OTP-8587 DSA key support

New ssl now support client/server-certificates signed by dsa keys.

5 files changed, 705 insertions, 94 deletions

diff --git a/lib/ssl/test/Makefile b/lib/ssl/test/Makefile
index bd86120c98..d35cafc47b 100644
--- a/lib/ssl/test/Makefile
+++ b/lib/ssl/test/Makefile
@@ -1,19 +1,19 @@
 #
 # %CopyrightBegin%
-# 
-# Copyright Ericsson AB 1999-2009. All Rights Reserved.
-# 
+#
+# Copyright Ericsson AB 1999-2010. All Rights Reserved.
+#
 # The contents of this file are subject to the Erlang Public License,
 # Version 1.1, (the "License"); you may not use this file except in
 # compliance with the License. You should have received a copy of the
 # Erlang Public License along with this software. If not, it can be
 # retrieved online at http://www.erlang.org/.
-# 
+#
 # Software distributed under the License is distributed on an "AS IS"
 # basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 # the License for the specific language governing rights and limitations
 # under the License.
-# 
+#
 # %CopyrightEnd%
 #
 
@@ -50,7 +50,8 @@ MODULES = \
 	old_ssl_protocol_SUITE \
 	old_transport_accept_SUITE \
 	old_ssl_dist_SUITE \
-	make_certs 
+	make_certs\
+	erl_make_certs
 
 
 ERL_FILES = $(MODULES:%=%.erl)
diff --git a/lib/ssl/test/erl_make_certs.erl b/lib/ssl/test/erl_make_certs.erl
new file mode 100644
index 0000000000..1d2cea6c72
--- /dev/null
+++ b/lib/ssl/test/erl_make_certs.erl
@@ -0,0 +1,412 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2010. All Rights Reserved.
+%%
+%% The contents of this file are subject to the Erlang Public License,
+%% Version 1.1, (the "License"); you may not use this file except in
+%% compliance with the License. You should have received a copy of the
+%% Erlang Public License along with this software. If not, it can be
+%% retrieved online at http://www.erlang.org/.
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and limitations
+%% under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+%% Create test certificates
+
+-module(erl_make_certs).
+-include_lib("public_key/include/public_key.hrl").
+
+-export([make_cert/1, gen_rsa/1, verify_signature/3, write_pem/3]).
+-compile(export_all).
+
+%%--------------------------------------------------------------------
+%% @doc  Create and return a der encoded certificate
+%%   Option                                         Default
+%%   -------------------------------------------------------
+%%   digest                                         sha1
+%%   validity                                       {date(), date() + week()}
+%%   version                                        3
+%%   subject                                        [] list of the following content
+%%      {name,  Name}
+%%      {email, Email} 
+%%      {city,  City}
+%%      {state, State}
+%%      {org, Org}
+%%      {org_unit, OrgUnit}
+%%      {country, Country} 
+%%      {serial, Serial}
+%%      {title, Title}
+%%      {dnQualifer, DnQ}
+%%   issuer = {Issuer, IssuerKey}                   true (i.e. a ca cert is created) 
+%%                                                  (obs IssuerKey migth be {Key, Password}
+%%   key = KeyFile|KeyBin|rsa|dsa                   Subject PublicKey rsa or dsa generates key
+%%   
+%%
+%%   (OBS: The generated keys are for testing only)
+%% @spec ([{::atom(), ::term()}]) -> {Cert::binary(), Key::binary()}
+%% @end
+%%--------------------------------------------------------------------
+
+make_cert(Opts) ->
+    SubjectPrivateKey = get_key(Opts),
+    {TBSCert, IssuerKey} = make_tbs(SubjectPrivateKey, Opts),
+    Cert = public_key:sign(TBSCert, IssuerKey),
+    true = verify_signature(Cert, IssuerKey, undef), %% verify that the keys where ok
+    {Cert, encode_key(SubjectPrivateKey)}.
+
+%%--------------------------------------------------------------------
+%% @doc Writes pem files in Dir with FileName ++ ".pem" and FileName ++ "_key.pem"
+%% @spec (::string(), ::string(), {Cert,Key}) -> ok
+%% @end
+%%--------------------------------------------------------------------
+write_pem(Dir, FileName, {Cert, Key = {_,_,not_encrypted}}) when is_binary(Cert) ->
+    ok = public_key:der_to_pem(filename:join(Dir, FileName ++ ".pem"), [{cert, Cert, not_encrypted}]),
+    ok = public_key:der_to_pem(filename:join(Dir, FileName ++ "_key.pem"), [Key]).
+
+%%--------------------------------------------------------------------
+%% @doc Creates a rsa key (OBS: for testing only)
+%%   the size are in bytes
+%% @spec (::integer()) -> {::atom(), ::binary(), ::opaque()}
+%% @end
+%%--------------------------------------------------------------------
+gen_rsa(Size) when is_integer(Size) ->
+    Key = gen_rsa2(Size),
+    {Key, encode_key(Key)}.
+
+%%--------------------------------------------------------------------
+%% @doc Creates a dsa key (OBS: for testing only)
+%%   the sizes are in bytes
+%% @spec (::integer()) -> {::atom(), ::binary(), ::opaque()}
+%% @end
+%%--------------------------------------------------------------------
+gen_dsa(LSize,NSize) when is_integer(LSize), is_integer(NSize) ->
+    Key = gen_dsa2(LSize, NSize),
+    {Key, encode_key(Key)}.
+
+%%--------------------------------------------------------------------
+%% @doc Verifies cert signatures
+%% @spec (::binary(), ::tuple()) -> ::boolean()
+%% @end
+%%--------------------------------------------------------------------
+verify_signature(DerEncodedCert, DerKey, KeyParams) ->
+    Key = decode_key(DerKey),
+    case Key of 
+	#'RSAPrivateKey'{modulus=Mod, publicExponent=Exp} ->
+	    public_key:verify_signature(DerEncodedCert, 
+					#'RSAPublicKey'{modulus=Mod, publicExponent=Exp}, 
+					'NULL');
+	#'DSAPrivateKey'{p=P, q=Q, g=G, y=Y} ->
+	    public_key:verify_signature(DerEncodedCert, Y, #'Dss-Parms'{p=P, q=Q, g=G});
+
+	_  ->
+	    public_key:verify_signature(DerEncodedCert, Key, KeyParams)
+    end.
+
+%%%%%%%%%%%%%%%%%%%%%%%%% Implementation %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+get_key(Opts) ->
+    case proplists:get_value(key, Opts) of
+	undefined -> make_key(rsa, Opts);
+	rsa ->       make_key(rsa, Opts);
+	dsa ->       make_key(dsa, Opts);
+	Key ->
+	    Password = proplists:get_value(password, Opts, no_passwd),
+	    decode_key(Key, Password)
+    end.
+
+decode_key({Key, Pw}) ->
+    decode_key(Key, Pw);
+decode_key(Key) ->
+    decode_key(Key, no_passwd).
+    
+
+decode_key(#'RSAPublicKey'{} = Key,_) ->
+    Key;
+decode_key(#'RSAPrivateKey'{} = Key,_) ->
+    Key;
+decode_key(#'DSAPrivateKey'{} = Key,_) ->
+    Key;
+decode_key(Der = {_,_,_}, Pw) ->
+    {ok, Key} = public_key:decode_private_key(Der, Pw),
+    Key;
+decode_key(FileOrDer, Pw) ->
+    {ok, [KeyInfo]} = public_key:pem_to_der(FileOrDer),
+    decode_key(KeyInfo, Pw).
+
+encode_key(Key = #'RSAPrivateKey'{}) ->
+    {ok, Der} = 'OTP-PUB-KEY':encode('RSAPrivateKey', Key),
+    {rsa_private_key, list_to_binary(Der), not_encrypted};   
+encode_key(Key = #'DSAPrivateKey'{}) ->
+    {ok, Der} = 'OTP-PUB-KEY':encode('DSAPrivateKey', Key),
+    {dsa_private_key, list_to_binary(Der), not_encrypted}.
+
+make_tbs(SubjectKey, Opts) ->    
+    Version = list_to_atom("v"++integer_to_list(proplists:get_value(version, Opts, 3))),
+    {Issuer, IssuerKey}  = issuer(Opts, SubjectKey),
+
+    {Algo, Parameters} = sign_algorithm(IssuerKey, Opts),
+    
+    SignAlgo = #'SignatureAlgorithm'{algorithm  = Algo,
+				     parameters = Parameters},    
+    
+    {#'OTPTBSCertificate'{serialNumber = trunc(random:uniform()*100000000)*10000 + 1,
+			  signature    = SignAlgo,
+			  issuer       = Issuer,
+			  validity     = validity(Opts),
+			  subject      = subject(proplists:get_value(subject, Opts),false),
+			  subjectPublicKeyInfo = publickey(SubjectKey),
+			  version      = Version,
+			  extensions   = extensions(Opts)
+			 }, IssuerKey}.
+
+issuer(Opts, SubjectKey) ->
+    IssuerProp = proplists:get_value(issuer, Opts, true),
+    case IssuerProp of 
+	true -> %% Self signed
+	    {subject(proplists:get_value(subject, Opts), true), SubjectKey};
+	{Issuer, IssuerKey} when is_binary(Issuer) ->
+	    {issuer_der(Issuer), decode_key(IssuerKey)};
+        {File, IssuerKey} when is_list(File) ->
+	    {ok, [{cert, Cert, _}|_]} = public_key:pem_to_der(File),
+	    {issuer_der(Cert), decode_key(IssuerKey)}
+    end.
+
+issuer_der(Issuer) ->
+    {ok, Decoded} = public_key:pkix_decode_cert(Issuer, otp),
+    #'OTPCertificate'{tbsCertificate=Tbs} = Decoded,
+    #'OTPTBSCertificate'{subject=Subject} = Tbs,
+    Subject.
+
+subject(undefined, IsCA) ->
+    User = if IsCA -> "CA"; true -> os:getenv("USER") end,
+    Opts = [{email, User ++ "@erlang.org"},
+	    {name, User},
+	    {city, "Stockholm"},
+	    {country, "SE"},
+	    {org, "erlang"},
+	    {org_unit, "testing dep"}],
+    subject(Opts);
+subject(Opts, _) ->
+    subject(Opts).
+
+subject(SubjectOpts) when is_list(SubjectOpts) ->
+    Encode = fun(Opt) ->
+		     {Type,Value} = subject_enc(Opt),
+		     [#'AttributeTypeAndValue'{type=Type, value=Value}]
+	     end,
+    {rdnSequence, [Encode(Opt) || Opt <- SubjectOpts]}.
+
+%% Fill in the blanks
+subject_enc({name,  Name}) ->       {?'id-at-commonName', {printableString, Name}};
+subject_enc({email, Email}) ->      {?'id-emailAddress', Email};
+subject_enc({city,  City}) ->       {?'id-at-localityName', {printableString, City}};
+subject_enc({state, State}) ->      {?'id-at-stateOrProvinceName', {printableString, State}};
+subject_enc({org, Org}) ->          {?'id-at-organizationName', {printableString, Org}};
+subject_enc({org_unit, OrgUnit}) -> {?'id-at-organizationalUnitName', {printableString, OrgUnit}};
+subject_enc({country, Country}) ->  {?'id-at-countryName', Country};
+subject_enc({serial, Serial}) ->    {?'id-at-serialNumber', Serial};
+subject_enc({title, Title}) ->      {?'id-at-title', {printableString, Title}};
+subject_enc({dnQualifer, DnQ}) ->   {?'id-at-dnQualifier', DnQ};
+subject_enc(Other) ->               Other.
+
+
+extensions(Opts) ->
+    case proplists:get_value(extensions, Opts, []) of
+	false -> 
+	    asn1_NOVALUE;
+	Exts  -> 
+	    lists:flatten([extension(Ext) || Ext <- default_extensions(Exts)])
+    end.
+
+default_extensions(Exts) ->
+    Def = [{key_usage,undefined}, 
+	   {subject_altname, undefined},
+	   {issuer_altname, undefined},
+	   {basic_constraints, default},
+	   {name_constraints, undefined},
+	   {policy_constraints, undefined},
+	   {ext_key_usage, undefined},
+	   {inhibit_any, undefined},
+	   {auth_key_id, undefined},
+	   {subject_key_id, undefined},
+	   {policy_mapping, undefined}],
+    Filter = fun({Key, _}, D) -> lists:keydelete(Key, 1, D) end,
+    Exts ++ lists:foldl(Filter, Def, Exts).
+       	
+extension({_, undefined}) -> [];
+extension({basic_constraints, Data}) ->
+    case Data of
+	default ->
+	    #'Extension'{extnID = ?'id-ce-basicConstraints',
+			 extnValue = #'BasicConstraints'{cA=true},
+			 critical=true};
+	false -> 
+	    [];
+	Len when is_integer(Len) ->
+	    #'Extension'{extnID = ?'id-ce-basicConstraints',
+			 extnValue = #'BasicConstraints'{cA=true, pathLenConstraint=Len},
+			 critical=true};
+	_ ->
+	    #'Extension'{extnID = ?'id-ce-basicConstraints',
+			 extnValue = Data}
+    end;
+extension({Id, Data, Critical}) ->
+    #'Extension'{extnID = Id, extnValue = Data, critical = Critical}.
+
+
+publickey(#'RSAPrivateKey'{modulus=N, publicExponent=E}) ->
+    Public = #'RSAPublicKey'{modulus=N, publicExponent=E},
+    Algo = #'PublicKeyAlgorithm'{algorithm= ?rsaEncryption, parameters='NULL'},
+    #'OTPSubjectPublicKeyInfo'{algorithm = Algo,
+			       subjectPublicKey = Public};
+publickey(#'DSAPrivateKey'{p=P, q=Q, g=G, y=Y}) ->
+    Algo = #'PublicKeyAlgorithm'{algorithm= ?'id-dsa', 
+				 parameters=#'Dss-Parms'{p=P, q=Q, g=G}},
+    #'OTPSubjectPublicKeyInfo'{algorithm = Algo, subjectPublicKey = Y}.
+
+validity(Opts) ->
+    DefFrom0 = date(),
+    DefTo0   = calendar:gregorian_days_to_date(calendar:date_to_gregorian_days(date())+7),
+    {DefFrom, DefTo} = proplists:get_value(validity, Opts, {DefFrom0, DefTo0}),
+    Format = fun({Y,M,D}) -> lists:flatten(io_lib:format("~w~2..0w~2..0w000000Z",[Y,M,D])) end,
+    #'Validity'{notBefore={generalTime, Format(DefFrom)},
+		notAfter ={generalTime, Format(DefTo)}}.
+
+sign_algorithm(#'RSAPrivateKey'{}, Opts) ->
+    Type = case proplists:get_value(digest, Opts, sha1) of
+	       sha1 ->   ?'sha1WithRSAEncryption';
+	       sha512 -> ?'sha512WithRSAEncryption';
+	       sha384 -> ?'sha384WithRSAEncryption';
+	       sha256 -> ?'sha256WithRSAEncryption';
+	       md5    -> ?'md5WithRSAEncryption';
+	       md2    -> ?'md2WithRSAEncryption'
+	   end,
+    {Type, 'NULL'};
+sign_algorithm(#'DSAPrivateKey'{p=P, q=Q, g=G}, _Opts) ->
+    {?'id-dsa-with-sha1', #'Dss-Parms'{p=P, q=Q, g=G}}.
+
+make_key(rsa, _Opts) ->
+    %% (OBS: for testing only)
+    gen_rsa2(64);
+make_key(dsa, _Opts) ->
+    gen_dsa2(128, 20).  %% Bytes i.e. {1024, 160} 
+    
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%% RSA key generation  (OBS: for testing only)
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+-define(SMALL_PRIMES, [65537,97,89,83,79,73,71,67,61,59,53,
+		       47,43,41,37,31,29,23,19,17,13,11,7,5,3]).
+
+gen_rsa2(Size) ->
+    P = prime(Size),
+    Q = prime(Size),
+    N = P*Q,
+    Tot = (P - 1) * (Q - 1),
+    [E|_] = lists:dropwhile(fun(Candidate) -> (Tot rem Candidate) == 0 end, ?SMALL_PRIMES),
+    {D1,D2} = extended_gcd(E, Tot),
+    D = erlang:max(D1,D2),
+    case D < E of
+	true ->
+	    gen_rsa2(Size);
+	false ->
+	    {Co1,Co2} = extended_gcd(Q, P),
+	    Co = erlang:max(Co1,Co2),
+	    #'RSAPrivateKey'{version = 'two-prime',
+			     modulus = N,
+			     publicExponent  = E,
+			     privateExponent = D, 
+			     prime1 = P, 
+			     prime2 = Q, 
+			     exponent1 = D rem (P-1), 
+			     exponent2 = D rem (Q-1), 
+			     coefficient = Co
+			    }
+    end.
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%% DSA key generation  (OBS: for testing only)
+%% See http://en.wikipedia.org/wiki/Digital_Signature_Algorithm
+%% and the fips_186-3.pdf
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+gen_dsa2(LSize, NSize) ->
+    Q  = prime(NSize),  %% Choose N-bit prime Q
+    X0 = prime(LSize),
+    P0 = prime((LSize div 2) +1),
+    
+    %% Choose L-bit prime modulus P such that p–1 is a multiple of q.
+    case dsa_search(X0 div (2*Q*P0), P0, Q, 1000) of
+	error -> 
+	    gen_dsa2(LSize, NSize);
+	P ->	    
+	    G = crypto:mod_exp(2, (P-1) div Q, P), % Choose G a number whose multiplicative order modulo p is q.
+	    %%                 such that This may be done by setting g = h^(p–1)/q mod p, commonly h=2 is used.
+	    
+	    X = prime(20),               %% Choose x by some random method, where 0 < x < q.
+	    Y = crypto:mod_exp(G, X, P), %% Calculate y = g^x mod p.
+	    
+	    #'DSAPrivateKey'{version=0, p=P, q=Q, g=G, y=Y, x=X}
+    end.
+    
+%% See fips_186-3.pdf
+dsa_search(T, P0, Q, Iter) when Iter > 0 ->
+    P = 2*T*Q*P0 + 1,
+    case is_prime(crypto:mpint(P), 50) of
+	true -> P;
+	false -> dsa_search(T+1, P0, Q, Iter-1)
+    end;
+dsa_search(_,_,_,_) -> 
+    error.
+
+
+%%%%%%% Crypto Math %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+prime(ByteSize) ->
+    Rand = odd_rand(ByteSize),
+    crypto:erlint(prime_odd(Rand, 0)).
+
+prime_odd(Rand, N) ->
+    case is_prime(Rand, 50) of
+	true -> 
+	    Rand;
+	false -> 
+	    NotPrime = crypto:erlint(Rand),
+	    prime_odd(crypto:mpint(NotPrime+2), N+1)
+    end.
+
+%% see http://en.wikipedia.org/wiki/Fermat_primality_test
+is_prime(_, 0) -> true;
+is_prime(Candidate, Test) -> 
+    CoPrime = odd_rand(<<0,0,0,4, 10000:32>>, Candidate),
+    case crypto:mod_exp(CoPrime, Candidate, Candidate) of
+	CoPrime -> is_prime(Candidate, Test-1);
+	_       -> false
+    end.
+
+odd_rand(Size) ->
+    Min = 1 bsl (Size*8-1),
+    Max = (1 bsl (Size*8))-1,
+    odd_rand(crypto:mpint(Min), crypto:mpint(Max)).
+
+odd_rand(Min,Max) ->
+    Rand = <<Sz:32, _/binary>> = crypto:rand_uniform(Min,Max),
+    BitSkip = (Sz+4)*8-1,
+    case Rand of
+	Odd  = <<_:BitSkip,  1:1>> -> Odd;
+	Even = <<_:BitSkip,  0:1>> -> 
+	    crypto:mpint(crypto:erlint(Even)+1)
+    end.
+
+extended_gcd(A, B) ->
+    case A rem B of
+	0 ->
+	    {0, 1};
+	N ->
+	    {X, Y} = extended_gcd(B, N),
+	    {Y, X-Y*(A div B)}
+    end.
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index ad87cfcba1..0d9a912e30 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -53,11 +53,15 @@
 init_per_suite(Config) ->
     crypto:start(),
     ssl:start(),
+    
+    %% make rsa certs using oppenssl
     Result = 
 	(catch make_certs:all(?config(data_dir, Config), 
 			      ?config(priv_dir, Config))),
     test_server:format("Make certs  ~p~n", [Result]),
-    ssl_test_lib:cert_options(Config).
+
+    NewConfig = ssl_test_lib:make_dsa_cert(Config),
+    ssl_test_lib:cert_options(NewConfig).
 
 %%--------------------------------------------------------------------
 %% Function: end_per_suite(Config) -> _
@@ -105,8 +109,10 @@ init_per_testcase(no_authority_key_identifier, Config) ->
     ssl:start(), 
     Config;
 
-init_per_testcase(TestCase, Config) when TestCase == ciphers_ssl3; 
-					 TestCase == ciphers_ssl3_openssl_names ->
+init_per_testcase(TestCase, Config) when TestCase == ciphers_rsa_signed_certs_ssl3; 
+					 TestCase == ciphers_rsa_signed_certs_openssl_names_ssl3;
+					 TestCase == ciphers_dsa_signed_certs_ssl3; 
+					 TestCase == ciphers_dsa_signed_certs_openssl_names_ssl3 ->
     ssl:stop(),
     application:load(ssl),
     application:set_env(ssl, protocol_version, sslv3),
@@ -124,7 +130,6 @@ init_per_testcase(protocol_versions, Config)  ->
 init_per_testcase(empty_protocol_versions, Config)  ->
     ssl:stop(),
     application:load(ssl),
-    %% For backwards compatibility sslv2 should be filtered out.
     application:set_env(ssl, protocol_version, []),
     ssl:start(),
     Config;
@@ -165,8 +170,10 @@ end_per_testcase(session_cache_process_mnesia, Config) ->
 end_per_testcase(reuse_session_expired, Config) ->
     application:unset_env(ssl, session_lifetime),
     end_per_testcase(default_action, Config);
-end_per_testcase(TestCase, Config) when TestCase == ciphers_ssl3; 
-					TestCase == ciphers_ssl3_openssl_names;
+end_per_testcase(TestCase, Config) when TestCase == ciphers_rsa_signed_certs_ssl3; 
+					TestCase == ciphers_rsa_signed_certs_openssl_names_ssl3;
+					TestCase == ciphers_dsa_signed_certs_ssl3; 
+					TestCase == ciphers_dsa_signed_certs_openssl_names_ssl3;
 					TestCase == protocol_versions;
 					TestCase == empty_protocol_versions->
     application:unset_env(ssl, protocol_version),
@@ -193,30 +200,37 @@ all(doc) ->
 
 all(suite) -> 
     [app, alerts, connection_info, protocol_versions,
-    empty_protocol_versions, controlling_process, controller_dies,
-    client_closes_socket, peercert, connect_dist, peername, sockname,
-    socket_options, misc_ssl_options, versions, cipher_suites,
-    upgrade, upgrade_with_timeout, tcp_connect, ipv6, ekeyfile,
-    ecertfile, ecacertfile, eoptions, shutdown, shutdown_write,
-    shutdown_both, shutdown_error, ciphers, ciphers_ssl3,
-    ciphers_openssl_names, send_close,
-    close_transport_accept, dh_params, server_verify_peer_passive,
-    server_verify_peer_active, server_verify_peer_active_once,
-    server_verify_none_passive, server_verify_none_active,
-    server_verify_none_active_once, server_verify_no_cacerts,
-    server_require_peer_cert_ok, server_require_peer_cert_fail,
-    server_verify_client_once_passive,
-    server_verify_client_once_active,
-    server_verify_client_once_active_once, client_verify_none_passive,
-    client_verify_none_active, client_verify_none_active_once,
-    session_cache_process_list, session_cache_process_mnesia,
-    reuse_session, reuse_session_expired,
-    server_does_not_want_to_reuse_session, client_renegotiate,
-    server_renegotiate, client_renegotiate_reused_session,
-    server_renegotiate_reused_session, client_no_wrap_sequence_number,
-    server_no_wrap_sequence_number, extended_key_usage,
-    validate_extensions_fun, no_authority_key_identifier,
-    invalid_signature_client, invalid_signature_server, cert_expired
+     empty_protocol_versions, controlling_process, controller_dies,
+     client_closes_socket, peercert, connect_dist, peername, sockname,
+     socket_options, misc_ssl_options, versions, cipher_suites,
+     upgrade, upgrade_with_timeout, tcp_connect, ipv6, ekeyfile,
+     ecertfile, ecacertfile, eoptions, shutdown, shutdown_write,
+     shutdown_both, shutdown_error, 
+     ciphers_rsa_signed_certs, ciphers_rsa_signed_certs_ssl3,
+     ciphers_rsa_signed_certs_openssl_names,
+     ciphers_rsa_signed_certs_openssl_names_ssl3,
+     ciphers_dsa_signed_certs, 
+     ciphers_dsa_signed_certs_ssl3,
+     ciphers_dsa_signed_certs_openssl_names,
+     ciphers_dsa_signed_certs_openssl_names_ssl3,
+     send_close,
+     close_transport_accept, dh_params, server_verify_peer_passive,
+     server_verify_peer_active, server_verify_peer_active_once,
+     server_verify_none_passive, server_verify_none_active,
+     server_verify_none_active_once, server_verify_no_cacerts,
+     server_require_peer_cert_ok, server_require_peer_cert_fail,
+     server_verify_client_once_passive,
+     server_verify_client_once_active,
+     server_verify_client_once_active_once, client_verify_none_passive,
+     client_verify_none_active, client_verify_none_active_once,
+     session_cache_process_list, session_cache_process_mnesia,
+     reuse_session, reuse_session_expired,
+     server_does_not_want_to_reuse_session, client_renegotiate,
+     server_renegotiate, client_renegotiate_reused_session,
+     server_renegotiate_reused_session, client_no_wrap_sequence_number,
+     server_no_wrap_sequence_number, extended_key_usage,
+     validate_extensions_fun, no_authority_key_identifier,
+     invalid_signature_client, invalid_signature_server, cert_expired
     ].
 
 %% Test cases starts here.
@@ -1394,66 +1408,129 @@ shutdown_error(Config) when is_list(Config) ->
     {error, closed} = ssl:shutdown(Listen, read_write).
 
 %%-------------------------------------------------------------------
-ciphers(doc) -> 
-    ["Test all ssl cipher suites in highest support ssl/tls version"];
+ciphers_rsa_signed_certs(doc) -> 
+    ["Test all rsa ssl cipher suites in highest support ssl/tls version"];
        
-ciphers(suite) -> 
+ciphers_rsa_signed_certs(suite) -> 
     [];
 
-ciphers(Config) when is_list(Config) ->
+ciphers_rsa_signed_certs(Config) when is_list(Config) ->
     Version = 
 	ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
 
-    Ciphers = ssl:cipher_suites(),
+    Ciphers = ssl_test_lib:rsa_suites(),
     test_server:format("tls1 erlang cipher suites ~p~n", [Ciphers]),
-    Result =  lists:map(fun(Cipher) -> 
-				cipher(Cipher, Version, Config) end,
-			Ciphers),
-    case lists:flatten(Result) of
-	[] ->
-	    ok;
-	Error ->
-	    test_server:format("Cipher suite errors: ~p~n", [Error]),
-	    test_server:fail(cipher_suite_failed_see_test_case_log) 
-    end.
+    run_suites(Ciphers, Version, Config, rsa).
 
-ciphers_ssl3(doc) -> 
-    ["Test all ssl cipher suites in ssl3"];
+ciphers_rsa_signed_certs_ssl3(doc) -> 
+    ["Test all rsa ssl cipher suites in ssl3"];
        
-ciphers_ssl3(suite) -> 
+ciphers_rsa_signed_certs_ssl3(suite) -> 
     [];
 
-ciphers_ssl3(Config) when is_list(Config) ->
+ciphers_rsa_signed_certs_ssl3(Config) when is_list(Config) ->
     Version = 
 	ssl_record:protocol_version({3,0}),
 
-    Ciphers = ssl:cipher_suites(),
+    Ciphers = ssl_test_lib:rsa_suites(),
     test_server:format("ssl3 erlang cipher suites ~p~n", [Ciphers]),
-    Result =  lists:map(fun(Cipher) -> 
-				cipher(Cipher, Version, Config) end,
-			Ciphers),
-    case lists:flatten(Result) of
-	[] ->
-	    ok;
-	Error ->
-	    test_server:format("Cipher suite errors: ~p~n", [Error]),
-	    test_server:fail(cipher_suite_failed_see_test_case_log) 
-    end.
+    run_suites(Ciphers, Version, Config, rsa).
+
+ciphers_rsa_signed_certs_openssl_names(doc) -> 
+    ["Test all rsa ssl cipher suites in highest support ssl/tls version"];
+       
+ciphers_rsa_signed_certs_openssl_names(suite) -> 
+    [];
+
+ciphers_rsa_signed_certs_openssl_names(Config) when is_list(Config) ->
+    Version = 
+	ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
+    Ciphers = ssl_test_lib:openssl_rsa_suites(),  
+    test_server:format("tls1 openssl cipher suites ~p~n", [Ciphers]),
+    run_suites(Ciphers, Version, Config, rsa).
 
-ciphers_openssl_names(doc) -> 
-    ["Test all ssl cipher suites in highest support ssl/tls version"];
+
+ciphers_rsa_signed_certs_openssl_names_ssl3(doc) -> 
+    ["Test all dsa ssl cipher suites in ssl3"];
        
-ciphers_openssl_names(suite) -> 
+ciphers_rsa_signed_certs_openssl_names_ssl3(suite) -> 
     [];
 
-ciphers_openssl_names(Config) when is_list(Config) ->
+ciphers_rsa_signed_certs_openssl_names_ssl3(Config) when is_list(Config) ->
+    Version = ssl_record:protocol_version({3,0}),
+    Ciphers = ssl_test_lib:openssl_rsa_suites(),
+    run_suites(Ciphers, Version, Config, rsa).
+
+
+ciphers_dsa_signed_certs(doc) -> 
+    ["Test all dsa ssl cipher suites in highest support ssl/tls version"];
+       
+ciphers_dsa_signed_certs(suite) -> 
+    [];
+
+ciphers_dsa_signed_certs(Config) when is_list(Config) ->
     Version = 
 	ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
 
-    Ciphers = ssl:cipher_suites(openssl),
+    Ciphers = ssl_test_lib:dsa_suites(),
+    test_server:format("tls1 erlang cipher suites ~p~n", [Ciphers]),
+    run_suites(Ciphers, Version, Config, dsa).
+
+ciphers_dsa_signed_certs_ssl3(doc) -> 
+    ["Test all dsa ssl cipher suites in ssl3"];
+       
+ciphers_dsa_signed_certs_ssl3(suite) -> 
+    [];
+
+ciphers_dsa_signed_certs_ssl3(Config) when is_list(Config) ->
+    Version = 
+	ssl_record:protocol_version({3,0}),
+
+    Ciphers = ssl_test_lib:dsa_suites(),
+    test_server:format("ssl3 erlang cipher suites ~p~n", [Ciphers]),  
+    run_suites(Ciphers, Version, Config, dsa).
+    
+
+ciphers_dsa_signed_certs_openssl_names(doc) -> 
+    ["Test all dsa ssl cipher suites in highest support ssl/tls version"];
+       
+ciphers_dsa_signed_certs_openssl_names(suite) -> 
+    [];
+
+ciphers_dsa_signed_certs_openssl_names(Config) when is_list(Config) ->
+    Version = 
+	ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
+
+    Ciphers = ssl_test_lib:openssl_dsa_suites(),
     test_server:format("tls1 openssl cipher suites ~p~n", [Ciphers]),
+    run_suites(Ciphers, Version, Config, dsa).
+
+
+ciphers_dsa_signed_certs_openssl_names_ssl3(doc) -> 
+    ["Test all dsa ssl cipher suites in ssl3"];
+       
+ciphers_dsa_signed_certs_openssl_names_ssl3(suite) -> 
+    [];
+
+ciphers_dsa_signed_certs_openssl_names_ssl3(Config) when is_list(Config) ->
+    Version = ssl_record:protocol_version({3,0}),
+    Ciphers = ssl_test_lib:openssl_dsa_suites(),
+    run_suites(Ciphers, Version, Config, dsa).
+
+
+run_suites(Ciphers, Version, Config, Type) ->
+    {ClientOpts, ServerOpts} =
+	case Type of 
+	    rsa ->
+		{?config(client_opts, Config),
+		 ?config(server_opts, Config)};
+	    dsa ->
+		{?config(client_opts, Config),
+		 ?config(server_dsa_opts, Config)}
+	end,
+    
     Result =  lists:map(fun(Cipher) -> 
-				cipher(Cipher, Version, Config) end,
+				cipher(Cipher, Version, Config, ClientOpts, ServerOpts) end,
 			Ciphers),
     case lists:flatten(Result) of
 	[] ->
@@ -1463,12 +1540,14 @@ ciphers_openssl_names(Config) when is_list(Config) ->
 	    test_server:fail(cipher_suite_failed_see_test_case_log) 
     end.
 
+erlang_cipher_suite(Suite) when is_list(Suite)->
+    ssl_cipher:suite_definition(ssl_cipher:openssl_suite(Suite));
+erlang_cipher_suite(Suite) ->
+    Suite.
 
-cipher(CipherSuite, Version, Config) ->   
+cipher(CipherSuite, Version, Config, ClientOpts, ServerOpts) ->   
     process_flag(trap_exit, true),
     test_server:format("Testing CipherSuite ~p~n", [CipherSuite]),
-    ClientOpts = ?config(client_opts, Config),
-    ServerOpts = ?config(server_opts, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
 					{from, self()}, 
@@ -1507,11 +1586,6 @@ cipher(CipherSuite, Version, Config) ->
 	    [{ErlangCipherSuite, Error}]
     end.
 
-erlang_cipher_suite(Suite) when is_list(Suite)->
-    ssl_cipher:suite_definition(ssl_cipher:openssl_suite(Suite));
-erlang_cipher_suite(Suite) ->
-    Suite.
-
 %%--------------------------------------------------------------------
 reuse_session(doc) -> 
     ["Test reuse of sessions (short handshake)"];
@@ -2664,7 +2738,7 @@ invalid_signature_client(Config) when is_list(Config) ->
 					      {host, Hostname},
 					      {from, self()}, 
 					      {options, NewClientOpts}]),
-    
+
     tcp_delivery_workaround(Server, {error, "bad certificate"},
 			    Client, {error,"bad certificate"}).
 
@@ -2971,4 +3045,3 @@ erlang_ssl_receive(Socket, Data) ->
     after ?SLEEP * 3 ->
 	    test_server:fail({did_not_get, Data})
     end.
- 
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index 46b6eb401d..d11acc8130 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -318,6 +318,25 @@ cert_options(Config) ->
      | Config].
 
 
+make_dsa_cert(Config) ->
+    ServerCaInfo = {ServerCaCert, _} = erl_make_certs:make_cert([{key, dsa}]),
+    {ServerCert, ServerCertKey} = erl_make_certs:make_cert([{key, dsa}, {issuer, ServerCaInfo}]),
+    ServerCaCertFile = filename:join([?config(priv_dir, Config), 
+				      "server", "dsa_cacerts.pem"]),
+    ServerCertFile = filename:join([?config(priv_dir, Config), 
+				      "server", "dsa_cert.pem"]),
+    ServerKeyFile = filename:join([?config(priv_dir, Config), 
+				   "server", "dsa_key.pem"]),
+
+    public_key:der_to_pem(ServerCaCertFile, [{cert, ServerCaCert, not_encrypted}]),
+    public_key:der_to_pem(ServerCertFile, [{cert, ServerCert, not_encrypted}]),
+    public_key:der_to_pem(ServerKeyFile, [ServerCertKey]),
+
+    [{server_dsa_opts, [{ssl_imp, new},{reuseaddr, true}, 
+				 {cacertfile, ServerCaCertFile},
+				 {certfile, ServerCertFile}, {keyfile, ServerKeyFile}]} | Config].
+    
+    
 start_upgrade_server(Args) ->
     Result = spawn_link(?MODULE, run_upgrade_server, [Args]),
     receive
@@ -529,3 +548,42 @@ send_selected_port(Pid, 0, Socket) ->
     Pid ! {self(), {port, NewPort}};
 send_selected_port(_,_,_) ->
     ok.
+
+rsa_suites() ->
+    lists:filter(fun({dhe_dss, _, _}) ->
+			 false;
+		    (_) ->
+			 true
+		 end,
+		 ssl:cipher_suites()).
+
+dsa_suites() ->
+     lists:filter(fun({dhe_dss, _, _}) ->
+			 true;
+		    (_) ->
+			 false
+		 end,
+		 ssl:cipher_suites()).
+
+
+openssl_rsa_suites() ->
+    Ciphers = ssl:cipher_suites(openssl),
+    lists:filter(fun(Str) ->
+			 case re:run(Str,"DSS",[]) of
+			     nomatch ->
+				 true;
+			     _ ->
+				 false
+			 end 
+		 end, Ciphers).
+
+openssl_dsa_suites() ->
+    Ciphers = ssl:cipher_suites(openssl),
+    lists:filter(fun(Str) ->
+			 case re:run(Str,"DSS",[]) of
+			     nomatch ->
+				 false;
+			     _ ->
+				 true
+			 end 
+		 end, Ciphers).
diff --git a/lib/ssl/test/ssl_to_openssl_SUITE.erl b/lib/ssl/test/ssl_to_openssl_SUITE.erl
index 1c18f10038..e4c77b2fb4 100644
--- a/lib/ssl/test/ssl_to_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_to_openssl_SUITE.erl
@@ -56,7 +56,8 @@ init_per_suite(Config) ->
 		(catch make_certs:all(?config(data_dir, Config), 
 				      ?config(priv_dir, Config))),
 	    test_server:format("Make certs  ~p~n", [Result]),
-	    ssl_test_lib:cert_options(Config)
+	    NewConfig = ssl_test_lib:make_dsa_cert(Config),
+	    ssl_test_lib:cert_options(NewConfig)
     end.
 
 %%--------------------------------------------------------------------
@@ -142,6 +143,7 @@ all(doc) ->
 all(suite) -> 
     [erlang_client_openssl_server, 
      erlang_server_openssl_client,
+     erlang_server_openssl_client_dsa_cert,
      erlang_server_openssl_client_reuse_session,
      erlang_client_openssl_server_renegotiate,
      erlang_client_openssl_server_no_wrap_sequence_number,
@@ -157,7 +159,8 @@ all(suite) ->
      tls1_erlang_client_openssl_server_client_cert,
      tls1_erlang_server_openssl_client_client_cert,
      tls1_erlang_server_erlang_client_client_cert,
-     ciphers,
+     ciphers_rsa_signed_certs,
+     ciphers_dsa_signed_certs,
      erlang_client_bad_openssl_server,
      expired_session,
      ssl2_erlang_server_openssl_client
@@ -247,6 +250,43 @@ erlang_server_openssl_client(Config) when is_list(Config) ->
 
 %%-------------------------------------------------------------------- 
 
+erlang_server_openssl_client_dsa_cert(doc) ->
+    ["Test erlang server with openssl client"];
+erlang_server_openssl_client_dsa_cert(suite) ->
+    [];
+erlang_server_openssl_client_dsa_cert(Config) when is_list(Config) ->
+    process_flag(trap_exit, true),
+    ServerOpts = ?config(server_dsa_opts, Config),  
+
+    {_, ServerNode, _} = ssl_test_lib:run_where(Config),
+    
+    Data = "From openssl to erlang",
+
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
+					{from, self()}, 
+			   {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
+			   {options, ServerOpts}]),
+    Port = ssl_test_lib:inet_port(Server),
+    
+    Cmd = "openssl s_client -port " ++ integer_to_list(Port)  ++ 
+	" -host localhost -tls1 -msg",
+
+    test_server:format("openssl cmd: ~p~n", [Cmd]),
+    
+    OpenSslPort =  open_port({spawn, Cmd}, [stderr_to_stdout]), 
+    port_command(OpenSslPort, Data),
+    
+    ssl_test_lib:check_result(Server, ok),
+    
+    ssl_test_lib:close(Server),
+
+    close_port(OpenSslPort),
+    process_flag(trap_exit, false),
+    ok.
+
+
+%%-------------------------------------------------------------------- 
+
 erlang_server_openssl_client_reuse_session(doc) ->
     ["Test erlang server with openssl client that reconnects with the"
      "same session id, to test reusing of sessions."];
@@ -881,19 +921,46 @@ tls1_erlang_server_erlang_client_client_cert(Config) when is_list(Config) ->
     ok.
 %%--------------------------------------------------------------------
 
-ciphers(doc) -> 
-    [""];
+ciphers_rsa_signed_certs(doc) -> 
+    ["Test cipher suites that uses rsa certs"];
+       
+ciphers_rsa_signed_certs(suite) -> 
+    [];
+
+ciphers_rsa_signed_certs(Config) when is_list(Config) ->
+    Version = 
+	ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
+
+    Ciphers = ssl_test_lib:rsa_suites(),
+    run_suites(Ciphers, Version, Config, rsa).
+
+
+ciphers_dsa_signed_certs(doc) -> 
+    ["Test cipher suites that uses dsa certs"];
        
-ciphers(suite) -> 
+ciphers_dsa_signed_certs(suite) -> 
     [];
 
-ciphers(Config) when is_list(Config) ->
+ciphers_dsa_signed_certs(Config) when is_list(Config) ->
     Version = 
 	ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
 
-    Ciphers = ssl:cipher_suites(),
+    Ciphers = ssl_test_lib:dsa_suites(),
+    run_suites(Ciphers, Version, Config, dsa).
+
+run_suites(Ciphers, Version, Config, Type) ->
+    {ClientOpts, ServerOpts} =
+	case Type of 
+	    rsa ->
+		{?config(client_opts, Config),
+		 ?config(server_opts, Config)};
+	    dsa ->
+		{?config(client_opts, Config),
+		 ?config(server_dsa_opts, Config)}
+	end,
+    
     Result =  lists:map(fun(Cipher) -> 
-				cipher(Cipher, Version, Config) end,
+				cipher(Cipher, Version, Config, ClientOpts, ServerOpts) end,
 			Ciphers),
     case lists:flatten(Result) of
 	[] ->
@@ -902,12 +969,12 @@ ciphers(Config) when is_list(Config) ->
 	    test_server:format("Cipher suite errors: ~p~n", [Error]),
 	    test_server:fail(cipher_suite_failed_see_test_case_log) 
     end.
-    
-cipher(CipherSuite, Version, Config) ->   
+
+
+
+cipher(CipherSuite, Version, Config, ClientOpts, ServerOpts) ->   
     process_flag(trap_exit, true),
     test_server:format("Testing CipherSuite ~p~n", [CipherSuite]),
-    ClientOpts = ?config(client_opts, Config),
-    ServerOpts = ?config(server_opts, Config),
     {ClientNode, _ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     
     Port = ssl_test_lib:inet_port(node()),