOpts0, _} = Options,
 %% same name as the current state name StateName is called to handle
 %% the event. It is also called if a timeout occurs.
 %%
+
 %%--------------------------------------------------------------------
 -spec hello(start | #hello_request{} | #client_hello{} | #server_hello{} | term(),
 	    #state{}) -> gen_fsm_state_return().    
@@ -344,23 +337,23 @@ init([Role, Host, Port, Socket, {SSLOpts0, _} = Options,
 hello(start, #state{host = Host, port = Port, role = client,
 		    ssl_options = SslOpts, 
 		    session = #session{own_certificate = Cert} = Session0,
+		    session_cache = Cache, session_cache_cb = CacheCb,
 		    transport_cb = Transport, socket = Socket,
-		    connection_states = ConnectionStates,
+		    connection_states = ConnectionStates0,
 		    renegotiation = {Renegotiation, _}} = State0) ->
-    Hello = ssl_handshake:client_hello(Host, Port, 
-				       ConnectionStates, 
-				       SslOpts, Renegotiation, Cert),
+    Hello = ssl_handshake:client_hello(Host, Port, ConnectionStates0, SslOpts,
+				       Cache, CacheCb, Renegotiation, Cert),
 
     Version = Hello#client_hello.client_version,
     Hashes0 = ssl_handshake:init_hashes(),
-    {BinMsg, CS2, Hashes1} = 
-        encode_handshake(Hello, Version, ConnectionStates, Hashes0),
+    {BinMsg, ConnectionStates, Hashes} =
+        encode_handshake(Hello, Version, ConnectionStates0, Hashes0),
     Transport:send(Socket, BinMsg),
-    State1 = State0#state{connection_states = CS2,
-			 negotiated_version = Version, %% Requested version
+    State1 = State0#state{connection_states = ConnectionStates,
+			  negotiated_version = Version, %% Requested version at this point
 			  session =
 			      Session0#session{session_id = Hello#client_hello.session_id},
-			  tls_handshake_hashes = Hashes1},
+			  tls_handshake_hashes = Hashes},
     {Record, State} = next_record(State1),
     next_state(hello, hello, Record, State);
 
@@ -394,7 +387,8 @@ hello(#server_hello{cipher_suite = CipherSuite,
 	    
 	    case ssl_session:is_new(OldId, NewId) of
 		true ->
-		    handle_new_session(NewId, CipherSuite, Compression, State);
+		    handle_new_session(NewId, CipherSuite, Compression,
+				       State#state{connection_states = ConnectionStates});
 		false ->
 		    handle_resumed_session(NewId, State#state{connection_states = ConnectionStates}) 
 	    end;
@@ -552,8 +546,8 @@ certify(#server_hello_done{},
 	       role = client} = State0) ->
     case ssl_handshake:master_secret(Version, Session, 
 				     ConnectionStates0, client) of
-	{MasterSecret, ConnectionStates1} -> 
-	    State = State0#state{connection_states = ConnectionStates1},
+	{MasterSecret, ConnectionStates} ->
+	    State = State0#state{connection_states = ConnectionStates},
 	    client_certify_and_key_exchange(State);
 	#alert{} = Alert ->
 	    handle_own_alert(Alert, Version, certify, State0),
@@ -569,10 +563,10 @@ certify(#server_hello_done{},
 	       role = client} = State0) ->    
     case ssl_handshake:master_secret(Version, PremasterSecret, 
 				     ConnectionStates0, client) of
-	{MasterSecret, ConnectionStates1} -> 
+	{MasterSecret, ConnectionStates} ->
 	    Session = Session0#session{master_secret = MasterSecret},
-	    State = State0#state{connection_states = ConnectionStates1,
-				  session = Session},
+	    State = State0#state{connection_states = ConnectionStates,
+				 session = Session},
 	    client_certify_and_key_exchange(State);
 	#alert{} = Alert ->
 	    handle_own_alert(Alert, Version, certify, State0),
@@ -691,22 +685,24 @@ cipher(Msg, State) ->
 %%--------------------------------------------------------------------
 connection(#hello_request{}, #state{host = Host, port = Port,
 				    socket = Socket,
-				    session = #session{own_certificate = Cert},
+				    session = #session{own_certificate = Cert} = Session0,
+				    session_cache = Cache, session_cache_cb = CacheCb,
 				    ssl_options = SslOpts,
 				    negotiated_version = Version,
 				    transport_cb = Transport,
 				    connection_states = ConnectionStates0,
 				    renegotiation = {Renegotiation, _},
 				    tls_handshake_hashes = Hashes0} = State0) ->
-    Hello = ssl_handshake:client_hello(Host, Port, ConnectionStates0,
-				       SslOpts, Renegotiation, Cert),
+    Hello = ssl_handshake:client_hello(Host, Port, ConnectionStates0, SslOpts,
+				       Cache, CacheCb, Renegotiation, Cert),
   
-    {BinMsg, ConnectionStates1, Hashes1} =
+    {BinMsg, ConnectionStates, Hashes} =
         encode_handshake(Hello, Version, ConnectionStates0, Hashes0),
     Transport:send(Socket, BinMsg),
     {Record, State} = next_record(State0#state{connection_states =  
-					       ConnectionStates1,
-					       tls_handshake_hashes = Hashes1}),
+					       ConnectionStates,
+					       session = Session0#session{session_id = Hello#client_hello.session_id},
+					       tls_handshake_hashes = Hashes}),
     next_state(connection, hello, Record, State);
 connection(#client_hello{} = Hello, #state{role = server, allow_renegotiate = true} = State) ->
     %% Mitigate Computational DoS attack
@@ -732,6 +728,7 @@ connection(timeout, State) ->
 
 connection(Msg, State) ->
     handle_unexpected_message(Msg, connection, State).
+
 %%--------------------------------------------------------------------
 %% Description: Whenever a gen_fsm receives an event sent using
 %% gen_fsm:send_all_state_event/2, this function is called to handle
@@ -774,6 +771,8 @@ handle_sync_event(start, From, hello, State) ->
 %% they upgrade a active socket. 
 handle_sync_event(start, _, connection, State) ->
     {reply, connected, connection, State, get_timeout(State)};
+handle_sync_event(start, _From, error, {Error, State = #state{}}) ->
+    {stop, {shutdown, Error}, {error, Error}, State};
 handle_sync_event(start, From, StateName, State) ->
     {next_state, StateName, State#state{from = From}, get_timeout(State)};
 
@@ -1002,16 +1001,19 @@ terminate(Reason, connection, #state{negotiated_version = Version,
 				      connection_states = ConnectionStates,
 				      transport_cb = Transport,
 				      socket = Socket, send_queue = SendQueue,
-				      renegotiation = Renegotiate}) ->
+				      renegotiation = Renegotiate} = State) ->
+    handle_trusted_certs_db(State),
     notify_senders(SendQueue),
     notify_renegotiater(Renegotiate),
     BinAlert = terminate_alert(Reason, Version, ConnectionStates),
     Transport:send(Socket, BinAlert),
     workaround_transport_delivery_problems(Socket, Transport, Reason),
     Transport:close(Socket);
+
 terminate(Reason, _StateName, #state{transport_cb = Transport,
 				      socket = Socket, send_queue = SendQueue,
-				      renegotiation = Renegotiate}) ->
+				      renegotiation = Renegotiate} = State) ->
+    handle_trusted_certs_db(State),
     notify_senders(SendQueue),
     notify_renegotiater(Renegotiate),
     workaround_transport_delivery_problems(Socket, Transport, Reason),
@@ -1059,12 +1061,12 @@ ssl_init(SslOpts, Role) ->
     
     init_manager_name(SslOpts#ssl_options.erl_dist),
 
-    {ok, CertDbRef, CertDbHandle, CacheHandle, OwnCert} = init_certificates(SslOpts, Role),
+    {ok, CertDbRef, CertDbHandle, FileRefHandle, PemCacheHandle, CacheHandle, OwnCert} = init_certificates(SslOpts, Role),
     PrivateKey =
-	init_private_key(CertDbHandle, SslOpts#ssl_options.key, SslOpts#ssl_options.keyfile,
+	init_private_key(PemCacheHandle, SslOpts#ssl_options.key, SslOpts#ssl_options.keyfile,
 			 SslOpts#ssl_options.password, Role),
-    DHParams = init_diffie_hellman(CertDbHandle, SslOpts#ssl_options.dh, SslOpts#ssl_options.dhfile, Role),
-    {ok, CertDbRef, CertDbHandle, CacheHandle, OwnCert, PrivateKey, DHParams}.
+    DHParams = init_diffie_hellman(PemCacheHandle, SslOpts#ssl_options.dh, SslOpts#ssl_options.dhfile, Role),
+    {ok, CertDbRef, CertDbHandle, FileRefHandle, CacheHandle, OwnCert, PrivateKey, DHParams}.
 
 init_manager_name(false) ->
     put(ssl_manager, ssl_manager);
@@ -1075,7 +1077,7 @@ init_certificates(#ssl_options{cacerts = CaCerts,
 			       cacertfile = CACertFile,
 			       certfile = CertFile,
 			       cert = Cert}, Role) ->
-    {ok, CertDbRef, CertDbHandle, CacheHandle} =
+    {ok, CertDbRef, CertDbHandle, FileRefHandle, PemCacheHandle, CacheHandle} =
 	try 
 	    Certs = case CaCerts of
 			undefined ->
@@ -1083,38 +1085,38 @@ init_certificates(#ssl_options{cacerts = CaCerts,
 			_ ->
 			    {der, CaCerts}
 		    end,
-	    {ok, _, _, _} = ssl_manager:connection_init(Certs, Role)
+	    {ok, _, _, _, _, _} = ssl_manager:connection_init(Certs, Role)
 	catch
 	    Error:Reason ->
 		handle_file_error(?LINE, Error, Reason, CACertFile, ecacertfile,
 				  erlang:get_stacktrace())
 	end,
-    init_certificates(Cert, CertDbRef, CertDbHandle, CacheHandle, CertFile, Role).
+    init_certificates(Cert, CertDbRef, CertDbHandle, FileRefHandle, PemCacheHandle, CacheHandle, CertFile, Role).
 
-init_certificates(undefined, CertDbRef, CertDbHandle, CacheHandle, "", _) ->
-    {ok, CertDbRef, CertDbHandle, CacheHandle, undefined};
+init_certificates(undefined, CertDbRef, CertDbHandle, FileRefHandle, PemCacheHandle, CacheHandle, <<>>, _) ->
+    {ok, CertDbRef, CertDbHandle, FileRefHandle, PemCacheHandle, CacheHandle, undefined};
 
-init_certificates(undefined, CertDbRef, CertDbHandle, CacheHandle, CertFile, client) ->
+init_certificates(undefined, CertDbRef, CertDbHandle, FileRefHandle, PemCacheHandle, CacheHandle, CertFile, client) ->
     try 
-	[OwnCert] = ssl_certificate:file_to_certificats(CertFile, CertDbHandle),
-	{ok, CertDbRef, CertDbHandle, CacheHandle, OwnCert}
+	[OwnCert] = ssl_certificate:file_to_certificats(CertFile, PemCacheHandle),
+	{ok, CertDbRef, CertDbHandle, FileRefHandle, PemCacheHandle, CacheHandle, OwnCert}
     catch _Error:_Reason  ->
-	    {ok, CertDbRef, CertDbHandle, CacheHandle, undefined}
+	    {ok, CertDbRef, CertDbHandle, FileRefHandle, PemCacheHandle, CacheHandle, undefined}
     end;
 
-init_certificates(undefined, CertDbRef, CertDbHandle, CacheRef, CertFile, server) ->
+init_certificates(undefined, CertDbRef, CertDbHandle, FileRefHandle, PemCacheHandle, CacheRef, CertFile, server) ->
     try
-	[OwnCert] = ssl_certificate:file_to_certificats(CertFile, CertDbHandle),
-	{ok, CertDbRef, CertDbHandle, CacheRef, OwnCert}
+	[OwnCert] = ssl_certificate:file_to_certificats(CertFile, PemCacheHandle),
+	{ok, CertDbRef, CertDbHandle, FileRefHandle, PemCacheHandle, CacheRef, OwnCert}
     catch
 	Error:Reason ->
 	    handle_file_error(?LINE, Error, Reason, CertFile, ecertfile,
 			      erlang:get_stacktrace())
     end;
-init_certificates(Cert, CertDbRef, CertDbHandle, CacheRef, _, _) ->
-    {ok, CertDbRef, CertDbHandle, CacheRef, Cert}.
+init_certificates(Cert, CertDbRef, CertDbHandle, FileRefHandle, PemCacheHandle, CacheRef, _, _) ->
+    {ok, CertDbRef, CertDbHandle, FileRefHandle, PemCacheHandle, CacheRef, Cert}.
 
-init_private_key(_, undefined, "", _Password, _Client) ->
+init_private_key(_, undefined, <<>>, _Password, _Client) ->
     undefined;
 init_private_key(DbHandle, undefined, KeyFile, Password, _) ->
     try
@@ -1225,11 +1227,11 @@ certify_client(#state{client_certificate_requested = true, role = client,
                       socket = Socket,
                       tls_handshake_hashes = Hashes0} = State) ->
     Certificate = ssl_handshake:certificate(OwnCert, CertDbHandle, CertDbRef, client),
-    {BinCert, ConnectionStates1, Hashes1} =
+    {BinCert, ConnectionStates, Hashes} =
         encode_handshake(Certificate, Version, ConnectionStates0, Hashes0),
     Transport:send(Socket, BinCert),
-            State#state{connection_states = ConnectionStates1, 
-                        tls_handshake_hashes = Hashes1};
+            State#state{connection_states = ConnectionStates,
+                        tls_handshake_hashes = Hashes};
 certify_client(#state{client_certificate_requested = false} = State) ->
     State.
 
@@ -1246,12 +1248,12 @@ verify_client_cert(#state{client_certificate_requested = true, role = client,
     case ssl_handshake:client_certificate_verify(OwnCert, MasterSecret, 
 						 Version, PrivateKey, Hashes0) of
         #certificate_verify{} = Verified ->
-            {BinVerified, ConnectionStates1, Hashes1} = 
+            {BinVerified, ConnectionStates, Hashes} =
                 encode_handshake(Verified, Version,
                                  ConnectionStates0, Hashes0),
             Transport:send(Socket, BinVerified),
-            State#state{connection_states = ConnectionStates1,
-                        tls_handshake_hashes = Hashes1};
+            State#state{connection_states = ConnectionStates,
+                        tls_handshake_hashes = Hashes};
 	ignore ->
 	    State;
 	#alert{} = Alert ->
@@ -1261,7 +1263,7 @@ verify_client_cert(#state{client_certificate_requested = false} = State) ->
     State.
 
 do_server_hello(Type, #state{negotiated_version = Version,
-			     session = #session{session_id = SessId} = Session,
+			     session = #session{session_id = SessId},
 			     connection_states = ConnectionStates0,
 			     renegotiation = {Renegotiation, _}} 
 		= State0) when is_atom(Type) -> 
@@ -1269,29 +1271,13 @@ do_server_hello(Type, #state{negotiated_version = Version,
     ServerHello = 
         ssl_handshake:server_hello(SessId, Version, 
                                    ConnectionStates0, Renegotiation),
-    State1 = server_hello(ServerHello, State0),
+    State = server_hello(ServerHello, State0),
     
     case Type of	
 	new ->
-	    new_server_hello(ServerHello, State1);
+	    new_server_hello(ServerHello, State);
 	resumed ->
-	    ConnectionStates1 = State1#state.connection_states,
-	    case ssl_handshake:master_secret(Version, Session,
-					     ConnectionStates1, server) of
-		{_, ConnectionStates2} ->
-		    State2 = State1#state{connection_states=ConnectionStates2, 
-					  session = Session},		    
-		    {ConnectionStates, Hashes} = 
-			finalize_handshake(State2, abbreviated),
-		    State3 = State2#state{connection_states = 
-					  ConnectionStates,
-					  tls_handshake_hashes = Hashes},
-		    {Record, State} = next_record(State3),
-		    next_state(hello, abbreviated, Record, State);
-		#alert{} = Alert ->
-		    handle_own_alert(Alert, Version, hello, State1), 
-		    {stop, normal, State1}
-	    end
+	    resumed_server_hello(State)
     end.
 
 new_server_hello(#server_hello{cipher_suite = CipherSuite,
@@ -1314,6 +1300,27 @@ new_server_hello(#server_hello{cipher_suite = CipherSuite,
 	    {stop, normal, State0}
     end.
 
+resumed_server_hello(#state{session = Session,
+			    connection_states = ConnectionStates0,
+			    negotiated_version = Version} = State0) ->
+
+    case ssl_handshake:master_secret(Version, Session,
+				     ConnectionStates0, server) of
+	{_, ConnectionStates1} ->
+	    State1 = State0#state{connection_states = ConnectionStates1,
+				  session = Session},
+	    {ConnectionStates, Hashes} =
+		finalize_handshake(State1, abbreviated),
+	    State2 = State1#state{connection_states =
+				      ConnectionStates,
+				  tls_handshake_hashes = Hashes},
+	    {Record, State} = next_record(State2),
+	    next_state(hello, abbreviated, Record, State);
+	#alert{} = Alert ->
+		    handle_own_alert(Alert, Version, hello, State0),
+	    {stop, normal, State0}
+    end.
+
 handle_new_session(NewId, CipherSuite, Compression, #state{session = Session0} = State0) ->
     Session = Session0#session{session_id = NewId,
 			       cipher_suite = CipherSuite,
@@ -1329,10 +1336,10 @@ handle_resumed_session(SessId, #state{connection_states = ConnectionStates0,
     Session = CacheCb:lookup(Cache, {{Host, Port}, SessId}),
     case ssl_handshake:master_secret(Version, Session, 
 				     ConnectionStates0, client) of
-	{_, ConnectionStates1} ->	
+	{_, ConnectionStates} ->
 	    {Record, State} = 
 		next_record(State0#state{
-			      connection_states = ConnectionStates1,
+			      connection_states = ConnectionStates,
 			      session = Session}),
 	    next_state(hello, abbreviated, Record, State);
 	#alert{} = Alert ->
@@ -1385,16 +1392,16 @@ server_hello(ServerHello, #state{transport_cb = Transport,
 server_hello_done(#state{transport_cb = Transport,
                          socket = Socket,
                          negotiated_version = Version,
-                         connection_states = ConnectionStates,
-                         tls_handshake_hashes = Hashes} = State) ->
+                         connection_states = ConnectionStates0,
+                         tls_handshake_hashes = Hashes0} = State) ->
     
     HelloDone = ssl_handshake:server_hello_done(),
     
-    {BinHelloDone, NewConnectionStates, NewHashes} =
-        encode_handshake(HelloDone, Version, ConnectionStates, Hashes),
+    {BinHelloDone, ConnectionStates, Hashes} =
+        encode_handshake(HelloDone, Version, ConnectionStates0, Hashes0),
     Transport:send(Socket, BinHelloDone),
-    State#state{connection_states = NewConnectionStates,
-		tls_handshake_hashes = NewHashes}.
+    State#state{connection_states = ConnectionStates,
+		tls_handshake_hashes = Hashes}.
 
 certify_server(#state{key_algorithm = dh_anon} = State) ->
     State;
@@ -1402,18 +1409,18 @@ certify_server(#state{key_algorithm = dh_anon} = State) ->
 certify_server(#state{transport_cb = Transport,
 		      socket = Socket,
 		      negotiated_version = Version,
-		      connection_states = ConnectionStates,
-		      tls_handshake_hashes = Hashes,
+		      connection_states = ConnectionStates0,
+		      tls_handshake_hashes = Hashes0,
 		      cert_db = CertDbHandle,
 		      cert_db_ref = CertDbRef,
 		      session = #session{own_certificate = OwnCert}} = State) ->
     case ssl_handshake:certificate(OwnCert, CertDbHandle, CertDbRef, server) of
 	CertMsg = #certificate{} ->
-	    {BinCertMsg, NewConnectionStates, NewHashes} =
-		encode_handshake(CertMsg, Version, ConnectionStates, Hashes),
+	    {BinCertMsg, ConnectionStates, Hashes} =
+		encode_handshake(CertMsg, Version, ConnectionStates0, Hashes0),
 	    Transport:send(Socket, BinCertMsg),
-	    State#state{connection_states = NewConnectionStates,
-			tls_handshake_hashes = NewHashes
+	    State#state{connection_states = ConnectionStates,
+			tls_handshake_hashes = Hashes
 		       };
 	Alert = #alert{} ->
 	    throw(Alert)
@@ -1443,12 +1450,12 @@ key_exchange(#state{role = server, key_algorithm = Algo,
 					       Algo, ClientRandom, 
 					       ServerRandom,
 					       PrivateKey}),
-    {BinMsg, ConnectionStates, Hashes1} =
+    {BinMsg, ConnectionStates, Hashes} =
         encode_handshake(Msg, Version, ConnectionStates0, Hashes0),
     Transport:send(Socket, BinMsg),
     State#state{connection_states = ConnectionStates,
 		diffie_hellman_keys = Keys,
-                tls_handshake_hashes = Hashes1};
+                tls_handshake_hashes = Hashes};
 
 key_exchange(#state{role = client, 
 		    connection_states = ConnectionStates0,
@@ -1459,11 +1466,11 @@ key_exchange(#state{role = client,
 		    socket = Socket, transport_cb = Transport,
 		    tls_handshake_hashes = Hashes0} = State) ->
     Msg = rsa_key_exchange(PremasterSecret, PublicKeyInfo),    
-    {BinMsg, ConnectionStates1, Hashes1} =
+    {BinMsg, ConnectionStates, Hashes} =
         encode_handshake(Msg, Version, ConnectionStates0, Hashes0),
     Transport:send(Socket, BinMsg),
-    State#state{connection_states = ConnectionStates1,
-                tls_handshake_hashes = Hashes1};
+    State#state{connection_states = ConnectionStates,
+                tls_handshake_hashes = Hashes};
 key_exchange(#state{role = client, 
 		    connection_states = ConnectionStates0,
 		    key_algorithm = Algorithm,
@@ -1475,11 +1482,11 @@ key_exchange(#state{role = client,
        Algorithm == dhe_rsa;
        Algorithm == dh_anon ->
     Msg =  ssl_handshake:key_exchange(client, {dh, DhPubKey}),
-    {BinMsg, ConnectionStates1, Hashes1} =
+    {BinMsg, ConnectionStates, Hashes} =
         encode_handshake(Msg, Version, ConnectionStates0, Hashes0),
     Transport:send(Socket, BinMsg),
-    State#state{connection_states = ConnectionStates1,
-                tls_handshake_hashes = Hashes1}.
+    State#state{connection_states = ConnectionStates,
+                tls_handshake_hashes = Hashes}.
 
 rsa_key_exchange(PremasterSecret, PublicKeyInfo = {Algorithm, _, _})  
   when Algorithm == ?rsaEncryption;
@@ -1501,12 +1508,12 @@ request_client_cert(#state{ssl_options = #ssl_options{verify = verify_peer},
 			   socket = Socket,
 			   transport_cb = Transport} = State) ->
     Msg = ssl_handshake:certificate_request(ConnectionStates0, CertDbHandle, CertDbRef),
-    {BinMsg, ConnectionStates1, Hashes1} =
+    {BinMsg, ConnectionStates, Hashes} =
         encode_handshake(Msg, Version, ConnectionStates0, Hashes0),
     Transport:send(Socket, BinMsg),
     State#state{client_certificate_requested = true,
-		connection_states = ConnectionStates1,      
-		tls_handshake_hashes = Hashes1};
+		connection_states = ConnectionStates,
+		tls_handshake_hashes = Hashes};
 request_client_cert(#state{ssl_options = #ssl_options{verify = verify_none}} =
 		    State) ->
     State.
@@ -1843,8 +1850,9 @@ format_reply(binary, _, N, Data) when N > 0 ->  % Header mode
 format_reply(binary, _, _, Data) ->  
     Data;
 format_reply(list, Packet, _, Data)
-  when Packet == http; Packet == {http, headers};  Packet == http_bin; Packet == {http_bin, headers}; Packet == httph;
-       Packet == httph_bin->
+  when Packet == http; Packet == {http, headers};
+       Packet == http_bin; Packet == {http_bin, headers};
+       Packet == httph; Packet == httph_bin ->
     Data;
 format_reply(list, _,_, Data) ->
     binary_to_list(Data).
@@ -2359,7 +2367,29 @@ linux_workaround_transport_delivery_problems(#alert{level = ?FATAL}, Socket) ->
 linux_workaround_transport_delivery_problems(_, _) ->
     ok.
 
-get_timeout(#state{ssl_options=#ssl_options{hibernate_after=undefined}}) ->
+get_timeout(#state{ssl_options=#ssl_options{hibernate_after = undefined}}) ->
     infinity;
-get_timeout(#state{ssl_options=#ssl_options{hibernate_after=HibernateAfter}}) ->
+get_timeout(#state{ssl_options=#ssl_options{hibernate_after = HibernateAfter}}) ->
     HibernateAfter.
+
+handle_trusted_certs_db(#state{ssl_options = #ssl_options{cacertfile = <<>>}}) ->
+    %% No trusted certs specified
+    ok;
+handle_trusted_certs_db(#state{cert_db_ref = Ref,
+			       cert_db = CertDb,
+			       ssl_options = #ssl_options{cacertfile = undefined}}) ->
+    %% Certs provided as DER directly can not be shared
+    %% with other connections and it is safe to delete them when the connection ends.
+    ssl_certificate_db:remove_trusted_certs(Ref, CertDb);
+handle_trusted_certs_db(#state{file_ref_db = undefined}) ->
+    %% Something went wrong early (typically cacertfile does not exist) so there is nothing to handle
+    ok;
+handle_trusted_certs_db(#state{cert_db_ref = Ref,
+			       file_ref_db = RefDb,
+			       ssl_options = #ssl_options{cacertfile = File}}) ->
+    case ssl_certificate_db:ref_count(Ref, RefDb, -1) of
+	0 ->
+	    ssl_manager:clean_cert_db(Ref, File);
+	_ ->
+	    ok
+    end.
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index 2e0a3de182..06d45966c1 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -30,7 +30,7 @@
 -include("ssl_internal.hrl").
 -include_lib("public_key/include/public_key.hrl").
 
--export([master_secret/4, client_hello/6, server_hello/4, hello/4,
+-export([master_secret/4, client_hello/8, server_hello/4, hello/4,
 	 hello_request/0, certify/7, certificate/4,
 	 client_certificate_verify/5, certificate_verify/5,
 	 certificate_request/3, key_exchange/2, server_key_exchange_hash/2,
@@ -51,14 +51,17 @@
 %%====================================================================
 %%--------------------------------------------------------------------
 -spec client_hello(host(), inet:port_number(), #connection_states{},
-		   #ssl_options{}, boolean(), der_cert()) -> #client_hello{}.
+		   #ssl_options{}, integer(), atom(), boolean(), der_cert()) ->
+			  #client_hello{}.
 %%
 %% Description: Creates a client hello message.
 %%--------------------------------------------------------------------
-client_hello(Host, Port, ConnectionStates, #ssl_options{versions = Versions,
-							ciphers = UserSuites} 
-	     = SslOpts, Renegotiation, OwnCert) ->
-    
+client_hello(Host, Port, ConnectionStates,
+	     #ssl_options{versions = Versions,
+			  ciphers = UserSuites
+			 } = SslOpts,
+	     Cache, CacheCb, Renegotiation, OwnCert) ->
+
     Fun = fun(Version) ->
 		  ssl_record:protocol_version(Version)
 	  end,
@@ -67,15 +70,15 @@ client_hello(Host, Port, ConnectionStates, #ssl_options{versions = Versions,
     SecParams = Pending#connection_state.security_parameters,
     Ciphers = available_suites(UserSuites, Version),
 
-    Id = ssl_manager:client_session_id(Host, Port, SslOpts, OwnCert),
+    Id = ssl_session:client_id({Host, Port, SslOpts}, Cache, CacheCb, OwnCert),
 
-    #client_hello{session_id = Id, 
+    #client_hello{session_id = Id,
 		  client_version = Version,
 		  cipher_suites = cipher_suites(Ciphers, Renegotiation),
 		  compression_methods = ssl_record:compressions(),
 		  random = SecParams#security_parameters.client_random,
-		  renegotiation_info  = 
-		  renegotiation_info(client, ConnectionStates, Renegotiation)
+		  renegotiation_info =
+		      renegotiation_info(client, ConnectionStates, Renegotiation)
 		 }.
 
 %%--------------------------------------------------------------------
@@ -584,24 +587,23 @@ path_validation_alert({bad_cert, unknown_ca}) ->
 path_validation_alert(_) ->
     ?ALERT_REC(?FATAL, ?HANDSHAKE_FAILURE).
 
-select_session(Hello, Port, Session, Version, 
+select_session(Hello, Port, Session, Version,
 	       #ssl_options{ciphers = UserSuites} = SslOpts, Cache, CacheCb, Cert) ->
     SuggestedSessionId = Hello#client_hello.session_id,
-    SessionId = ssl_manager:server_session_id(Port, SuggestedSessionId, 
-					      SslOpts, Cert),
-    
-    Suites = available_suites(Cert, UserSuites, Version), 
-    case ssl_session:is_new(SuggestedSessionId, SessionId) of
-        true ->
-	    CipherSuite = 
-		select_cipher_suite(Hello#client_hello.cipher_suites, Suites),
+    {SessionId, Resumed} = ssl_session:server_id(Port, SuggestedSessionId,
+						 SslOpts, Cert,
+						 Cache, CacheCb),
+    Suites = available_suites(Cert, UserSuites, Version),
+    case Resumed of
+        undefined ->
+	    CipherSuite = select_cipher_suite(Hello#client_hello.cipher_suites, Suites),
 	    Compressions = Hello#client_hello.compression_methods,
 	    Compression = select_compression(Compressions),
 	    {new, Session#session{session_id = SessionId,
 				  cipher_suite = CipherSuite,
 				  compression_method = Compression}};
-	false ->	    
-	    {resumed, CacheCb:lookup(Cache, {Port, SessionId})}
+	_ ->
+	    {resumed, Resumed}
     end.
 
 available_suites(UserSuites, Version) ->
diff --git a/lib/ssl/src/ssl_manager.erl b/lib/ssl/src/ssl_manager.erl
index 6389ff03f5..a18cb70e2d 100644
--- a/lib/ssl/src/ssl_manager.erl
+++ b/lib/ssl/src/ssl_manager.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2007-2011. All Rights Reserved.
+%% Copyright Ericsson AB 2007-2012. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -30,9 +30,9 @@
 -export([start_link/1, start_link_dist/1,
 	 connection_init/2, cache_pem_file/2,
 	 lookup_trusted_cert/4,
-	 client_session_id/4, server_session_id/4,
+	 new_session_id/1, clean_cert_db/2,
 	 register_session/2, register_session/3, invalidate_session/2,
-	 invalidate_session/3]).
+	 invalidate_session/3, clear_pem_cache/0]).
 
 % Spawn export
 -export([init_session_validator/1]).
@@ -56,9 +56,12 @@
 
 -define('24H_in_msec', 8640000).
 -define('24H_in_sec', 8640).
+-define(GEN_UNIQUE_ID_MAX_TRIES, 10).
 -define(SESSION_VALIDATION_INTERVAL, 60000).
--define(CERTIFICATE_CACHE_CLEANUP, 30000).
+-define(CLEAR_PEM_CACHE, 120000).
 -define(CLEAN_SESSION_DB, 60000).
+-define(CLEAN_CERT_DB, 500).
+-define(NOT_TO_BIG, 10).
 
 %%====================================================================
 %% API
@@ -82,26 +85,46 @@ start_link_dist(Opts) ->
     gen_server:start_link({local, ssl_manager_dist}, ?MODULE, [ssl_manager_dist, Opts], []).
 
 %%--------------------------------------------------------------------
--spec connection_init(string()| {der, list()}, client | server) ->
+-spec connection_init(binary()| {der, list()}, client | server) ->
 			     {ok, certdb_ref(), db_handle(), db_handle()}.
 %%			     
 %% Description: Do necessary initializations for a new connection.
 %%--------------------------------------------------------------------
+connection_init({der, _} = Trustedcerts, Role) ->
+    call({connection_init, Trustedcerts, Role});
+
+connection_init(<<>> = Trustedcerts, Role) ->
+    call({connection_init, Trustedcerts, Role});
+
 connection_init(Trustedcerts, Role) ->
     call({connection_init, Trustedcerts, Role}).
+
 %%--------------------------------------------------------------------
--spec cache_pem_file(string(), term()) -> {ok, term()} | {error, reason()}.
+-spec cache_pem_file(binary(), term()) -> {ok, term()} | {error, reason()}.
 %%		    
 %% Description: Cach a pem file and return its content.
 %%--------------------------------------------------------------------
 cache_pem_file(File, DbHandle) ->
-    try file:read_file_info(File) of
-	{ok, #file_info{mtime = LastWrite}} ->
-	    cache_pem_file(File, LastWrite, DbHandle)
-    catch
-	_:Reason ->
-	    {error, Reason}
+    MD5 = crypto:md5(File),
+    case ssl_certificate_db:lookup_cached_pem(DbHandle, MD5) of
+	[Content] ->
+	   {ok, Content};
+	[{Content,_}] ->
+	    {ok, Content};
+	undefined ->
+	    call({cache_pem, {MD5, File}})
     end.
+
+%%--------------------------------------------------------------------
+-spec clear_pem_cache() -> ok.
+%%
+%% Description: Clear the PEM cache
+%%--------------------------------------------------------------------
+clear_pem_cache() ->
+    %% Not supported for distribution at the moement, should it be?
+    put(ssl_manager, ssl_manager),
+    call(unconditionally_clear_pem_cache).
+
 %%--------------------------------------------------------------------
 -spec lookup_trusted_cert(term(), reference(), serialnumber(), issuer()) ->
 				 undefined | 
@@ -114,22 +137,15 @@ lookup_trusted_cert(DbHandle, Ref, SerialNumber, Issuer) ->
     ssl_certificate_db:lookup_trusted_cert(DbHandle, Ref, SerialNumber, Issuer).
 
 %%--------------------------------------------------------------------
--spec client_session_id(host(), inet:port_number(), #ssl_options{},
-			der_cert() | undefined) -> session_id().
+-spec new_session_id(integer()) -> session_id().
 %%
-%% Description: Select a session id for the client.
+%% Description: Creates a session id for the server.
 %%--------------------------------------------------------------------
-client_session_id(Host, Port, SslOpts, OwnCert) ->
-    call({client_session_id, Host, Port, SslOpts, OwnCert}).
+new_session_id(Port) ->
+    call({new_session_id, Port}).
 
-%%--------------------------------------------------------------------
--spec server_session_id(host(), inet:port_number(), #ssl_options{},
-			der_cert()) -> session_id().
-%%
-%% Description: Select a session id for the server.
-%%--------------------------------------------------------------------
-server_session_id(Port, SuggestedSessionId, SslOpts, OwnCert) ->
-    call({server_session_id, Port, SuggestedSessionId, SslOpts, OwnCert}).
+clean_cert_db(Ref, File) ->
+    erlang:send_after(?CLEAN_CERT_DB, self(), {clean_cert_db, Ref, File}).
 
 %%--------------------------------------------------------------------
 -spec register_session(inet:port_number(), #session{}) -> ok.
@@ -177,6 +193,7 @@ init([Name, Opts]) ->
     SessionCache = CacheCb:init(proplists:get_value(session_cb_init_args, Opts, [])),
     Timer = erlang:send_after(SessionLifeTime * 1000, 
 			      self(), validate_sessions),
+    erlang:send_after(?CLEAR_PEM_CACHE, self(), clear_pem_cache),
     {ok, #state{certificate_db = CertDb,
 		session_cache = SessionCache,
 		session_cache_cb = CacheCb,
@@ -194,55 +211,44 @@ init([Name, Opts]) ->
 %%
 %% Description: Handling call messages
 %%--------------------------------------------------------------------
-handle_call({{connection_init, "", _Role}, Pid}, _From, 
-	    #state{certificate_db = [CertDb |_],
+handle_call({{connection_init, <<>>, _Role}, _Pid}, _From,
+	    #state{certificate_db = [CertDb, FileRefDb, PemChace],
 		   session_cache = Cache} = State) ->
-    erlang:monitor(process, Pid),
-    Result = {ok, make_ref(),CertDb, Cache},
+    Result = {ok, make_ref(),CertDb, FileRefDb, PemChace, Cache},
     {reply, Result, State};
 
 handle_call({{connection_init, Trustedcerts, _Role}, Pid}, _From,
-	    #state{certificate_db = [CertDb|_] =Db,
+	    #state{certificate_db = [CertDb, FileRefDb, PemChace] = Db,
 		   session_cache = Cache} = State) ->
-    erlang:monitor(process, Pid),
     Result = 
 	try
 	    {ok, Ref} = ssl_certificate_db:add_trusted_certs(Pid, Trustedcerts, Db),
-	    {ok, Ref, CertDb, Cache}
+	    {ok, Ref, CertDb, FileRefDb, PemChace, Cache}
 	catch
 	    _:Reason ->
 		{error, Reason}
 	end,
     {reply, Result, State};
 
-handle_call({{client_session_id, Host, Port, SslOpts, OwnCert}, _}, _,
-	    #state{session_cache = Cache,
-		  session_cache_cb = CacheCb} = State) ->
-    Id = ssl_session:id({Host, Port, SslOpts}, Cache, CacheCb, OwnCert),
-    {reply, Id, State};
-
-handle_call({{server_session_id, Port, SuggestedSessionId, SslOpts, OwnCert}, _},
+handle_call({{new_session_id,Port}, _},
 	    _, #state{session_cache_cb = CacheCb,
-		      session_cache = Cache,
-		      session_lifetime = LifeTime} = State) ->
-    Id = ssl_session:id(Port, SuggestedSessionId, SslOpts,
-			Cache, CacheCb, LifeTime, OwnCert),
+		      session_cache = Cache} = State) ->
+    Id = new_id(Port, ?GEN_UNIQUE_ID_MAX_TRIES, Cache, CacheCb),
     {reply, Id, State};
 
-handle_call({{cache_pem, File, LastWrite}, Pid}, _, 
+
+handle_call({{cache_pem, File}, _Pid}, _,
 	    #state{certificate_db = Db} = State) ->
-    try ssl_certificate_db:cache_pem_file(Pid, File, LastWrite, Db) of
+    try ssl_certificate_db:cache_pem_file(File, Db) of
 	Result ->
 	    {reply, Result, State}
     catch 
 	_:Reason ->
 	    {reply, {error, Reason}, State}
     end;
-handle_call({{recache_pem, File, LastWrite}, Pid}, From,
-	    #state{certificate_db = Db} = State) ->
-    ssl_certificate_db:uncache_pem_file(File, Db),
-    cast({recache_pem, File, LastWrite, Pid, From}),
-    {noreply, State}.
+handle_call({unconditionally_clear_pem_cache, _},_, #state{certificate_db = [_,_,PemChace]} = State) ->
+    ssl_certificate_db:clear(PemChace),
+    {reply, ok,  State}.
 
 %%--------------------------------------------------------------------
 -spec  handle_cast(msg(), #state{}) -> {noreply, #state{}}.
@@ -278,22 +284,7 @@ handle_cast({invalidate_session, Host, Port,
 handle_cast({invalidate_session, Port, #session{session_id = ID} = Session},
 	    #state{session_cache = Cache,
 		   session_cache_cb = CacheCb} = State) ->
-    invalidate_session(Cache, CacheCb, {Port, ID}, Session, State);
-
-handle_cast({recache_pem, File, LastWrite, Pid, From},
-	    #state{certificate_db = [_, FileToRefDb, _]} = State0) ->
-    case ssl_certificate_db:lookup(File, FileToRefDb) of
-	undefined ->
-	    {reply, Msg, State} =
-		handle_call({{cache_pem, File, LastWrite}, Pid}, From, State0),
-	    gen_server:reply(From, Msg),
-	    {noreply, State};
-	_ -> %% Send message to self letting cleanup messages be handled
-	     %% first so that no reference to the old version of file
-             %% exists when we cache the new one.
-	    cast({recache_pem, File, LastWrite, Pid, From}),
-	    {noreply, State0}
-    end.
+    invalidate_session(Cache, CacheCb, {Port, ID}, Session, State).
 
 %%--------------------------------------------------------------------
 -spec handle_info(msg(), #state{}) -> {noreply, #state{}}.
@@ -318,23 +309,38 @@ handle_info({delayed_clean_session, Key}, #state{session_cache = Cache,
     CacheCb:delete(Cache, Key),
     {noreply, State};
 
-handle_info({'EXIT', _, _}, State) ->
-    %% Session validator died!! Do we need to take any action?
-    %% maybe error log
+handle_info(clear_pem_cache, #state{certificate_db = [_,_,PemChace]} = State) ->
+    case ssl_certificate_db:db_size(PemChace) of
+	N  when N < ?NOT_TO_BIG ->
+	    ok;
+	_ ->
+	    ssl_certificate_db:clear(PemChace)
+    end,
+    erlang:send_after(?CLEAR_PEM_CACHE, self(), clear_pem_cache),
     {noreply, State};
 
-handle_info({'DOWN', _Ref, _Type, _Pid, ecacertfile}, State) ->
-    {noreply, State};
 
-handle_info({'DOWN', _Ref, _Type, Pid, shutdown}, State) ->
-    handle_info({remove_trusted_certs, Pid}, State);
-handle_info({'DOWN', _Ref, _Type, Pid, _Reason}, State) ->
-    erlang:send_after(?CERTIFICATE_CACHE_CLEANUP, self(), 
-		      {remove_trusted_certs, Pid}),
+handle_info({clean_cert_db, Ref, File},
+	    #state{certificate_db = [CertDb,RefDb, PemCache]} = State) ->
+    case ssl_certificate_db:ref_count(Ref, RefDb, 0) of
+	0 ->
+	    MD5 = crypto:md5(File),
+	    case ssl_certificate_db:lookup_cached_pem(MD5, PemCache) of
+		[{Content, Ref}] ->
+		    ssl_certificate_db:insert(MD5, Content, PemCache);
+		undefined ->
+		    ok
+	    end,
+	    ssl_certificate_db:remove(Ref, RefDb),
+	    ssl_certificate_db:remove_trusted_certs(Ref, CertDb);
+	_ ->
+	    ok
+    end,
     {noreply, State};
-handle_info({remove_trusted_certs, Pid}, 
-	    #state{certificate_db = Db} = State) ->
-    ssl_certificate_db:remove_trusted_certs(Pid, Db),
+
+handle_info({'EXIT', _, _}, State) ->
+    %% Session validator died!! Do we need to take any action?
+    %% maybe error log
     {noreply, State};
 
 handle_info(_Info, State) ->
@@ -406,19 +412,6 @@ session_validation({{Port, _}, Session}, LifeTime) ->
     validate_session(Port, Session, LifeTime),
     LifeTime.
 
-cache_pem_file(File, LastWrite, DbHandle) ->
-    case ssl_certificate_db:lookup_cached_certs(DbHandle,File) of
-	[{_, {Mtime, Content}}] ->
-	    case LastWrite of
-		Mtime ->
-		    {ok, Content};
-		_ ->
-		    call({recache_pem, File, LastWrite})
-	    end;
-	[] ->
-	    call({cache_pem, File, LastWrite})
-    end.
-
 delay_time() ->
     case application:get_env(ssl, session_delay_cleanup_time) of
 	{ok, Time} when is_integer(Time) ->
@@ -448,3 +441,28 @@ last_delay_timer({{_,_},_}, TRef, {LastServer, _}) ->
     {LastServer, TRef};
 last_delay_timer({_,_}, TRef, {_, LastClient}) ->
     {TRef, LastClient}.
+
+%% If we can not generate a not allready in use session ID in
+%% ?GEN_UNIQUE_ID_MAX_TRIES we make the new session uncacheable The
+%% value of ?GEN_UNIQUE_ID_MAX_TRIES is stolen from open SSL which
+%% states : "If we can not find a session id in
+%% ?GEN_UNIQUE_ID_MAX_TRIES either the RAND code is broken or someone
+%% is trying to open roughly very close to 2^128 (or 2^256) SSL
+%% sessions to our server"
+new_id(_, 0, _, _) ->
+    <<>>;
+new_id(Port, Tries, Cache, CacheCb) ->
+    Id = crypto:rand_bytes(?NUM_OF_SESSION_ID_BYTES),
+    case CacheCb:lookup(Cache, {Port, Id}) of
+	undefined ->
+	    Now =  calendar:datetime_to_gregorian_seconds({date(), time()}),
+	    %% New sessions can not be set to resumable
+	    %% until handshake is compleate and the
+	    %% other session values are set.
+	    CacheCb:update(Cache, {Port, Id}, #session{session_id = Id,
+						       is_resumable = false,
+						       time_stamp = Now}),
+	    Id;
+	_ ->
+	    new_id(Port, Tries - 1, Cache, CacheCb)
+    end.
diff --git a/lib/ssl/src/ssl_session.erl b/lib/ssl/src/ssl_session.erl
index df5d7e0146..2ad422fc03 100644
--- a/lib/ssl/src/ssl_session.erl
+++ b/lib/ssl/src/ssl_session.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %% 
-%% Copyright Ericsson AB 2007-2011. All Rights Reserved.
+%% Copyright Ericsson AB 2007-2012. All Rights Reserved.
 %% 
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -28,9 +28,9 @@
 -include("ssl_internal.hrl").
 
 %% Internal application API
--export([is_new/2, id/4, id/7, valid_session/2]).
+-export([is_new/2, client_id/4, server_id/6, valid_session/2]).
 
--define(GEN_UNIQUE_ID_MAX_TRIES, 10).
+-define('24H_in_sec', 8640).
 
 -type seconds()   :: integer(). 
 
@@ -48,13 +48,13 @@ is_new(_ClientSuggestion, _ServerDecision) ->
     true.
 
 %%--------------------------------------------------------------------
--spec id({host(), inet:port_number(), #ssl_options{}}, db_handle(), atom(),
+-spec client_id({host(), inet:port_number(), #ssl_options{}}, db_handle(), atom(),
 	 undefined | binary()) -> binary().
 %%
-%% Description: Should be called by the client side to get an id 
+%% Description: Should be called by the client side to get an id
 %%              for the client hello message.
 %%--------------------------------------------------------------------
-id(ClientInfo, Cache, CacheCb, OwnCert) ->
+client_id(ClientInfo, Cache, CacheCb, OwnCert) ->
     case select_session(ClientInfo, Cache, CacheCb, OwnCert) of
 	no_session ->
 	    <<>>;
@@ -62,27 +62,6 @@ id(ClientInfo, Cache, CacheCb, OwnCert) ->
 	    SessionId
     end.
 
-%%--------------------------------------------------------------------
--spec id(inet:port_number(), binary(), #ssl_options{}, db_handle(),
-	 atom(), seconds(), binary()) -> binary().
-%%
-%% Description: Should be called by the server side to get an id 
-%%              for the server hello message.
-%%--------------------------------------------------------------------
-id(Port, <<>>, _, Cache, CacheCb, _, _) ->
-    new_id(Port, ?GEN_UNIQUE_ID_MAX_TRIES, Cache, CacheCb);
-
-id(Port, SuggestedSessionId, #ssl_options{reuse_sessions = ReuseEnabled,
-					  reuse_session = ReuseFun}, 
-   Cache, CacheCb, SecondLifeTime, OwnCert) ->
-    case is_resumable(SuggestedSessionId, Port, ReuseEnabled, 
-		      ReuseFun, Cache, CacheCb, SecondLifeTime, OwnCert) of
-	true ->
-	    SuggestedSessionId;
-	false ->
-	    new_id(Port, ?GEN_UNIQUE_ID_MAX_TRIES, Cache, CacheCb)
-    end.
-%%--------------------------------------------------------------------
 -spec valid_session(#session{}, seconds()) -> boolean().
 %%
 %% Description: Check that the session has not expired
@@ -91,57 +70,51 @@ valid_session(#session{time_stamp = TimeStamp}, LifeTime) ->
     Now =  calendar:datetime_to_gregorian_seconds({date(), time()}),
     Now - TimeStamp < LifeTime.
 
+server_id(Port, <<>>, _SslOpts, _Cert, _, _) ->
+    {ssl_manager:new_session_id(Port), undefined};
+server_id(Port, SuggestedId,
+	  #ssl_options{reuse_sessions = ReuseEnabled,
+		       reuse_session = ReuseFun},
+	  Cert, Cache, CacheCb) ->
+    LifeTime = case application:get_env(ssl, session_lifetime) of
+		   {ok, Time} when is_integer(Time) -> Time;
+		   _ -> ?'24H_in_sec'
+	       end,
+    case is_resumable(SuggestedId, Port, ReuseEnabled,ReuseFun,
+		      Cache, CacheCb, LifeTime, Cert)
+    of
+	{true, Resumed} ->
+	    {SuggestedId, Resumed};
+	{false, undefined} ->
+	    {ssl_manager:new_session_id(Port), undefined}
+    end.
+
 %%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
+select_session({_, _, #ssl_options{reuse_sessions=false}}, _Cache, _CacheCb, _OwnCert) ->
+    no_session;
 select_session({HostIP, Port, SslOpts}, Cache, CacheCb, OwnCert) ->
     Sessions = CacheCb:select_session(Cache, {HostIP, Port}),
     select_session(Sessions, SslOpts, OwnCert).
 
 select_session([], _, _) ->
     no_session;
-
-select_session(Sessions, #ssl_options{ciphers = Ciphers,
-				      reuse_sessions = ReuseSession}, OwnCert) ->
-    IsResumable =
-	fun(Session) ->
-		ReuseSession andalso resumable(Session#session.is_resumable) andalso
- 		    lists:member(Session#session.cipher_suite, Ciphers)
-		    andalso (OwnCert == Session#session.own_certificate)
+select_session(Sessions, #ssl_options{ciphers = Ciphers}, OwnCert) ->
+    IsNotResumable =
+	fun([_Id, Session]) ->
+		not (resumable(Session#session.is_resumable) andalso
+		     lists:member(Session#session.cipher_suite, Ciphers)
+		     andalso (OwnCert == Session#session.own_certificate))
  	end,
-    case [Id || [Id, Session] <- Sessions, IsResumable(Session)] of
- 	[] ->
- 	    no_session;
- 	List ->
- 	    hd(List)
-    end.
-
-%% If we can not generate a not allready in use session ID in
-%% ?GEN_UNIQUE_ID_MAX_TRIES we make the new session uncacheable The
-%% value of ?GEN_UNIQUE_ID_MAX_TRIES is stolen from open SSL which
-%% states : "If we can not find a session id in
-%% ?GEN_UNIQUE_ID_MAX_TRIES either the RAND code is broken or someone
-%% is trying to open roughly very close to 2^128 (or 2^256) SSL
-%% sessions to our server"
-new_id(_, 0, _, _) ->
-    <<>>;
-new_id(Port, Tries, Cache, CacheCb) ->
-    Id = crypto:rand_bytes(?NUM_OF_SESSION_ID_BYTES),
-    case CacheCb:lookup(Cache, {Port, Id}) of
-	undefined ->
-	    Now =  calendar:datetime_to_gregorian_seconds({date(), time()}),
-	    %% New sessions can not be set to resumable
-	    %% until handshake is compleate and the
-	    %% other session values are set.
-	    CacheCb:update(Cache, {Port, Id}, #session{session_id = Id,
-						       is_resumable = false,
-						       time_stamp = Now}),
-	    Id;
-	_ ->
-	    new_id(Port, Tries - 1, Cache, CacheCb)
+    case lists:dropwhile(IsNotResumable, Sessions) of
+	[] ->   no_session;
+	[[Id, _]|_] -> Id
     end.
 
-is_resumable(SuggestedSessionId, Port, ReuseEnabled, ReuseFun, Cache, 
+is_resumable(_, _, false, _, _, _, _, _) ->
+    {false, undefined};
+is_resumable(SuggestedSessionId, Port, true, ReuseFun, Cache,
 	     CacheCb, SecondLifeTime, OwnCert) ->
     case CacheCb:lookup(Cache, {Port, SuggestedSessionId}) of
 	#session{cipher_suite = CipherSuite,
@@ -149,14 +122,17 @@ is_resumable(SuggestedSessionId, Port, ReuseEnabled, ReuseFun, Cache,
 		 compression_method = Compression,
 		 is_resumable = IsResumable,
 		 peer_certificate = PeerCert} = Session ->
-	    ReuseEnabled 
-		andalso resumable(IsResumable)
+	    case resumable(IsResumable)
 		andalso (OwnCert == SessionOwnCert)
-		andalso valid_session(Session, SecondLifeTime) 
-		andalso ReuseFun(SuggestedSessionId, PeerCert, 
-				 Compression, CipherSuite);
+		andalso valid_session(Session, SecondLifeTime)
+		andalso ReuseFun(SuggestedSessionId, PeerCert,
+				 Compression, CipherSuite)
+	    of
+		true  -> {true, Session};
+		false -> {false, undefined}
+	    end;
 	undefined ->
-	    false
+	    {false, undefined}
     end.
 
 resumable(new) ->
diff --git a/lib/ssl/src/ssl_session_cache.erl b/lib/ssl/src/ssl_session_cache.erl
index f9bbf905e1..5c6ee3c54c 100644
--- a/lib/ssl/src/ssl_session_cache.erl
+++ b/lib/ssl/src/ssl_session_cache.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2011. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2012. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -32,7 +32,7 @@
 %% Description: Return table reference. Called by ssl_manager process. 
 %%--------------------------------------------------------------------
 init(_) ->
-    ets:new(cache_name(), [set, protected]).
+    ets:new(cache_name(), [ordered_set, protected]).
 
 %%--------------------------------------------------------------------
 %% Description: Handles cache table at termination of ssl manager.