Merge branch 'ingela/ssl/cert-handling' into maint

* ingela/ssl/cert-handling:
  ssl: Correct cipher suite handling
  ssl: Modernize DSA cert chain generation
  ssl: Clean
  ssl: Remove test of OpenSSL
  ssl: Use new cert generation

6 files changed, 218 insertions, 761 deletions

diff --git a/lib/ssl/test/Makefile b/lib/ssl/test/Makefile
index 558be6d642..c7e2f402af 100644
--- a/lib/ssl/test/Makefile
+++ b/lib/ssl/test/Makefile
@@ -56,7 +56,6 @@ MODULES = \
 	ssl_upgrade_SUITE\
 	ssl_sni_SUITE \
 	make_certs\
-	erl_make_certs\
         x509_test
 
 
diff --git a/lib/ssl/test/erl_make_certs.erl b/lib/ssl/test/erl_make_certs.erl
deleted file mode 100644
index 3ab6222780..0000000000
--- a/lib/ssl/test/erl_make_certs.erl
+++ /dev/null
@@ -1,477 +0,0 @@
-%%
-%% %CopyrightBegin%
-%%
-%% Copyright Ericsson AB 2011-2017. All Rights Reserved.
-%%
-%% Licensed under the Apache License, Version 2.0 (the "License");
-%% you may not use this file except in compliance with the License.
-%% You may obtain a copy of the License at
-%%
-%%     http://www.apache.org/licenses/LICENSE-2.0
-%%
-%% Unless required by applicable law or agreed to in writing, software
-%% distributed under the License is distributed on an "AS IS" BASIS,
-%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-%% See the License for the specific language governing permissions and
-%% limitations under the License.
-%%
-%% %CopyrightEnd%
-%%
-
-%% Create test certificates
-
--module(erl_make_certs).
--include_lib("public_key/include/public_key.hrl").
-
--export([make_cert/1, gen_rsa/1, verify_signature/3, write_pem/3]).
--compile(export_all).
-
-%%--------------------------------------------------------------------
-%% @doc  Create and return a der encoded certificate
-%%   Option                                         Default
-%%   -------------------------------------------------------
-%%   digest                                         sha1
-%%   validity                                       {date(), date() + week()}
-%%   version                                        3
-%%   subject                                        [] list of the following content
-%%      {name,  Name}
-%%      {email, Email} 
-%%      {city,  City}
-%%      {state, State}
-%%      {org, Org}
-%%      {org_unit, OrgUnit}
-%%      {country, Country} 
-%%      {serial, Serial}
-%%      {title, Title}
-%%      {dnQualifer, DnQ}
-%%   issuer = {Issuer, IssuerKey}                   true (i.e. a ca cert is created) 
-%%                                                  (obs IssuerKey migth be {Key, Password}
-%%   key = KeyFile|KeyBin|rsa|dsa|ec                Subject PublicKey rsa, dsa or ec generates key
-%%   
-%%
-%%   (OBS: The generated keys are for testing only)
-%% @spec ([{::atom(), ::term()}]) -> {Cert::binary(), Key::binary()}
-%% @end
-%%--------------------------------------------------------------------
-
-make_cert(Opts) ->
-    SubjectPrivateKey = get_key(Opts),
-    {TBSCert, IssuerKey} = make_tbs(SubjectPrivateKey, Opts),
-    Cert = public_key:pkix_sign(TBSCert, IssuerKey),
-    true = verify_signature(Cert, IssuerKey, undef), %% verify that the keys where ok
-    {Cert, encode_key(SubjectPrivateKey)}.
-
-%%--------------------------------------------------------------------
-%% @doc Writes pem files in Dir with FileName ++ ".pem" and FileName ++ "_key.pem"
-%% @spec (::string(), ::string(), {Cert,Key}) -> ok
-%% @end
-%%--------------------------------------------------------------------
-write_pem(Dir, FileName, {Cert, Key = {_,_,not_encrypted}}) when is_binary(Cert) ->
-    ok = der_to_pem(filename:join(Dir, FileName ++ ".pem"),
-			       [{'Certificate', Cert, not_encrypted}]),
-    ok = der_to_pem(filename:join(Dir, FileName ++ "_key.pem"), [Key]).
-
-%%--------------------------------------------------------------------
-%% @doc Creates a rsa key (OBS: for testing only)
-%%   the size are in bytes
-%% @spec (::integer()) -> {::atom(), ::binary(), ::opaque()}
-%% @end
-%%--------------------------------------------------------------------
-gen_rsa(Size) when is_integer(Size) ->
-    Key = gen_rsa2(Size),
-    {Key, encode_key(Key)}.
-
-%%--------------------------------------------------------------------
-%% @doc Creates a dsa key (OBS: for testing only)
-%%   the sizes are in bytes
-%% @spec (::integer()) -> {::atom(), ::binary(), ::opaque()}
-%% @end
-%%--------------------------------------------------------------------
-gen_dsa(LSize,NSize) when is_integer(LSize), is_integer(NSize) ->
-    Key = gen_dsa2(LSize, NSize),
-    {Key, encode_key(Key)}.
-
-%%--------------------------------------------------------------------
-%% @doc Creates a ec key (OBS: for testing only)
-%%   the sizes are in bytes
-%% @spec (::integer()) -> {::atom(), ::binary(), ::opaque()}
-%% @end
-%%--------------------------------------------------------------------
-gen_ec(Curve) when is_atom(Curve) ->
-    Key = gen_ec2(Curve),
-    {Key, encode_key(Key)}.
-
-%%--------------------------------------------------------------------
-%% @doc Verifies cert signatures
-%% @spec (::binary(), ::tuple()) -> ::boolean()
-%% @end
-%%--------------------------------------------------------------------
-verify_signature(DerEncodedCert, DerKey, _KeyParams) ->
-    Key = decode_key(DerKey),
-    case Key of 
-	#'RSAPrivateKey'{modulus=Mod, publicExponent=Exp} ->
-	    public_key:pkix_verify(DerEncodedCert, 
-				   #'RSAPublicKey'{modulus=Mod, publicExponent=Exp});
-	#'DSAPrivateKey'{p=P, q=Q, g=G, y=Y} ->
-	    public_key:pkix_verify(DerEncodedCert, {Y, #'Dss-Parms'{p=P, q=Q, g=G}});
-	#'ECPrivateKey'{version = _Version, privateKey = _PrivKey,
-			parameters = Params, publicKey = PubKey} ->
-	    public_key:pkix_verify(DerEncodedCert, {#'ECPoint'{point = PubKey}, Params})
-    end.
-
-%%%%%%%%%%%%%%%%%%%%%%%%% Implementation %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-
-get_key(Opts) ->
-    case proplists:get_value(key, Opts) of
-	undefined -> make_key(rsa, Opts);
-	rsa ->       make_key(rsa, Opts);
-	dsa ->       make_key(dsa, Opts);
-	ec ->        make_key(ec, Opts);
-	Key ->
-	    Password = proplists:get_value(password, Opts, no_passwd),
-	    decode_key(Key, Password)
-    end.
-
-decode_key({Key, Pw}) ->
-    decode_key(Key, Pw);
-decode_key(Key) ->
-    decode_key(Key, no_passwd).
-    
-
-decode_key(#'RSAPublicKey'{} = Key,_) ->
-    Key;
-decode_key(#'RSAPrivateKey'{} = Key,_) ->
-    Key;
-decode_key(#'DSAPrivateKey'{} = Key,_) ->
-    Key;
-decode_key(#'ECPrivateKey'{} = Key,_) ->
-    Key;
-decode_key(PemEntry = {_,_,_}, Pw) ->
-    public_key:pem_entry_decode(PemEntry, Pw);
-decode_key(PemBin, Pw) ->
-    [KeyInfo] = public_key:pem_decode(PemBin),
-    decode_key(KeyInfo, Pw).
-
-encode_key(Key = #'RSAPrivateKey'{}) ->
-    {ok, Der} = 'OTP-PUB-KEY':encode('RSAPrivateKey', Key),
-    {'RSAPrivateKey', Der, not_encrypted};
-encode_key(Key = #'DSAPrivateKey'{}) ->
-    {ok, Der} = 'OTP-PUB-KEY':encode('DSAPrivateKey', Key),
-    {'DSAPrivateKey', Der, not_encrypted};
-encode_key(Key = #'ECPrivateKey'{}) ->
-    {ok, Der} = 'OTP-PUB-KEY':encode('ECPrivateKey', Key),
-    {'ECPrivateKey', Der, not_encrypted}.
-
-make_tbs(SubjectKey, Opts) ->    
-    Version = list_to_atom("v"++integer_to_list(proplists:get_value(version, Opts, 3))),
-
-    IssuerProp = proplists:get_value(issuer, Opts, true),
-    {Issuer, IssuerKey}  = issuer(IssuerProp, Opts, SubjectKey),
-
-    {Algo, Parameters} = sign_algorithm(IssuerKey, Opts),
-    
-    SignAlgo = #'SignatureAlgorithm'{algorithm  = Algo,
-				     parameters = Parameters},    
-    Subject = case IssuerProp of
-		  true -> %% Is a Root Ca
-		      Issuer;
-		  _ ->
-		      subject(proplists:get_value(subject, Opts),false)
-	      end,
-
-    {#'OTPTBSCertificate'{serialNumber = trunc(rand:uniform()*100000000)*10000 + 1,
-			  signature    = SignAlgo,
-			  issuer       = Issuer,
-			  validity     = validity(Opts),
-			  subject      = Subject,
-			  subjectPublicKeyInfo = publickey(SubjectKey),
-			  version      = Version,
-			  extensions   = extensions(Opts)
-			 }, IssuerKey}.
-
-issuer(true, Opts, SubjectKey) ->
-    %% Self signed
-    {subject(proplists:get_value(subject, Opts), true), SubjectKey};
-issuer({Issuer, IssuerKey}, _Opts, _SubjectKey) when is_binary(Issuer) ->
-    {issuer_der(Issuer), decode_key(IssuerKey)};
-issuer({File, IssuerKey}, _Opts, _SubjectKey) when is_list(File) ->
-    {ok, [{cert, Cert, _}|_]} = pem_to_der(File),
-    {issuer_der(Cert), decode_key(IssuerKey)}.
-
-issuer_der(Issuer) ->
-    Decoded = public_key:pkix_decode_cert(Issuer, otp),
-    #'OTPCertificate'{tbsCertificate=Tbs} = Decoded,
-    #'OTPTBSCertificate'{subject=Subject} = Tbs,
-    Subject.
-
-subject(undefined, IsRootCA) ->
-    User = if IsRootCA -> "RootCA"; true -> os:getenv("USER", "test_user") end,
-    Opts = [{email, User ++ "@erlang.org"},
-	    {name, User},
-	    {city, "Stockholm"},
-	    {country, "SE"},
-	    {org, "erlang"},
-	    {org_unit, "testing dep"}],
-    subject(Opts);
-subject(Opts, _) ->
-    subject(Opts).
-
-subject(SubjectOpts) when is_list(SubjectOpts) ->
-    Encode = fun(Opt) ->
-		     {Type,Value} = subject_enc(Opt),
-		     [#'AttributeTypeAndValue'{type=Type, value=Value}]
-	     end,
-    {rdnSequence, [Encode(Opt) || Opt <- SubjectOpts]}.
-
-%% Fill in the blanks
-subject_enc({name,  Name}) ->       {?'id-at-commonName', {printableString, Name}};
-subject_enc({email, Email}) ->      {?'id-emailAddress', Email};
-subject_enc({city,  City}) ->       {?'id-at-localityName', {printableString, City}};
-subject_enc({state, State}) ->      {?'id-at-stateOrProvinceName', {printableString, State}};
-subject_enc({org, Org}) ->          {?'id-at-organizationName', {printableString, Org}};
-subject_enc({org_unit, OrgUnit}) -> {?'id-at-organizationalUnitName', {printableString, OrgUnit}};
-subject_enc({country, Country}) ->  {?'id-at-countryName', Country};
-subject_enc({serial, Serial}) ->    {?'id-at-serialNumber', Serial};
-subject_enc({title, Title}) ->      {?'id-at-title', {printableString, Title}};
-subject_enc({dnQualifer, DnQ}) ->   {?'id-at-dnQualifier', DnQ};
-subject_enc(Other) ->               Other.
-
-
-extensions(Opts) ->
-    case proplists:get_value(extensions, Opts, []) of
-	false -> 
-	    asn1_NOVALUE;
-	Exts  -> 
-	    lists:flatten([extension(Ext) || Ext <- default_extensions(Exts)])
-    end.
-
-default_extensions(Exts) ->
-    Def = [{key_usage,undefined}, 
-	   {subject_altname, undefined},
-	   {issuer_altname, undefined},
-	   {basic_constraints, default},
-	   {name_constraints, undefined},
-	   {policy_constraints, undefined},
-	   {ext_key_usage, undefined},
-	   {inhibit_any, undefined},
-	   {auth_key_id, undefined},
-	   {subject_key_id, undefined},
-	   {policy_mapping, undefined}],
-    Filter = fun({Key, _}, D) -> lists:keydelete(Key, 1, D) end,
-    Exts ++ lists:foldl(Filter, Def, Exts).
-       	
-extension({_, undefined}) -> [];
-extension({basic_constraints, Data}) ->
-    case Data of
-	default ->
-	    #'Extension'{extnID = ?'id-ce-basicConstraints',
-			 extnValue = #'BasicConstraints'{cA=true},
-			 critical=true};
-	false -> 
-	    [];
-	Len when is_integer(Len) ->
-	    #'Extension'{extnID = ?'id-ce-basicConstraints',
-			 extnValue = #'BasicConstraints'{cA=true, pathLenConstraint=Len},
-			 critical=true};
-	_ ->
-	    #'Extension'{extnID = ?'id-ce-basicConstraints',
-			 extnValue = Data}
-    end;
-extension({Id, Data, Critical}) ->
-    #'Extension'{extnID = Id, extnValue = Data, critical = Critical}.
-
-
-publickey(#'RSAPrivateKey'{modulus=N, publicExponent=E}) ->
-    Public = #'RSAPublicKey'{modulus=N, publicExponent=E},
-    Algo = #'PublicKeyAlgorithm'{algorithm= ?rsaEncryption, parameters='NULL'},
-    #'OTPSubjectPublicKeyInfo'{algorithm = Algo,
-			       subjectPublicKey = Public};
-publickey(#'DSAPrivateKey'{p=P, q=Q, g=G, y=Y}) ->
-    Algo = #'PublicKeyAlgorithm'{algorithm= ?'id-dsa', 
-				 parameters={params, #'Dss-Parms'{p=P, q=Q, g=G}}},
-    #'OTPSubjectPublicKeyInfo'{algorithm = Algo, subjectPublicKey = Y};
-publickey(#'ECPrivateKey'{version = _Version,
-			  privateKey = _PrivKey,
-			  parameters = Params,
-			  publicKey = PubKey}) ->
-    Algo = #'PublicKeyAlgorithm'{algorithm= ?'id-ecPublicKey', parameters=Params},
-    #'OTPSubjectPublicKeyInfo'{algorithm = Algo,
-			       subjectPublicKey = #'ECPoint'{point = PubKey}}.
-
-validity(Opts) ->
-    DefFrom0 = calendar:gregorian_days_to_date(calendar:date_to_gregorian_days(date())-1),
-    DefTo0   = calendar:gregorian_days_to_date(calendar:date_to_gregorian_days(date())+7),
-    {DefFrom, DefTo} = proplists:get_value(validity, Opts, {DefFrom0, DefTo0}),
-    Format = fun({Y,M,D}) -> lists:flatten(io_lib:format("~w~2..0w~2..0w000000Z",[Y,M,D])) end,
-    #'Validity'{notBefore={generalTime, Format(DefFrom)},
-		notAfter ={generalTime, Format(DefTo)}}.
-
-sign_algorithm(#'RSAPrivateKey'{}, Opts) ->
-    Type = case proplists:get_value(digest, Opts, sha1) of
-	       sha1 ->   ?'sha1WithRSAEncryption';
-	       sha512 -> ?'sha512WithRSAEncryption';
-	       sha384 -> ?'sha384WithRSAEncryption';
-	       sha256 -> ?'sha256WithRSAEncryption';
-	       md5    -> ?'md5WithRSAEncryption';
-	       md2    -> ?'md2WithRSAEncryption'
-	   end,
-    {Type, 'NULL'};
-sign_algorithm(#'DSAPrivateKey'{p=P, q=Q, g=G}, _Opts) ->
-    {?'id-dsa-with-sha1', {params,#'Dss-Parms'{p=P, q=Q, g=G}}};
-sign_algorithm(#'ECPrivateKey'{parameters = Parms}, Opts) ->
-    Type = case proplists:get_value(digest, Opts, sha1) of
-	       sha1 ->   ?'ecdsa-with-SHA1';
-	       sha512 -> ?'ecdsa-with-SHA512';
-	       sha384 -> ?'ecdsa-with-SHA384';
-	       sha256 -> ?'ecdsa-with-SHA256'
-	   end,
-    {Type, Parms}.
-
-make_key(rsa, _Opts) ->
-    %% (OBS: for testing only)
-    gen_rsa2(64);
-make_key(dsa, _Opts) ->
-    gen_dsa2(128, 20);  %% Bytes i.e. {1024, 160}
-make_key(ec, _Opts) ->
-    %% (OBS: for testing only)
-    CurveOid = hd(tls_v1:ecc_curves(0)),
-    NamedCurve = pubkey_cert_records:namedCurves(CurveOid),
-    gen_ec2(NamedCurve).
-    
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-%% RSA key generation  (OBS: for testing only)
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-
--define(SMALL_PRIMES, [65537,97,89,83,79,73,71,67,61,59,53,
-		       47,43,41,37,31,29,23,19,17,13,11,7,5,3]).
-
-gen_rsa2(Size) ->
-    P = prime(Size),
-    Q = prime(Size),
-    N = P*Q,
-    Tot = (P - 1) * (Q - 1),
-    [E|_] = lists:dropwhile(fun(Candidate) -> (Tot rem Candidate) == 0 end, ?SMALL_PRIMES),
-    {D1,D2} = extended_gcd(E, Tot),
-    D = erlang:max(D1,D2),
-    case D < E of
-	true ->
-	    gen_rsa2(Size);
-	false ->
-	    {Co1,Co2} = extended_gcd(Q, P),
-	    Co = erlang:max(Co1,Co2),
-	    #'RSAPrivateKey'{version = 'two-prime',
-			     modulus = N,
-			     publicExponent  = E,
-			     privateExponent = D, 
-			     prime1 = P, 
-			     prime2 = Q, 
-			     exponent1 = D rem (P-1), 
-			     exponent2 = D rem (Q-1), 
-			     coefficient = Co
-			    }
-    end.
-
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-%% DSA key generation  (OBS: for testing only)
-%% See http://en.wikipedia.org/wiki/Digital_Signature_Algorithm
-%% and the fips_186-3.pdf
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-gen_dsa2(LSize, NSize) ->
-    Q  = prime(NSize),  %% Choose N-bit prime Q
-    X0 = prime(LSize),
-    P0 = prime((LSize div 2) +1),
-    
-    %% Choose L-bit prime modulus P such that p-1 is a multiple of q.
-    case dsa_search(X0 div (2*Q*P0), P0, Q, 1000) of
-	error -> 
-	    gen_dsa2(LSize, NSize);
-	P ->	    
-	    G = crypto:mod_pow(2, (P-1) div Q, P), % Choose G a number whose multiplicative order modulo p is q.
-	    %%                 such that This may be done by setting g = h^(p-1)/q mod p, commonly h=2 is used.
-	    
-	    X = prime(20),               %% Choose x by some random method, where 0 < x < q.
-	    Y = crypto:mod_pow(G, X, P), %% Calculate y = g^x mod p.
-	    
-	    #'DSAPrivateKey'{version=0, p = P, q = Q, 
-			     g = crypto:bytes_to_integer(G), y = crypto:bytes_to_integer(Y), x = X}
-    end.
-    
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-%% EC key generation  (OBS: for testing only)
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-
-gen_ec2(CurveId) ->
-     {PubKey, PrivKey} = crypto:generate_key(ecdh, CurveId),
-
-    #'ECPrivateKey'{version = 1,
-		    privateKey = PrivKey,
-		    parameters = {namedCurve, pubkey_cert_records:namedCurves(CurveId)},
-		    publicKey = PubKey}.
-
-%% See fips_186-3.pdf
-dsa_search(T, P0, Q, Iter) when Iter > 0 ->
-    P = 2*T*Q*P0 + 1,
-    case is_prime(P, 50) of
-	true -> P;
-	false -> dsa_search(T+1, P0, Q, Iter-1)
-    end;
-dsa_search(_,_,_,_) -> 
-    error.
-
-
-%%%%%%% Crypto Math %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-prime(ByteSize) ->
-    Rand = odd_rand(ByteSize),
-    prime_odd(Rand, 0).
-
-prime_odd(Rand, N) ->
-    case is_prime(Rand, 50) of
-	true -> 
-	    Rand;
-	false -> 
-	    prime_odd(Rand+2, N+1)
-    end.
-
-%% see http://en.wikipedia.org/wiki/Fermat_primality_test
-is_prime(_, 0) -> true;
-is_prime(Candidate, Test) -> 
-    CoPrime = odd_rand(10000, Candidate),
-    Result = crypto:mod_pow(CoPrime, Candidate, Candidate) ,
-    is_prime(CoPrime, crypto:bytes_to_integer(Result), Candidate, Test).
-
-is_prime(CoPrime, CoPrime, Candidate, Test) ->
-    is_prime(Candidate, Test-1);
-is_prime(_,_,_,_) ->
-    false.
-
-odd_rand(Size) ->
-    Min = 1 bsl (Size*8-1),
-    Max = (1 bsl (Size*8))-1,
-    odd_rand(Min, Max).
-
-odd_rand(Min,Max) ->
-    Rand = crypto:rand_uniform(Min,Max),
-    case Rand rem 2 of
-	0 -> 
-	    Rand + 1;
-	_ -> 
-	    Rand
-    end.
-
-extended_gcd(A, B) ->
-    case A rem B of
-	0 ->
-	    {0, 1};
-	N ->
-	    {X, Y} = extended_gcd(B, N),
-	    {Y, X-Y*(A div B)}
-    end.
-
-pem_to_der(File) ->
-    {ok, PemBin} = file:read_file(File),
-    public_key:pem_decode(PemBin).
-
-der_to_pem(File, Entries) ->
-    PemBin = public_key:pem_encode(Entries),
-    file:write_file(File, PemBin).
-
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index 8a4d827456..12d255a5bc 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -2315,20 +2315,16 @@ tls_shutdown_error(Config) when is_list(Config) ->
 ciphers_rsa_signed_certs() ->
     [{doc,"Test all rsa ssl cipher suites in highest support ssl/tls version"}].
        
-ciphers_rsa_signed_certs(Config) when is_list(Config) ->
-    Version = ssl_test_lib:protocol_version(Config),
+ciphers_rsa_signed_certs(Config) when is_list(Config) ->  
     Ciphers = ssl_test_lib:rsa_suites(crypto),
-    ct:log("~p erlang cipher suites ~p~n", [Version, Ciphers]),
-    run_suites(Ciphers, Version, Config, rsa).
+    run_suites(Ciphers, Config, rsa).
 %%-------------------------------------------------------------------
 ciphers_rsa_signed_certs_openssl_names() ->
     [{doc,"Test all rsa ssl cipher suites in highest support ssl/tls version"}].
        
 ciphers_rsa_signed_certs_openssl_names(Config) when is_list(Config) ->
-    Version = ssl_test_lib:protocol_version(Config),
-    Ciphers = ssl_test_lib:openssl_rsa_suites(crypto),  
-    ct:log("tls1 openssl cipher suites ~p~n", [Ciphers]),
-    run_suites(Ciphers, Version, Config, rsa).
+    Ciphers = ssl_test_lib:openssl_rsa_suites(),  
+    run_suites(Ciphers, Config, rsa).
 
 %%-------------------------------------------------------------------
 ciphers_dsa_signed_certs() ->
@@ -2336,120 +2332,104 @@ ciphers_dsa_signed_certs() ->
        
 ciphers_dsa_signed_certs(Config) when is_list(Config) ->
     NVersion = ssl_test_lib:protocol_version(Config, tuple),
-    Version = ssl_test_lib:protocol_version(Config),
     Ciphers = ssl_test_lib:dsa_suites(NVersion),
-    ct:log("~p erlang cipher suites ~p~n", [Version, Ciphers]),
-    run_suites(Ciphers, Version, Config, dsa).
+    run_suites(Ciphers, Config, dsa).
 %%-------------------------------------------------------------------
 ciphers_dsa_signed_certs_openssl_names() ->
     [{doc,"Test all dsa ssl cipher suites in highest support ssl/tls version"}].
        
 ciphers_dsa_signed_certs_openssl_names(Config) when is_list(Config) ->
-    Version = ssl_test_lib:protocol_version(Config),
     Ciphers = ssl_test_lib:openssl_dsa_suites(),
-    ct:log("tls1 openssl cipher suites ~p~n", [Ciphers]),
-    run_suites(Ciphers, Version, Config, dsa).
+    run_suites(Ciphers, Config, dsa).
 %%-------------------------------------------------------------------
 anonymous_cipher_suites()->
     [{doc,"Test the anonymous ciphersuites"}].
 anonymous_cipher_suites(Config) when is_list(Config) ->
-    Version = ssl_test_lib:protocol_version(Config),
-    Ciphers = ssl_test_lib:anonymous_suites(Version),
-    run_suites(Ciphers, Version, Config, anonymous).
+    NVersion = ssl_test_lib:protocol_version(Config, tuple),
+    Ciphers = ssl_test_lib:anonymous_suites(NVersion),
+    run_suites(Ciphers, Config, anonymous).
 %%-------------------------------------------------------------------
 psk_cipher_suites() ->
     [{doc, "Test the PSK ciphersuites WITHOUT server supplied identity hint"}].
 psk_cipher_suites(Config) when is_list(Config) ->
-    NVersion = tls_record:highest_protocol_version([]),
-    Version = ssl_test_lib:protocol_version(Config),
+    NVersion = ssl_test_lib:protocol_version(Config, tuple),
     Ciphers = ssl_test_lib:psk_suites(NVersion),
-    run_suites(Ciphers, Version, Config, psk).
+    run_suites(Ciphers, Config, psk).
 %%-------------------------------------------------------------------
 psk_with_hint_cipher_suites()->
     [{doc, "Test the PSK ciphersuites WITH server supplied identity hint"}].
 psk_with_hint_cipher_suites(Config) when is_list(Config) ->
-    NVersion = tls_record:highest_protocol_version([]),
-    Version = ssl_test_lib:protocol_version(Config),
+    NVersion = ssl_test_lib:protocol_version(Config, tuple),
     Ciphers = ssl_test_lib:psk_suites(NVersion),
-    run_suites(Ciphers, Version, Config, psk_with_hint).
+    run_suites(Ciphers, Config, psk_with_hint).
 %%-------------------------------------------------------------------
 psk_anon_cipher_suites() ->
     [{doc, "Test the anonymous PSK ciphersuites WITHOUT server supplied identity hint"}].
 psk_anon_cipher_suites(Config) when is_list(Config) ->
-    NVersion = tls_record:highest_protocol_version([]),
-    Version = ssl_test_lib:protocol_version(Config),
+    NVersion = ssl_test_lib:protocol_version(Config, tuple),
     Ciphers = ssl_test_lib:psk_anon_suites(NVersion),
-    run_suites(Ciphers, Version, Config, psk_anon).
+    run_suites(Ciphers, Config, psk_anon).
 %%-------------------------------------------------------------------
 psk_anon_with_hint_cipher_suites()->
     [{doc, "Test the anonymous PSK ciphersuites WITH server supplied identity hint"}].
 psk_anon_with_hint_cipher_suites(Config) when is_list(Config) ->
-    NVersion = tls_record:highest_protocol_version([]),
-    Version = ssl_test_lib:protocol_version(Config),
+    NVersion = ssl_test_lib:protocol_version(Config, tuple),
     Ciphers = ssl_test_lib:psk_anon_suites(NVersion),
-    run_suites(Ciphers, Version, Config, psk_anon_with_hint).
+    run_suites(Ciphers, Config, psk_anon_with_hint).
 %%-------------------------------------------------------------------
 srp_cipher_suites()->
     [{doc, "Test the SRP ciphersuites"}].
 srp_cipher_suites(Config) when is_list(Config) ->
-    Version = ssl_test_lib:protocol_version(Config),
     Ciphers = ssl_test_lib:srp_suites(),
-    run_suites(Ciphers, Version, Config, srp).
+    run_suites(Ciphers, Config, srp).
 %%-------------------------------------------------------------------
 srp_anon_cipher_suites()->
     [{doc, "Test the anonymous SRP ciphersuites"}].
 srp_anon_cipher_suites(Config) when is_list(Config) ->
-    Version = ssl_test_lib:protocol_version(Config),
     Ciphers = ssl_test_lib:srp_anon_suites(),
-    run_suites(Ciphers, Version, Config, srp_anon).
+    run_suites(Ciphers, Config, srp_anon).
 %%-------------------------------------------------------------------
 srp_dsa_cipher_suites()->
     [{doc, "Test the SRP DSA ciphersuites"}].
 srp_dsa_cipher_suites(Config) when is_list(Config) ->
-    Version = ssl_test_lib:protocol_version(Config),
     Ciphers = ssl_test_lib:srp_dss_suites(),
-    run_suites(Ciphers, Version, Config, srp_dsa).
+    run_suites(Ciphers, Config, srp_dsa).
 %%-------------------------------------------------------------------
 rc4_rsa_cipher_suites()->
     [{doc, "Test the RC4 ciphersuites"}].
 rc4_rsa_cipher_suites(Config) when is_list(Config) ->
-    NVersion = tls_record:highest_protocol_version([]),
-    Version = tls_record:protocol_version(NVersion),
-    Ciphers = ssl_test_lib:rc4_suites(NVersion),
-    run_suites(Ciphers, Version, Config, rc4_rsa).
+    NVersion = ssl_test_lib:protocol_version(Config, tuple),
+    Ciphers = [S || {rsa,_,_} = S <- ssl_test_lib:rc4_suites(NVersion)],
+    run_suites(Ciphers, Config, rc4_rsa).
 %-------------------------------------------------------------------
 rc4_ecdh_rsa_cipher_suites()->
     [{doc, "Test the RC4 ciphersuites"}].
 rc4_ecdh_rsa_cipher_suites(Config) when is_list(Config) ->
-    NVersion = tls_record:highest_protocol_version([]),
-    Version = tls_record:protocol_version(NVersion),
-    Ciphers = ssl_test_lib:rc4_suites(NVersion),
-    run_suites(Ciphers, Version, Config, rc4_ecdh_rsa).
+    NVersion = ssl_test_lib:protocol_version(Config, tuple),
+    Ciphers = [S || {ecdh_rsa,_,_} = S <- ssl_test_lib:rc4_suites(NVersion)],
+    run_suites(Ciphers, Config, rc4_ecdh_rsa).
 
 %%-------------------------------------------------------------------
 rc4_ecdsa_cipher_suites()->
     [{doc, "Test the RC4 ciphersuites"}].
 rc4_ecdsa_cipher_suites(Config) when is_list(Config) ->
     NVersion = tls_record:highest_protocol_version([]),
-    Version = tls_record:protocol_version(NVersion),
-    Ciphers = ssl_test_lib:rc4_suites(NVersion),
-    run_suites(Ciphers, Version, Config, rc4_ecdsa).
+    Ciphers = [S || {ecdhe_ecdsa,_,_} = S <- ssl_test_lib:rc4_suites(NVersion)],
+    run_suites(Ciphers, Config, rc4_ecdsa).
 
 %%-------------------------------------------------------------------
 des_rsa_cipher_suites()->
     [{doc, "Test the des_rsa ciphersuites"}].
 des_rsa_cipher_suites(Config) when is_list(Config) ->
-    Version = ssl_test_lib:protocol_version(Config),
     Ciphers = ssl_test_lib:des_suites(Config),
-    run_suites(Ciphers, Version, Config, des_rsa).
+    run_suites(Ciphers, Config, des_rsa).
 %-------------------------------------------------------------------
 des_ecdh_rsa_cipher_suites()->
     [{doc, "Test ECDH rsa signed ciphersuites"}].
 des_ecdh_rsa_cipher_suites(Config) when is_list(Config) ->
     NVersion = ssl_test_lib:protocol_version(Config, tuple),
-    Version = ssl_test_lib:protocol_version(Config),
     Ciphers = ssl_test_lib:des_suites(NVersion),
-    run_suites(Ciphers, Version, Config, des_dhe_rsa).
+    run_suites(Ciphers, Config, des_dhe_rsa).
 
 %%--------------------------------------------------------------------
 default_reject_anonymous()->
@@ -2483,38 +2463,30 @@ ciphers_ecdsa_signed_certs() ->
 
 ciphers_ecdsa_signed_certs(Config) when is_list(Config) ->
     NVersion = ssl_test_lib:protocol_version(Config, tuple),
-    Version = ssl_test_lib:protocol_version(Config),
     Ciphers = ssl_test_lib:ecdsa_suites(NVersion),
-    ct:log("~p erlang cipher suites ~p~n", [Version, Ciphers]),
-    run_suites(Ciphers, Version, Config, ecdsa).
+    run_suites(Ciphers, Config, ecdsa).
 %%--------------------------------------------------------------------
 ciphers_ecdsa_signed_certs_openssl_names() ->
     [{doc, "Test all ecdsa ssl cipher suites in highest support ssl/tls version"}].
 
 ciphers_ecdsa_signed_certs_openssl_names(Config) when is_list(Config) ->
-    Version = ssl_test_lib:protocol_version(Config),
     Ciphers = ssl_test_lib:openssl_ecdsa_suites(),
-    ct:log("tls1 openssl cipher suites ~p~n", [Ciphers]),
-    run_suites(Ciphers, Version, Config, ecdsa).
+    run_suites(Ciphers, Config, ecdsa).
 %%--------------------------------------------------------------------
 ciphers_ecdh_rsa_signed_certs() ->
     [{doc, "Test all ecdh_rsa ssl cipher suites in highest support ssl/tls version"}].
 
 ciphers_ecdh_rsa_signed_certs(Config) when is_list(Config) ->
     NVersion = ssl_test_lib:protocol_version(Config, tuple),
-    Version = ssl_test_lib:protocol_version(Config),
     Ciphers = ssl_test_lib:ecdh_rsa_suites(NVersion),
-    ct:log("~p erlang cipher suites ~p~n", [Version, Ciphers]),
-    run_suites(Ciphers, Version, Config, ecdh_rsa).
+    run_suites(Ciphers, Config, ecdh_rsa).
 %%--------------------------------------------------------------------
 ciphers_ecdh_rsa_signed_certs_openssl_names() ->
     [{doc, "Test all ecdh_rsa ssl cipher suites in highest support ssl/tls version"}].
 
 ciphers_ecdh_rsa_signed_certs_openssl_names(Config) when is_list(Config) ->
-    Version = ssl_test_lib:protocol_version(Config),
     Ciphers = ssl_test_lib:openssl_ecdh_rsa_suites(),
-    ct:log("tls1 openssl cipher suites ~p~n", [Ciphers]),
-    run_suites(Ciphers, Version, Config, ecdh_rsa).
+    run_suites(Ciphers, Config, ecdh_rsa).
 %%--------------------------------------------------------------------
 reuse_session() ->
     [{doc,"Test reuse of sessions (short handshake)"}].
@@ -3031,37 +3003,6 @@ der_input_opts(Opts) ->
     {Cert, {Asn1Type, Key}, CaCerts, DHParams}.
 
 %%--------------------------------------------------------------------
-%% different_ca_peer_sign() ->
-%%     ["Check that a CA can have a different signature algorithm than the peer cert."];
-
-%% different_ca_peer_sign(Config) when is_list(Config) ->
-%%     ClientOpts =  ssl_test_lib:ssl_options(client_mix_opts, Config),
-%%     ServerOpts =  ssl_test_lib:ssl_options(server_mix_verify_opts, Config),
-
-%%     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-%%     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
-%% 					{from, self()},
-%% 			   {mfa, {ssl_test_lib, send_recv_result_active_once, []}},
-%% 			   {options, [{active, once},
-%% 				      {verify, verify_peer} | ServerOpts]}]),
-%%     Port  = ssl_test_lib:inet_port(Server),
-
-%%     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
-%% 					{host, Hostname},
-%% 					{from, self()},
-%% 					{mfa, {ssl_test_lib,
-%% 					       send_recv_result_active_once,
-%% 					       []}},
-%% 					{options, [{active, once},
-%% 						   {verify, verify_peer}
-%% 						   | ClientOpts]}]),
-
-%%     ssl_test_lib:check_result(Server, ok, Client, ok),
-%%     ssl_test_lib:close(Server),
-%%     ssl_test_lib:close(Client).
-
-
-%%--------------------------------------------------------------------
 no_reuses_session_server_restart_new_cert() ->
     [{doc,"Check that a session is not reused if the server is restarted with a new cert."}].
 no_reuses_session_server_restart_new_cert(Config) when is_list(Config) ->
@@ -3129,14 +3070,14 @@ no_reuses_session_server_restart_new_cert_file(Config) when is_list(Config) ->
     DsaServerOpts = ssl_test_lib:ssl_options(server_dsa_opts, Config),
     PrivDir =  proplists:get_value(priv_dir, Config),
 
-    NewServerOpts = new_config(PrivDir, ServerOpts),
+    NewServerOpts0 = new_config(PrivDir, ServerOpts),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
     Server =
 	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
 				   {from, self()},
 		      {mfa, {ssl_test_lib, session_info_result, []}},
-				   {options, NewServerOpts}]),
+				   {options, NewServerOpts0}]),
     Port = ssl_test_lib:inet_port(Server),
     Client0 =
 	ssl_test_lib:start_client([{node, ClientNode},
@@ -3157,13 +3098,13 @@ no_reuses_session_server_restart_new_cert_file(Config) when is_list(Config) ->
 
     ssl:clear_pem_cache(),
 
-    NewServerOpts = new_config(PrivDir, DsaServerOpts),
+    NewServerOpts1 = new_config(PrivDir, DsaServerOpts),
 
     Server1 =
 	ssl_test_lib:start_server([{node, ServerNode}, {port, Port},
 				   {from, self()},
 		      {mfa, {ssl_test_lib, no_result, []}},
-				   {options, NewServerOpts}]),
+				   {options, NewServerOpts1}]),
     Client1 =
 	ssl_test_lib:start_client([{node, ClientNode},
 		      {port, Port}, {host, Hostname},
@@ -3814,8 +3755,10 @@ no_rizzo_rc4() ->
 no_rizzo_rc4(Config) when is_list(Config) ->
     Prop = proplists:get_value(tc_group_properties, Config),
     Version = proplists:get_value(name, Prop),
-    Ciphers  =  [ssl_cipher:erl_suite_definition(Suite) || 
-		    Suite  <- ssl_test_lib:rc4_suites(tls_record:protocol_version(Version))],
+    NVersion = ssl_test_lib:protocol_version(Config, tuple),
+    %% Test uses RSA certs
+    Ciphers  = ssl_test_lib:rc4_suites(NVersion) -- [{ecdhe_ecdsa,rc4_128,sha},
+                                                     {ecdh_ecdsa,rc4_128,sha}],
     run_send_recv_rizzo(Ciphers, Config, Version,
 			{?MODULE, send_recv_result_active_no_rizzo, []}).
 
@@ -3825,7 +3768,8 @@ rizzo_one_n_minus_one() ->
 rizzo_one_n_minus_one(Config) when is_list(Config) ->
     Prop = proplists:get_value(tc_group_properties, Config),
     Version = proplists:get_value(name, Prop),
-    AllSuites = ssl_test_lib:available_suites(tls_record:protocol_version(Version)),
+    NVersion = ssl_test_lib:protocol_version(Config, tuple),
+    AllSuites = ssl_test_lib:available_suites(NVersion),
     Ciphers  = [X || X ={_,Y,_} <- AllSuites, Y  =/= rc4_128],
     run_send_recv_rizzo(Ciphers, Config, Version,
 			 {?MODULE, send_recv_result_active_rizzo, []}).
@@ -3836,7 +3780,8 @@ rizzo_zero_n() ->
 rizzo_zero_n(Config) when is_list(Config) ->
     Prop = proplists:get_value(tc_group_properties, Config),
     Version = proplists:get_value(name, Prop),
-    AllSuites = ssl_test_lib:available_suites(tls_record:protocol_version(Version)),
+    NVersion = ssl_test_lib:protocol_version(Config, tuple),
+    AllSuites = ssl_test_lib:available_suites(NVersion),
     Ciphers  = [X || X ={_,Y,_} <- AllSuites, Y  =/= rc4_128],
     run_send_recv_rizzo(Ciphers, Config, Version,
 			 {?MODULE, send_recv_result_active_no_rizzo, []}).
@@ -4638,7 +4583,10 @@ client_server_opts({KeyAlgo,_,_}, Config) when KeyAlgo == ecdh_rsa ->
     {ssl_test_lib:ssl_options(client_opts, Config),
      ssl_test_lib:ssl_options(server_ecdh_rsa_opts, Config)}.
 
-run_suites(Ciphers, Version, Config, Type) ->
+run_suites(Ciphers, Config, Type) ->
+    NVersion = ssl_test_lib:protocol_version(Config, tuple),
+    Version = ssl_test_lib:protocol_version(Config),
+    ct:log("Running cipher suites ~p~n", [Ciphers]),
     {ClientOpts, ServerOpts} =
 	case Type of
 	    rsa ->
@@ -4650,23 +4598,24 @@ run_suites(Ciphers, Version, Config, Type) ->
 	    anonymous ->
 		%% No certs in opts!
 		{ssl_test_lib:ssl_options(client_verification_opts, Config),
-		 [{reuseaddr, true}, {ciphers, ssl_test_lib:anonymous_suites(Version)}]};
+		 [{reuseaddr, true}, {ciphers, ssl_test_lib:anonymous_suites(NVersion)} |
+                  ssl_test_lib:ssl_options([], Config)]};
 	    psk ->
 		{ssl_test_lib:ssl_options(client_psk, Config),
-                 [{ciphers, ssl_test_lib:psk_suites(Version)} | 
+                 [{ciphers, ssl_test_lib:psk_suites(NVersion)} | 
                   ssl_test_lib:ssl_options(server_psk, Config)]};
 	    psk_with_hint ->
 		{ssl_test_lib:ssl_options(client_psk, Config),
-		 [{ciphers, ssl_test_lib:psk_suites(Version)} |
+		 [{ciphers, ssl_test_lib:psk_suites(NVersion)} |
                   ssl_test_lib:ssl_options(server_psk_hint, Config)
                  ]};
 	    psk_anon ->
 		{ssl_test_lib:ssl_options(client_psk, Config),
-                 [{ciphers, ssl_test_lib:psk_anon_suites(Version)} |
+                 [{ciphers, ssl_test_lib:psk_anon_suites(NVersion)} |
                   ssl_test_lib:ssl_options(server_psk_anon, Config)]};
 	    psk_anon_with_hint ->
 		{ssl_test_lib:ssl_options(client_psk, Config),
-                 [{ciphers, ssl_test_lib:psk_anon_suites(Version)} |
+                 [{ciphers, ssl_test_lib:psk_anon_suites(NVersion)} |
 		 ssl_test_lib:ssl_options(server_psk_anon_hint, Config)]};
 	    srp ->
 		{ssl_test_lib:ssl_options(client_srp, Config),
diff --git a/lib/ssl/test/ssl_sni_SUITE.erl b/lib/ssl/test/ssl_sni_SUITE.erl
index 4e916a7f03..4a8027edda 100644
--- a/lib/ssl/test/ssl_sni_SUITE.erl
+++ b/lib/ssl/test/ssl_sni_SUITE.erl
@@ -42,9 +42,18 @@ init_per_suite(Config0) ->
     try crypto:start() of
         ok ->
             ssl_test_lib:clean_start(),
-	    {ok, _} = make_certs:all(proplists:get_value(data_dir, Config0),
-				     proplists:get_value(priv_dir, Config0)),
-            ssl_test_lib:cert_options(Config0)
+            Config = ssl_test_lib:make_rsa_cert(Config0),
+            RsaOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+            [{sni_server_opts, [{sni_hosts, [
+                                              {"a.server", [
+                                                            {certfile, proplists:get_value(certfile, RsaOpts)},
+                                                            {keyfile,  proplists:get_value(keyfile, RsaOpts)}
+                                                           ]},
+                                              {"b.server", [
+                                                            {certfile, proplists:get_value(certfile, RsaOpts)},
+                                                            {keyfile, proplists:get_value(keyfile, RsaOpts)}
+                                                           ]}
+                                             ]}]} | Config] 
     catch _:_  ->
             {skip, "Crypto did not start"}
     end.
@@ -66,22 +75,22 @@ end_per_testcase(_TestCase, Config) ->
 %% Test Cases --------------------------------------------------------
 %%--------------------------------------------------------------------
 no_sni_header(Config) ->
-    run_handshake(Config, undefined, undefined, "server").
+    run_handshake(Config, undefined, undefined, "server Peer cert").
 
 no_sni_header_fun(Config) ->
-    run_sni_fun_handshake(Config, undefined, undefined, "server").
+    run_sni_fun_handshake(Config, undefined, undefined, "server Peer cert").
 
 sni_match(Config) ->
-    run_handshake(Config, "a.server", "a.server", "a.server").
+    run_handshake(Config, "a.server", "a.server",  "server Peer cert").
 
 sni_match_fun(Config) ->
-    run_sni_fun_handshake(Config, "a.server", "a.server", "a.server").
+    run_sni_fun_handshake(Config, "a.server", "a.server", "server Peer cert").
 
 sni_no_match(Config) ->
-    run_handshake(Config, "c.server", undefined, "server").
+    run_handshake(Config, "c.server", undefined, "server Peer cert").
 
 sni_no_match_fun(Config) ->
-    run_sni_fun_handshake(Config, "c.server", undefined, "server").
+    run_sni_fun_handshake(Config, "c.server", undefined, "server Peer cert").
 
 
 %%--------------------------------------------------------------------
@@ -141,13 +150,13 @@ run_sni_fun_handshake(Config, SNIHostname, ExpectedSNIHostname, ExpectedCN) ->
 	   [Config, SNIHostname, ExpectedSNIHostname, ExpectedCN]),
     [{sni_hosts, ServerSNIConf}] = proplists:get_value(sni_server_opts, Config),
     SNIFun = fun(Domain) -> proplists:get_value(Domain, ServerSNIConf, undefined) end,
-    ServerOptions = proplists:get_value(server_opts, Config) ++ [{sni_fun, SNIFun}],
+    ServerOptions =  ssl_test_lib:ssl_options(server_rsa_opts, Config) ++ [{sni_fun, SNIFun}],
     ClientOptions = 
     case SNIHostname of
         undefined ->
-            proplists:get_value(client_opts, Config);
+            proplists:get_value(client_rsa_opts, Config);
         _ ->
-            [{server_name_indication, SNIHostname}] ++ proplists:get_value(client_opts, Config)
+            [{server_name_indication, SNIHostname}] ++ proplists:get_value(client_rsa_opts, Config)
     end,
     ct:log("Options: ~p", [[ServerOptions, ClientOptions]]),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
@@ -167,14 +176,14 @@ run_handshake(Config, SNIHostname, ExpectedSNIHostname, ExpectedCN) ->
     ct:log("Start running handshake, Config: ~p, SNIHostname: ~p, "
 	   "ExpectedSNIHostname: ~p, ExpectedCN: ~p", 
 	   [Config, SNIHostname, ExpectedSNIHostname, ExpectedCN]),
-    ServerOptions = proplists:get_value(sni_server_opts, Config) ++ proplists:get_value(server_opts, Config),
+    ServerOptions = proplists:get_value(sni_server_opts, Config) ++  ssl_test_lib:ssl_options(server_rsa_opts, Config),
     ClientOptions = 
-    case SNIHostname of
-        undefined ->
-            proplists:get_value(client_opts, Config);
-        _ ->
-            [{server_name_indication, SNIHostname}] ++ proplists:get_value(client_opts, Config)
-    end,
+        case SNIHostname of
+            undefined ->
+                proplists:get_value(client_rsa_opts, Config);
+            _ ->
+                [{server_name_indication, SNIHostname}] ++ proplists:get_value(client_rsa_opts, Config)
+        end,
     ct:log("Options: ~p", [[ServerOptions, ClientOptions]]),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index e61993598e..452980b96d 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -384,10 +384,6 @@ cert_options(Config) ->
 			      "badkey.pem"]),
     PskSharedSecret = <<1,2,3,4,5,6,7,8,9,10,11,12,13,14,15>>,
 
-    SNIServerACertFile = filename:join([proplists:get_value(priv_dir, Config), "a.server", "cert.pem"]),
-    SNIServerAKeyFile = filename:join([proplists:get_value(priv_dir, Config), "a.server", "key.pem"]),
-    SNIServerBCertFile = filename:join([proplists:get_value(priv_dir, Config), "b.server", "cert.pem"]),
-    SNIServerBKeyFile = filename:join([proplists:get_value(priv_dir, Config), "b.server", "key.pem"]),
     [{client_opts, [{cacertfile, ClientCaCertFile}, 
 		    {certfile, ClientCertFile},  
 		    {keyfile, ClientKeyFile}]}, 
@@ -445,46 +441,34 @@ cert_options(Config) ->
      {server_bad_cert, [{ssl_imp, new},{cacertfile, ServerCaCertFile},
 			{certfile, BadCertFile}, {keyfile, ServerKeyFile}]},
      {server_bad_key, [{ssl_imp, new},{cacertfile, ServerCaCertFile},
-		       {certfile, ServerCertFile}, {keyfile, BadKeyFile}]},
-     {sni_server_opts, [{sni_hosts, [
-                                     {"a.server", [
-                                                   {certfile, SNIServerACertFile},
-                                                   {keyfile, SNIServerAKeyFile}
-                                                  ]},
-                                     {"b.server", [
-                                                   {certfile, SNIServerBCertFile},
-                                                   {keyfile, SNIServerBKeyFile}
-                                                  ]}
-                                    ]}]}
+		       {certfile, ServerCertFile}, {keyfile, BadKeyFile}]}
      | Config].
 
 
-make_dsa_cert(Config) ->
-    {ServerCaCertFile, ServerCertFile, ServerKeyFile} = 
-	make_cert_files("server", Config, dsa, dsa, "", []),
-    {ClientCaCertFile, ClientCertFile, ClientKeyFile} = 
-	make_cert_files("client", Config, dsa, dsa, "", []),
-    [{server_dsa_opts, [{ssl_imp, new},{reuseaddr, true}, 
-				 {cacertfile, ServerCaCertFile},
-				 {certfile, ServerCertFile}, {keyfile, ServerKeyFile}]},
-     {server_dsa_verify_opts, [{ssl_imp, new},{reuseaddr, true}, 
-			       {cacertfile, ClientCaCertFile},
-			       {certfile, ServerCertFile}, {keyfile, ServerKeyFile},
-			       {verify, verify_peer}]},
-     {client_dsa_opts, [{ssl_imp, new},
-			{cacertfile, ClientCaCertFile},
-			{certfile, ClientCertFile}, {keyfile, ClientKeyFile}]},
-     {server_srp_dsa, [{ssl_imp, new},{reuseaddr, true}, 
-		       {cacertfile, ServerCaCertFile},
-		       {certfile, ServerCertFile}, {keyfile, ServerKeyFile},
-		       {user_lookup_fun, {fun user_lookup/3, undefined}},
-		       {ciphers, srp_dss_suites()}]},
-     {client_srp_dsa, [{ssl_imp, new},
-		       {srp_identity, {"Test-User", "secret"}},
-		       {cacertfile, ClientCaCertFile},
-		       {certfile, ClientCertFile}, {keyfile, ClientKeyFile}]}
-     | Config].
-
+make_dsa_cert(Config) ->  
+    CryptoSupport = crypto:supports(),
+    case proplists:get_bool(dss, proplists:get_value(public_keys, CryptoSupport)) of
+        true ->
+            ClientFileBase = filename:join([proplists:get_value(priv_dir, Config), "dsa"]),
+            ServerFileBase = filename:join([proplists:get_value(priv_dir, Config), "dsa"]),
+            KeyGenSpec = key_gen_info(dsa, dsa),
+            
+            GenCertData = x509_test:gen_test_certs([{digest, sha} | KeyGenSpec]),
+            [{server_config, ServerConf}, 
+             {client_config, ClientConf}] = 
+                x509_test:gen_pem_config_files(GenCertData, ClientFileBase, ServerFileBase),
+            
+          [{server_dsa_opts, ServerConf},
+           {server_dsa_verify_opts, [{verify, verify_peer} | ServerConf]},
+           {client_dsa_opts, ClientConf},
+           {server_srp_dsa, [{user_lookup_fun, {fun user_lookup/3, undefined}},
+                             {ciphers, srp_dss_suites()} | ServerConf]},
+           {client_srp_dsa, [{srp_identity, {"Test-User", "secret"}}
+                             | ClientConf]}
+           | Config];
+      false ->
+          Config
+  end.
 make_rsa_cert_chains(ChainConf, Config, Suffix) ->
    CryptoSupport = crypto:supports(),
     KeyGenSpec = key_gen_info(rsa, rsa),
@@ -541,6 +525,11 @@ key_gen_spec(Role, rsa) ->
     [{list_to_atom(Role ++ "_key_gen"),  hardcode_rsa_key(1)},
      {list_to_atom(Role ++ "_key_gen_chain"),  [hardcode_rsa_key(2),
                                                 hardcode_rsa_key(3)]}
+    ];
+key_gen_spec(Role, dsa) ->
+    [{list_to_atom(Role ++ "_key_gen"),  hardcode_dsa_key(1)},
+     {list_to_atom(Role ++ "_key_gen_chain"),  [hardcode_dsa_key(2),
+                                                hardcode_dsa_key(3)]}
     ].
 make_ecdsa_cert(Config) ->
     CryptoSupport = crypto:supports(),
@@ -638,41 +627,6 @@ make_ecdh_rsa_cert(Config) ->
 	    Config
     end.
 
-make_mix_cert(Config) ->
-    {ServerCaCertFile, ServerCertFile, ServerKeyFile} = make_cert_files("server", Config, dsa,
-									rsa, "mix", []),
-    {ClientCaCertFile, ClientCertFile, ClientKeyFile} = make_cert_files("client", Config, dsa,
-									rsa, "mix", []),
-    [{server_mix_opts, [{ssl_imp, new},{reuseaddr, true},
-				 {cacertfile, ServerCaCertFile},
-				 {certfile, ServerCertFile}, {keyfile, ServerKeyFile}]},
-     {server_mix_verify_opts, [{ssl_imp, new},{reuseaddr, true},
-			       {cacertfile, ClientCaCertFile},
-			       {certfile, ServerCertFile}, {keyfile, ServerKeyFile},
-			       {verify, verify_peer}]},
-     {client_mix_opts, [{ssl_imp, new},
-			{cacertfile, ClientCaCertFile},
-			{certfile, ClientCertFile}, {keyfile, ClientKeyFile}]}
-     | Config].
-
-make_cert_files(RoleStr, Config, Alg1, Alg2, Prefix, Opts) ->
-    Alg1Str = atom_to_list(Alg1),
-    Alg2Str = atom_to_list(Alg2),
-    CaInfo = {CaCert, _} = erl_make_certs:make_cert([{key, Alg1}| Opts]),
-    {Cert, CertKey} = erl_make_certs:make_cert([{key, Alg2}, {issuer, CaInfo} | Opts]),
-    CaCertFile = filename:join([proplists:get_value(priv_dir, Config), 
-				RoleStr, Prefix ++ Alg1Str ++ "_cacerts.pem"]),
-    CertFile = filename:join([proplists:get_value(priv_dir, Config), 
-			      RoleStr, Prefix ++ Alg2Str ++ "_cert.pem"]),
-    KeyFile = filename:join([proplists:get_value(priv_dir, Config), 
-				   RoleStr, Prefix ++ Alg2Str ++ "_key.pem"]),
-    
-    der_to_pem(CaCertFile, [{'Certificate', CaCert, not_encrypted}]),
-    der_to_pem(CertFile, [{'Certificate', Cert, not_encrypted}]),
-    der_to_pem(KeyFile, [CertKey]),
-    {CaCertFile, CertFile, KeyFile}.
-
-
 start_upgrade_server(Args) ->
     Result = spawn_link(?MODULE, run_upgrade_server, [Args]),
     receive
@@ -983,16 +937,10 @@ ecdh_rsa_suites(Version) ->
 		 end,
 		 available_suites(Version)).
 
-openssl_rsa_suites(CounterPart) ->
+openssl_rsa_suites() ->
     Ciphers = ssl:cipher_suites(openssl),
-    Names = case is_sane_ecc(CounterPart) of
-		true ->
-		    "DSS | ECDSA";
-		false ->
-		    "DSS | ECDHE | ECDH"
-		end,
-    lists:filter(fun(Str) -> string_regex_filter(Str, Names)
-		 end, Ciphers).
+    lists:filter(fun(Str) -> string_regex_filter(Str, "RSA")
+		 end, Ciphers) -- openssl_ecdh_rsa_suites().
 
 openssl_dsa_suites() ->
     Ciphers = ssl:cipher_suites(openssl),
@@ -1026,11 +974,11 @@ string_regex_filter(_Str, _Search) ->
     false.
 
 anonymous_suites(Version) ->
-    Suites = ssl_cipher:anonymous_suites(Version),
+    Suites = [ssl_cipher:erl_suite_definition(S) || S <- ssl_cipher:anonymous_suites(Version)],
     ssl_cipher:filter_suites(Suites).
 
 psk_suites(Version) ->
-    Suites = ssl_cipher:psk_suites(Version),
+    Suites = [ssl_cipher:erl_suite_definition(S) || S <- ssl_cipher:psk_suites(Version)],
     ssl_cipher:filter_suites(Suites).
 
 psk_anon_suites(Version) ->
@@ -1062,7 +1010,7 @@ srp_dss_suites() ->
     ssl_cipher:filter_suites(Suites).
 
 rc4_suites(Version) ->
-    Suites = ssl_cipher:rc4_suites(Version),
+    Suites = [ssl_cipher:erl_suite_definition(S) || S <- ssl_cipher:rc4_suites(Version)],
     ssl_cipher:filter_suites(Suites).
 
 des_suites(Version) ->
@@ -1367,6 +1315,12 @@ version_flag('dtlsv1.2') ->
 version_flag('dtlsv1') ->
     "-dtls1".
 
+filter_suites([Cipher | _] = Ciphers, AtomVersion) when is_list(Cipher)->
+    filter_suites([ssl_cipher:openssl_suite(S) || S <- Ciphers], 
+                  AtomVersion);
+filter_suites([Cipher | _] = Ciphers, AtomVersion) when is_binary(Cipher)->
+    filter_suites([ssl_cipher:erl_suite_definition(S) || S <- Ciphers], 
+                  AtomVersion);
 filter_suites(Ciphers0, AtomVersion) ->
     Version = tls_version(AtomVersion),
     Supported0 = ssl_cipher:suites(Version)
@@ -1611,6 +1565,27 @@ hardcode_rsa_key(6) ->
                  81173034184183681160439870161505779100040258708276674532866007896310418779840630960490793104541748007902477778658270784073595697910785917474138815202903114440800310078464142273778315781957021015333260021813037604142367434117205299831740956310682461174553260184078272196958146289378701001596552915990080834227,
                  asn1_NOVALUE}.
 
+hardcode_dsa_key(1) -> 
+    {'DSAPrivateKey',0,
+     99438313664986922963487511141216248076486724382260996073922424025828494981416579966171753999204426907349400798052572573634137057487829150578821328280864500098312146772602202702021153757550650696224643730869835650674962433068943942837519621267815961566259265204876799778977478160416743037274938277357237615491,
+     1454908511695148818053325447108751926908854531909,
+     20302424198893709525243209250470907105157816851043773596964076323184805650258390738340248469444700378962907756890306095615785481696522324901068493502141775433048117442554163252381401915027666416630898618301033737438756165023568220631119672502120011809327566543827706483229480417066316015458225612363927682579,
+     48598545580251057979126570873881530215432219542526130654707948736559463436274835406081281466091739849794036308281564299754438126857606949027748889019480936572605967021944405048011118039171039273602705998112739400664375208228641666852589396502386172780433510070337359132965412405544709871654840859752776060358,
+     1457508827177594730669011716588605181448418352823};
+hardcode_dsa_key(2) -> 
+    {'DSAPrivateKey',0,
+     145447354557382582722944332987784622105075065624518040072393858097520305927329240484963764783346271194321683798321743658303478090647837211867389721684646254999291098347011037298359107547264573476540026676832159205689428125157386525591130716464335426605521884822982379206842523670736739023467072341958074788151,
+     742801637799670234315651916144768554943688916729,
+     79727684678125120155622004643594683941478642656111969487719464672433839064387954070113655822700268007902716505761008423792735229036965034283173483862273639257533568978482104785033927768441235063983341565088899599358397638308472931049309161811156189887217888328371767967629005149630676763492409067382020352505,
+     35853727034965131665219275925554159789667905059030049940938124723126925435403746979702929280654735557166864135215989313820464108440192507913554896358611966877432546584986661291483639036057475682547385322659469460385785257933737832719745145778223672383438466035853830832837226950912832515496378486927322864228,
+     801315110178350279541885862867982846569980443911};
+hardcode_dsa_key(3) -> 
+    {'DSAPrivateKey',0,
+     99438313664986922963487511141216248076486724382260996073922424025828494981416579966171753999204426907349400798052572573634137057487829150578821328280864500098312146772602202702021153757550650696224643730869835650674962433068943942837519621267815961566259265204876799778977478160416743037274938277357237615491,
+     1454908511695148818053325447108751926908854531909,
+     20302424198893709525243209250470907105157816851043773596964076323184805650258390738340248469444700378962907756890306095615785481696522324901068493502141775433048117442554163252381401915027666416630898618301033737438756165023568220631119672502120011809327566543827706483229480417066316015458225612363927682579,
+     48598545580251057979126570873881530215432219542526130654707948736559463436274835406081281466091739849794036308281564299754438126857606949027748889019480936572605967021944405048011118039171039273602705998112739400664375208228641666852589396502386172780433510070337359132965412405544709871654840859752776060358,
+     1457508827177594730669011716588605181448418352823}.
 
 dtls_hello() ->
     [1,
diff --git a/lib/ssl/test/ssl_to_openssl_SUITE.erl b/lib/ssl/test/ssl_to_openssl_SUITE.erl
index 04c86ccbb6..a14007640a 100644
--- a/lib/ssl/test/ssl_to_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_to_openssl_SUITE.erl
@@ -142,12 +142,11 @@ init_per_suite(Config0) ->
 	    catch crypto:stop(),
 	    try crypto:start() of
 		ok ->
-		    ssl_test_lib:clean_start(),
-		    {ok,  _} = make_certs:all(proplists:get_value(data_dir, Config0),
-					      proplists:get_value(priv_dir, Config0)),
-		    Config1 = ssl_test_lib:make_dsa_cert(Config0),
-		    Config = ssl_test_lib:cert_options(Config1),
-		    ssl_test_lib:cipher_restriction(Config)
+                    ssl_test_lib:clean_start(),
+                  
+                    Config1 = ssl_test_lib:make_rsa_cert(Config0),
+                    Config2 = ssl_test_lib:make_dsa_cert(Config1),
+                    ssl_test_lib:cipher_restriction(Config2)
 		catch _:_  ->
 		    {skip, "Crypto did not start"}
 	    end
@@ -270,13 +269,24 @@ special_init(TestCase, Config)
 	    check_openssl_npn_support(Config)
     end;
 
-special_init(TestCase, Config)
+special_init(TestCase, Config0)
   when TestCase == erlang_server_openssl_client_sni_match;
        TestCase == erlang_server_openssl_client_sni_no_match;
        TestCase == erlang_server_openssl_client_sni_no_header;
        TestCase == erlang_server_openssl_client_sni_match_fun;
        TestCase == erlang_server_openssl_client_sni_no_match_fun;
        TestCase == erlang_server_openssl_client_sni_no_header_fun ->
+    RsaOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config0),
+    Config = [{sni_server_opts, [{sni_hosts,
+                                  [{"a.server", [
+                                                 {certfile, proplists:get_value(certfile, RsaOpts)},
+                                                 {keyfile,  proplists:get_value(keyfile, RsaOpts)}
+                                                ]},
+                                   {"b.server", [
+                                                 {certfile, proplists:get_value(certfile, RsaOpts)},
+                                                 {keyfile, proplists:get_value(keyfile, RsaOpts)}
+                                                ]}
+                                  ]}]} | Config0], 
     check_openssl_sni_support(Config);
 
 special_init(_, Config) ->
@@ -295,8 +305,8 @@ basic_erlang_client_openssl_server() ->
     [{doc,"Test erlang client with openssl server"}].
 basic_erlang_client_openssl_server(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
     
@@ -335,7 +345,7 @@ basic_erlang_server_openssl_client() ->
     [{doc,"Test erlang server with openssl client"}].
 basic_erlang_server_openssl_client(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
     V2Compat = proplists:get_value(v2_hello_compatible, Config), 
 
     {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
@@ -369,8 +379,8 @@ erlang_client_openssl_server() ->
     [{doc,"Test erlang client with openssl server"}].
 erlang_client_openssl_server(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
 
@@ -409,7 +419,7 @@ erlang_server_openssl_client() ->
     [{doc,"Test erlang server with openssl client"}].
 erlang_server_openssl_client(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
 
     {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     
@@ -442,7 +452,7 @@ erlang_client_openssl_server_dsa_cert() ->
 erlang_client_openssl_server_dsa_cert(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ClientOpts = ssl_test_lib:ssl_options(client_dsa_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_dsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_dsa_verify_opts, Config),
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
   
@@ -524,7 +534,7 @@ erlang_server_openssl_client_reuse_session() ->
      "same session id, to test reusing of sessions."}].
 erlang_server_openssl_client_reuse_session(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
 
     {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     
@@ -562,8 +572,8 @@ erlang_client_openssl_server_renegotiate() ->
     [{doc,"Test erlang client when openssl server issuses a renegotiate"}].
 erlang_client_openssl_server_renegotiate(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
     
@@ -612,8 +622,8 @@ erlang_client_openssl_server_nowrap_seqnum() ->
      " to lower treashold substantially."}].
 erlang_client_openssl_server_nowrap_seqnum(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
     
@@ -655,7 +665,7 @@ erlang_server_openssl_client_nowrap_seqnum() ->
      " to lower treashold substantially."}].
 erlang_server_openssl_client_nowrap_seqnum(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
 
     {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     
@@ -694,8 +704,8 @@ erlang_client_openssl_server_no_server_ca_cert() ->
      "implicitly tested eleswhere."}].
 erlang_client_openssl_server_no_server_ca_cert(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
     
@@ -735,8 +745,8 @@ erlang_client_openssl_server_client_cert() ->
     [{doc,"Test erlang client with openssl server when client sends cert"}].
 erlang_client_openssl_server_client_cert(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_verification_opts, Config),
-    ClientOpts = ssl_test_lib:ssl_options(client_verification_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_verify_opts, Config),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_verify_opts, Config),
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
     
@@ -778,8 +788,8 @@ erlang_server_openssl_client_client_cert() ->
     [{doc,"Test erlang server with openssl client when client sends cert"}].
 erlang_server_openssl_client_client_cert(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_verification_opts, Config),
-    ClientOpts = ssl_test_lib:ssl_options(client_verification_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_verify_opts, Config),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_verify_opts, Config),
 
     {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     
@@ -819,8 +829,8 @@ erlang_server_erlang_client_client_cert() ->
     [{doc,"Test erlang server with erlang client when client sends cert"}].
 erlang_server_erlang_client_client_cert(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ServerOpts = proplists:get_value(server_verification_opts, Config),  
-    ClientOpts = proplists:get_value(client_verification_opts, Config),  
+    ServerOpts = proplists:get_value(server_rsa_verify_opts, Config),  
+    ClientOpts = proplists:get_value(client_rsa_verify_opts, Config),  
     Version = ssl_test_lib:protocol_version(Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     
@@ -873,8 +883,8 @@ erlang_client_bad_openssl_server() ->
     [{doc,"Test what happens if openssl server sends garbage to erlang ssl client"}].
 erlang_client_bad_openssl_server(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_verification_opts, Config),
-    ClientOpts = ssl_test_lib:ssl_options(client_verification_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
     
@@ -928,8 +938,8 @@ expired_session() ->
       "better code coverage of the ssl_manager module"}].
 expired_session(Config) when is_list(Config) -> 
     process_flag(trap_exit, true),
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
 
     Port = ssl_test_lib:inet_port(node()),
@@ -982,7 +992,7 @@ ssl2_erlang_server_openssl_client() ->
 
 ssl2_erlang_server_openssl_client(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
 
     {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     
@@ -1007,10 +1017,10 @@ ssl2_erlang_server_openssl_client_comp() ->
 
 ssl2_erlang_server_openssl_client_comp(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
     V2Compat = proplists:get_value(v2_hello_compatible, Config), 
 
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
 
     {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     
@@ -1250,22 +1260,22 @@ erlang_server_openssl_client_npn_only_client(Config) when is_list(Config) ->
     ok.
 %--------------------------------------------------------------------------
 erlang_server_openssl_client_sni_no_header(Config) when is_list(Config) ->
-    erlang_server_openssl_client_sni_test(Config, undefined, undefined, "server").
+    erlang_server_openssl_client_sni_test(Config, undefined, undefined, "server Peer cert").
 
 erlang_server_openssl_client_sni_no_header_fun(Config) when is_list(Config) ->
-    erlang_server_openssl_client_sni_test_sni_fun(Config, undefined, undefined, "server").
+    erlang_server_openssl_client_sni_test_sni_fun(Config, undefined, undefined, "server Peer cert").
 
-erlang_server_openssl_client_sni_match(Config) when is_list(Config) ->
-    erlang_server_openssl_client_sni_test(Config, "a.server", "a.server", "a.server").
+erlang_server_openssl_client_sni_match(Config) when is_list(Config) ->  
+    erlang_server_openssl_client_sni_test(Config, "a.server", "a.server", "server Peer cert").
 
 erlang_server_openssl_client_sni_match_fun(Config) when is_list(Config) ->
-    erlang_server_openssl_client_sni_test_sni_fun(Config, "a.server", "a.server", "a.server").
+    erlang_server_openssl_client_sni_test_sni_fun(Config, "a.server", "a.server", "server Peer cert").
 
 erlang_server_openssl_client_sni_no_match(Config) when is_list(Config) ->
-    erlang_server_openssl_client_sni_test(Config, "c.server", undefined, "server").
+    erlang_server_openssl_client_sni_test(Config, "c.server", undefined, "server Peer cert").
 
 erlang_server_openssl_client_sni_no_match_fun(Config) when is_list(Config) ->
-    erlang_server_openssl_client_sni_test_sni_fun(Config, "c.server", undefined, "server").
+    erlang_server_openssl_client_sni_test_sni_fun(Config, "c.server", undefined, "server Peer cert").
 
 
 %%--------------------------------------------------------------------
@@ -1275,11 +1285,11 @@ run_suites(Ciphers, Version, Config, Type) ->
     {ClientOpts, ServerOpts} =
 	case Type of
 	    rsa ->
-		{ssl_test_lib:ssl_options(client_opts, Config),
-		 ssl_test_lib:ssl_options(server_opts, Config)};
+		{ssl_test_lib:ssl_options(client_rsa_opts, Config),
+		 ssl_test_lib:ssl_options(server_rsa_opts, Config)};
 	    dsa ->
-		{ssl_test_lib:ssl_options(client_opts, Config),
-		 ssl_test_lib:ssl_options(server_dsa_opts, Config)}
+		{ssl_test_lib:ssl_options(client_dsa_opts, Config),
+		 ssl_test_lib:ssl_options(server_dsa_verify_opts, Config)}
 	end,
 
     Result =  lists:map(fun(Cipher) ->
@@ -1332,7 +1342,7 @@ send_and_hostname(SSLSocket) ->
 
 erlang_server_openssl_client_sni_test(Config, SNIHostname, ExpectedSNIHostname, ExpectedCN) ->
     ct:log("Start running handshake, Config: ~p, SNIHostname: ~p, ExpectedSNIHostname: ~p, ExpectedCN: ~p", [Config, SNIHostname, ExpectedSNIHostname, ExpectedCN]),
-    ServerOptions = proplists:get_value(sni_server_opts, Config) ++ proplists:get_value(server_opts, Config),
+    ServerOptions = proplists:get_value(sni_server_opts, Config) ++ proplists:get_value(server_rsa_opts, Config),
     {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
                                         {from, self()}, {mfa, {?MODULE, send_and_hostname, []}},
@@ -1346,11 +1356,7 @@ erlang_server_openssl_client_sni_test(Config, SNIHostname, ExpectedSNIHostname,
 			 openssl_client_args(ssl_test_lib:supports_ssl_tls_version(sslv2), Hostname, Port, SNIHostname)
 		 end,       
     ClientPort = ssl_test_lib:portable_open_port(Exe, ClientArgs),  
-    
-    %% Client check needs to be done befor server check,
-    %% or server check might consume client messages
-    ExpectedClientOutput = ["OK", "/CN=" ++ ExpectedCN ++ "/"],
-    client_check_result(ClientPort, ExpectedClientOutput),
+  
     ssl_test_lib:check_result(Server, ExpectedSNIHostname),
     ssl_test_lib:close_port(ClientPort),
     ssl_test_lib:close(Server),
@@ -1361,7 +1367,7 @@ erlang_server_openssl_client_sni_test_sni_fun(Config, SNIHostname, ExpectedSNIHo
     ct:log("Start running handshake for sni_fun, Config: ~p, SNIHostname: ~p, ExpectedSNIHostname: ~p, ExpectedCN: ~p", [Config, SNIHostname, ExpectedSNIHostname, ExpectedCN]),
     [{sni_hosts, ServerSNIConf}] = proplists:get_value(sni_server_opts, Config),
     SNIFun = fun(Domain) -> proplists:get_value(Domain, ServerSNIConf, undefined) end,
-    ServerOptions = proplists:get_value(server_opts, Config) ++ [{sni_fun, SNIFun}],
+    ServerOptions = proplists:get_value(server_rsa_opts, Config) ++ [{sni_fun, SNIFun}],
     {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
                                         {from, self()}, {mfa, {?MODULE, send_and_hostname, []}},
@@ -1377,10 +1383,6 @@ erlang_server_openssl_client_sni_test_sni_fun(Config, SNIHostname, ExpectedSNIHo
 
     ClientPort = ssl_test_lib:portable_open_port(Exe, ClientArgs), 
     
-    %% Client check needs to be done befor server check,
-    %% or server check might consume client messages
-    ExpectedClientOutput = ["OK", "/CN=" ++ ExpectedCN ++ "/"],
-    client_check_result(ClientPort, ExpectedClientOutput),
     ssl_test_lib:check_result(Server, ExpectedSNIHostname),
     ssl_test_lib:close_port(ClientPort),
     ssl_test_lib:close(Server).
@@ -1444,8 +1446,8 @@ cipher(CipherSuite, Version, Config, ClientOpts, ServerOpts) ->
 
 start_erlang_client_and_openssl_server_with_opts(Config, ErlangClientOpts, OpensslServerOpts, Data, Callback) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    ClientOpts0 = ssl_test_lib:ssl_options(client_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    ClientOpts0 = ssl_test_lib:ssl_options(client_rsa_opts, Config),
     ClientOpts = ErlangClientOpts ++ ClientOpts0,
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
@@ -1490,8 +1492,8 @@ start_erlang_client_and_openssl_server_with_opts(Config, ErlangClientOpts, Opens
 
 start_erlang_client_and_openssl_server_for_alpn_negotiation(Config, Data, Callback) ->
     process_flag(trap_exit, true),
-    ServerOpts = proplists:get_value(server_opts, Config),
-    ClientOpts0 = proplists:get_value(client_opts, Config),
+    ServerOpts = proplists:get_value(server_rsa_opts, Config),
+    ClientOpts0 = proplists:get_value(client_rsa_opts, Config),
     ClientOpts = [{alpn_advertised_protocols, [<<"spdy/2">>]} | ClientOpts0],
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
@@ -1526,7 +1528,7 @@ start_erlang_client_and_openssl_server_for_alpn_negotiation(Config, Data, Callba
 
 start_erlang_server_and_openssl_client_for_alpn_negotiation(Config, Data, Callback) ->
     process_flag(trap_exit, true),
-    ServerOpts0 = proplists:get_value(server_opts, Config),
+    ServerOpts0 = proplists:get_value(server_rsa_opts, Config),
     ServerOpts = [{alpn_preferred_protocols, [<<"spdy/2">>]} | ServerOpts0],
 
     {_, ServerNode, _} = ssl_test_lib:run_where(Config),
@@ -1555,8 +1557,8 @@ start_erlang_server_and_openssl_client_for_alpn_negotiation(Config, Data, Callba
 
 start_erlang_client_and_openssl_server_for_alpn_npn_negotiation(Config, Data, Callback) ->
     process_flag(trap_exit, true),
-    ServerOpts = proplists:get_value(server_opts, Config),
-    ClientOpts0 = proplists:get_value(client_opts, Config),
+    ServerOpts = proplists:get_value(server_rsa_opts, Config),
+    ClientOpts0 = proplists:get_value(client_rsa_opts, Config),
     ClientOpts = [{alpn_advertised_protocols, [<<"spdy/2">>]},
         {client_preferred_next_protocols, {client, [<<"spdy/3">>, <<"http/1.1">>]}} | ClientOpts0],
 
@@ -1595,7 +1597,7 @@ start_erlang_client_and_openssl_server_for_alpn_npn_negotiation(Config, Data, Ca
 
 start_erlang_server_and_openssl_client_for_alpn_npn_negotiation(Config, Data, Callback) ->
     process_flag(trap_exit, true),
-    ServerOpts0 = proplists:get_value(server_opts, Config),
+    ServerOpts0 = proplists:get_value(server_rsa_opts, Config),
     ServerOpts = [{alpn_preferred_protocols, [<<"spdy/2">>]},
         {next_protocols_advertised, [<<"spdy/3">>, <<"http/1.1">>]} | ServerOpts0],
 
@@ -1622,8 +1624,8 @@ start_erlang_server_and_openssl_client_for_alpn_npn_negotiation(Config, Data, Ca
 
 start_erlang_client_and_openssl_server_for_npn_negotiation(Config, Data, Callback) ->
     process_flag(trap_exit, true),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    ClientOpts0 = ssl_test_lib:ssl_options(client_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    ClientOpts0 = ssl_test_lib:ssl_options(client_rsa_opts, Config),
     ClientOpts = [{client_preferred_next_protocols, {client, [<<"spdy/2">>], <<"http/1.1">>}} | ClientOpts0],
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
@@ -1660,7 +1662,7 @@ start_erlang_client_and_openssl_server_for_npn_negotiation(Config, Data, Callbac
 
 start_erlang_server_and_openssl_client_for_npn_negotiation(Config, Data, Callback) ->
     process_flag(trap_exit, true),
-    ServerOpts0 = ssl_test_lib:ssl_options(server_opts, Config),
+    ServerOpts0 = ssl_test_lib:ssl_options(server_rsa_opts, Config),
     ServerOpts = [{next_protocols_advertised, [<<"spdy/2">>]}, ServerOpts0],
 
     {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
@@ -1690,7 +1692,7 @@ start_erlang_server_and_openssl_client_for_npn_negotiation(Config, Data, Callbac
 
 start_erlang_server_and_openssl_client_with_opts(Config, ErlangServerOpts, OpenSSLClientOpts, Data, Callback) ->
     process_flag(trap_exit, true),
-    ServerOpts0 = ssl_test_lib:ssl_options(server_opts, Config),
+    ServerOpts0 = ssl_test_lib:ssl_options(server_rsa_opts, Config),
     ServerOpts = ErlangServerOpts ++  ServerOpts0,
 
     {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),