Merge branch 'ingela/ssl/do-not-hardcode-cipher-suites'

* ingela/ssl/do-not-hardcode-cipher-suites:
  ssl: Fix ECDSA key decode clause
  ssl: Avoid hardcoding of cipher suites and fix ECDH suite handling
  ssl: Run all test case combinations
  ssl: Update tests to reflect sslv3 is not supported by default

8 files changed, 456 insertions, 259 deletions

diff --git a/lib/ssl/src/ssl_cipher.erl b/lib/ssl/src/ssl_cipher.erl
index 28b26fd358..0956d3501d 100644
--- a/lib/ssl/src/ssl_cipher.erl
+++ b/lib/ssl/src/ssl_cipher.erl
@@ -37,10 +37,10 @@
 	 erl_suite_definition/1,
 	 cipher_init/3, decipher/6, cipher/5, decipher_aead/6, cipher_aead/6,
 	 suite/1, suites/1, all_suites/1,  crypto_support_filters/0,
-	 ec_keyed_suites/0, chacha_suites/1, anonymous_suites/1, psk_suites/1, psk_suites_anon/1, 
+	 chacha_suites/1, anonymous_suites/1, psk_suites/1, psk_suites_anon/1, 
          srp_suites/0, srp_suites_anon/0,
 	 rc4_suites/1, des_suites/1, rsa_suites/1, openssl_suite/1, openssl_suite_name/1, 
-         filter/2, filter_suites/1, filter_suites/2,
+         filter/3, filter_suites/1, filter_suites/2,
 	 hash_algorithm/1, sign_algorithm/1, is_acceptable_hash/2, is_fallback/1,
 	 random_bytes/1, calc_mac_hash/4,
          is_stream_ciphersuite/1]).
@@ -2212,39 +2212,25 @@ openssl_suite_name(Cipher) ->
     suite_definition(Cipher).
 
 %%--------------------------------------------------------------------
--spec filter(undefined | binary(), [cipher_suite()]) -> [cipher_suite()].
+-spec filter(undefined | binary(), [cipher_suite()], ssl_record:ssl_version()) -> [cipher_suite()].
 %%
 %% Description: Select the cipher suites that can be used together with the 
 %% supplied certificate. (Server side functionality)  
 %%-------------------------------------------------------------------
-filter(undefined, Ciphers) -> 
+filter(undefined, Ciphers, _) -> 
     Ciphers;
-filter(DerCert, Ciphers) ->
+filter(DerCert, Ciphers0, Version) ->
     OtpCert = public_key:pkix_decode_cert(DerCert, otp),
     SigAlg = OtpCert#'OTPCertificate'.signatureAlgorithm,
     PubKeyInfo = OtpCert#'OTPCertificate'.tbsCertificate#'OTPTBSCertificate'.subjectPublicKeyInfo,
     PubKeyAlg = PubKeyInfo#'OTPSubjectPublicKeyInfo'.algorithm,
 
-    Ciphers1 =
-	case ssl_certificate:public_key_type(PubKeyAlg#'PublicKeyAlgorithm'.algorithm) of
-	    rsa ->
-		filter_keyuse(OtpCert, ((Ciphers -- dsa_signed_suites()) -- ec_keyed_suites()) -- ecdh_suites(),
-			      rsa_suites(), dhe_rsa_suites() ++ ecdhe_rsa_suites());
-	    dsa ->
-		(Ciphers -- rsa_keyed_suites()) -- ec_keyed_suites();
-	    ec ->
-		filter_keyuse(OtpCert, (Ciphers -- rsa_keyed_suites()) -- dsa_signed_suites(),
-			      [], ecdhe_ecdsa_suites())
-	end,
-
-    case public_key:pkix_sign_types(SigAlg#'SignatureAlgorithm'.algorithm) of
-	{_, rsa} ->
-	    Ciphers1 -- ecdsa_signed_suites();
-	{_, dsa} ->
-	    Ciphers1;
-	{_, ecdsa} ->
-	    Ciphers1 -- rsa_signed_suites()
-    end.
+    Ciphers = filter_suites_pubkey(
+                ssl_certificate:public_key_type(PubKeyAlg#'PublicKeyAlgorithm'.algorithm),
+                Ciphers0, Version, OtpCert),
+    {_, Sign} = public_key:pkix_sign_types(SigAlg#'SignatureAlgorithm'.algorithm),
+    filter_suites_signature(Sign, Ciphers, Version).
+ 
 %%--------------------------------------------------------------------
 -spec filter_suites([erl_cipher_suite()] | [cipher_suite()], map()) ->
                            [erl_cipher_suite()] |  [cipher_suite()].
@@ -2676,141 +2662,184 @@ next_iv(Bin, IV) ->
     <<_:FirstPart/binary, NextIV:IVSz/binary>> = Bin,
     NextIV.
 
-rsa_signed_suites() ->
-    dhe_rsa_suites() ++ rsa_suites() ++
-	psk_rsa_suites() ++ srp_rsa_suites() ++
-	ecdh_rsa_suites() ++ ecdhe_rsa_suites().
-
-rsa_keyed_suites() ->
-    dhe_rsa_suites() ++ rsa_suites() ++
-	psk_rsa_suites() ++ srp_rsa_suites() ++
-	ecdhe_rsa_suites().
-
-dhe_rsa_suites() ->
-    [?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
-     ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
-     ?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
-     ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
-     ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
-     ?TLS_DHE_RSA_WITH_DES_CBC_SHA,
-     ?TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
-     ?TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
-     ?TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
-    ].
-
-psk_rsa_suites() ->
-    [?TLS_RSA_PSK_WITH_AES_256_GCM_SHA384,
-     ?TLS_RSA_PSK_WITH_AES_128_GCM_SHA256,
-     ?TLS_RSA_PSK_WITH_AES_256_CBC_SHA384,
-     ?TLS_RSA_PSK_WITH_AES_128_CBC_SHA256,
-     ?TLS_RSA_PSK_WITH_AES_256_CBC_SHA,
-     ?TLS_RSA_PSK_WITH_AES_128_CBC_SHA,
-     ?TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA,
-     ?TLS_RSA_PSK_WITH_RC4_128_SHA].
 
-srp_rsa_suites() ->
-    [?TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
-     ?TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
-     ?TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA].
-
-rsa_suites() ->
-    [?TLS_RSA_WITH_AES_256_CBC_SHA256,
-     ?TLS_RSA_WITH_AES_256_CBC_SHA,
-     ?TLS_RSA_WITH_3DES_EDE_CBC_SHA,
-     ?TLS_RSA_WITH_AES_128_CBC_SHA256,
-     ?TLS_RSA_WITH_AES_128_CBC_SHA,
-     ?TLS_RSA_WITH_RC4_128_SHA,
-     ?TLS_RSA_WITH_RC4_128_MD5,
-     ?TLS_RSA_WITH_DES_CBC_SHA,
-     ?TLS_RSA_WITH_AES_128_GCM_SHA256,
-     ?TLS_RSA_WITH_AES_256_GCM_SHA384].
-
-ecdh_rsa_suites() ->
-    [?TLS_ECDH_RSA_WITH_NULL_SHA,
-     ?TLS_ECDH_RSA_WITH_RC4_128_SHA,
-     ?TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,
-     ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
-     ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
-     ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,
-     ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,
-     ?TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,
-     ?TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384].
-
-ecdhe_rsa_suites() ->
-    [?TLS_ECDHE_RSA_WITH_NULL_SHA,
-     ?TLS_ECDHE_RSA_WITH_RC4_128_SHA,
-     ?TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
-     ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-     ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-     ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
-     ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
-     ?TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-     ?TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-     ?TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256].
-
-dsa_signed_suites() ->
-    dhe_dss_suites() ++ srp_dss_suites().
-
-dhe_dss_suites()  ->
-    [?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,
-     ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
-     ?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
-     ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
-     ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
-     ?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
-     ?TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,
-     ?TLS_DHE_DSS_WITH_AES_256_GCM_SHA384].
-
-srp_dss_suites() ->
-    [?TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
-     ?TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
-     ?TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA].
-
-ec_keyed_suites() ->
-    ecdh_ecdsa_suites() ++ ecdhe_ecdsa_suites()
-	++ ecdh_rsa_suites().
+filter_suites_pubkey(rsa, CiphersSuites0, Version, OtpCert) ->
+    KeyUses = key_uses(OtpCert),
+    CiphersSuites = filter_keyuse_suites(keyEncipherment, KeyUses,
+                                         (CiphersSuites0 -- ec_keyed_suites(CiphersSuites0)) 
+                                         -- dss_keyed_suites(CiphersSuites0),
+                                         rsa_suites_encipher(CiphersSuites0)),
+    filter_keyuse_suites(digitalSignature, KeyUses, CiphersSuites,
+                         rsa_signed_suites(CiphersSuites, Version));
+filter_suites_pubkey(dsa, Ciphers, _, _OtpCert) ->  
+    (Ciphers -- rsa_keyed_suites(Ciphers)) -- ec_keyed_suites(Ciphers);
+filter_suites_pubkey(ec, Ciphers, _, OtpCert) ->
+    Uses = key_uses(OtpCert),  
+    filter_keyuse_suites(digitalSignature, Uses,
+                         (Ciphers -- rsa_keyed_suites(Ciphers)) -- dss_keyed_suites(Ciphers),
+                         ecdsa_sign_suites(Ciphers)).
+
+filter_suites_signature(rsa, Ciphers, Version) ->
+    Ciphers -- ecdsa_signed_suites(Ciphers, Version) -- dsa_signed_suites(Ciphers, Version);
+filter_suites_signature(dsa, Ciphers, Version) ->
+    Ciphers -- ecdsa_signed_suites(Ciphers, Version) -- rsa_signed_suites(Ciphers, Version);
+filter_suites_signature(ecdsa, Ciphers, Version) ->
+    Ciphers -- rsa_signed_suites(Ciphers, Version) -- dsa_signed_suites(Ciphers, Version).
+
+
+%% From RFC 5246 - Section  7.4.2.  Server Certificate
+%% If the client provided a "signature_algorithms" extension, then all
+%% certificates provided by the server MUST be signed by a
+%% hash/signature algorithm pair that appears in that extension.  Note
+%% that this implies that a certificate containing a key for one
+%% signature algorithm MAY be signed using a different signature
+%% algorithm (for instance, an RSA key signed with a DSA key).  This is
+%% a departure from TLS 1.1, which required that the algorithms be the
+%% same. 
+%% Note that this also implies that the DH_DSS, DH_RSA,
+%% ECDH_ECDSA, and ECDH_RSA key exchange algorithms do not restrict the
+%% algorithm used to sign the certificate.  Fixed DH certificates MAY be
+%% signed with any hash/signature algorithm pair appearing in the
+%% extension.  The names DH_DSS, DH_RSA, ECDH_ECDSA, and ECDH_RSA are
+%% historical.
+%% Note: DH_DSS and DH_RSA is not supported
+rsa_signed({3,N}) when N >= 3 ->
+    fun(rsa) -> true;
+       (dhe_rsa) -> true;
+       (ecdhe_rsa) -> true;
+       (rsa_psk) -> true;
+       (srp_rsa) -> true;
+       (_) -> false
+    end;
+rsa_signed(_) ->
+    fun(rsa) -> true;
+       (dhe_rsa) -> true;
+       (ecdhe_rsa) -> true;
+       (ecdh_rsa) -> true;
+       (rsa_psk) -> true;
+       (srp_rsa) -> true;
+       (_) -> false
+    end.
+%% Cert should be signed by RSA
+rsa_signed_suites(Ciphers, Version) ->
+    filter_suites(Ciphers, #{key_exchange_filters => [rsa_signed(Version)],
+                             cipher_filters => [],
+                             mac_filters => [],
+                             prf_filters => []}).
+ecdsa_signed({3,N}) when N >= 3 ->
+    fun(ecdhe_ecdsa) -> true;
+       (_) -> false
+    end;
+ecdsa_signed(_) ->
+    fun(ecdhe_ecdsa) -> true;
+       (ecdh_ecdsa) -> true;
+       (_) -> false
+    end. 
+
+%% Cert should be signed by ECDSA
+ecdsa_signed_suites(Ciphers, Version) ->
+    filter_suites(Ciphers, #{key_exchange_filters => [ecdsa_signed(Version)],
+                             cipher_filters => [],
+                             mac_filters => [],
+                             prf_filters => []}).
+
+rsa_keyed(dhe_rsa) -> 
+    true;
+rsa_keyed(rsa) -> 
+    true;
+rsa_keyed(rsa_psk) -> 
+    true;
+rsa_keyed(srp_rsa) -> 
+    true;
+rsa_keyed(ecdhe_rsa) -> 
+    true;
+rsa_keyed(_) -> 
+    false.
 
-ecdsa_signed_suites() ->
-    ecdh_ecdsa_suites() ++ ecdhe_ecdsa_suites().
+%% Certs key is an RSA key
+rsa_keyed_suites(Ciphers) ->
+   filter_suites(Ciphers, #{key_exchange_filters => [fun(Kex) -> rsa_keyed(Kex) end],
+                             cipher_filters => [],
+                             mac_filters => [],
+                             prf_filters => []}).
+
+%% RSA Certs key can be used for encipherment
+rsa_suites_encipher(Ciphers) ->
+    filter_suites(Ciphers, #{key_exchange_filters => [fun(rsa) -> true; 
+                                                         (rsa_psk) -> true; 
+                                                         (_) -> false
+                                                      end],
+                             cipher_filters => [],
+                             mac_filters => [],
+                             prf_filters => []}).
+
+dss_keyed(dhe_dss) ->
+    true;
+dss_keyed(spr_dss) -> 
+    true;
+dss_keyed(_) -> 
+    false. 
+
+%% Cert should be have DSS key (DSA)
+dss_keyed_suites(Ciphers) ->
+    filter_suites(Ciphers, #{key_exchange_filters => [fun(Kex) -> dss_keyed(Kex) end],
+                             cipher_filters => [],
+                             mac_filters => [],
+                             prf_filters => []}).
+
+%% Cert should be signed by DSS (DSA)
+dsa_signed_suites(Ciphers, Version) ->
+    filter_suites(Ciphers, #{key_exchange_filters => [dsa_signed(Version)],
+                             cipher_filters => [],
+                             mac_filters => [],
+                             prf_filters => []}).
+
+dsa_signed({3,N}) when N >= 3 ->
+    fun(dhe_dss) -> true;
+       (ecdhe_dss) -> true;
+       (_) -> false
+    end;
+dsa_signed(_) ->
+    fun(dhe_dss) -> true;
+       (ecdh_dss) -> true;
+       (ecdhe_dss) -> true;
+       (_) -> false
+    end.
 
-ecdh_suites() ->
-    ecdh_rsa_suites() ++ ecdh_ecdsa_suites().
+ec_keyed(ecdh_ecdsa) ->
+    true;
+ec_keyed(ecdhe_ecdsa) -> 
+    true;
+ec_keyed(ecdh_rsa) -> 
+    true;
+ec_keyed(_) -> 
+    false.
 
-ecdh_ecdsa_suites() ->
-    [?TLS_ECDH_ECDSA_WITH_NULL_SHA,
-     ?TLS_ECDH_ECDSA_WITH_RC4_128_SHA,
-     ?TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,
-     ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
-     ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
-     ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,
-     ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,
-     ?TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
-     ?TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384].
-
-ecdhe_ecdsa_suites() ->
-    [?TLS_ECDHE_ECDSA_WITH_NULL_SHA,
-     ?TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
-     ?TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
-     ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-     ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-     ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
-     ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
-     ?TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-     ?TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-     ?TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256].
-
-filter_keyuse(OtpCert, Ciphers, Suites, SignSuites) ->
+%% Certs key is an ECC key
+ec_keyed_suites(Ciphers) ->
+    filter_suites(Ciphers, #{key_exchange_filters => [fun(Kex) -> ec_keyed(Kex) end],
+                             cipher_filters => [],
+                             mac_filters => [],
+                             prf_filters => []}).
+
+%% EC Certs key can be used for signing
+ecdsa_sign_suites(Ciphers)->
+    filter_suites(Ciphers, #{key_exchange_filters => [fun(ecdhe_ecdsa) -> true;
+                                                         (_) -> false
+                                                      end],
+                             cipher_filters => [],
+                             mac_filters => [],
+                             prf_filters => []}).
+
+key_uses(OtpCert) ->
     TBSCert = OtpCert#'OTPCertificate'.tbsCertificate, 
     TBSExtensions = TBSCert#'OTPTBSCertificate'.extensions,
     Extensions = ssl_certificate:extensions_list(TBSExtensions),
     case ssl_certificate:select_extension(?'id-ce-keyUsage', Extensions) of
 	undefined ->
-	    Ciphers;
-	#'Extension'{extnValue = KeyUse} ->
-	    Result = filter_keyuse_suites(keyEncipherment,
-					  KeyUse, Ciphers, Suites),
-	    filter_keyuse_suites(digitalSignature,
-				 KeyUse, Result, SignSuites)
+	    undefined;
+	#'Extension'{extnValue = KeyUses} ->
+            KeyUses
     end.
 
 filter_keyuse_suites(Use, KeyUse, CipherSuits, Suites) ->
diff --git a/lib/ssl/src/ssl_config.erl b/lib/ssl/src/ssl_config.erl
index 022fb7eac0..452a98e683 100644
--- a/lib/ssl/src/ssl_config.erl
+++ b/lib/ssl/src/ssl_config.erl
@@ -132,7 +132,13 @@ private_key(#'PrivateKeyInfo'{privateKeyAlgorithm =
 				 #'PrivateKeyInfo_privateKeyAlgorithm'{algorithm = ?'id-dsa'},
 			     privateKey = Key}) ->
     public_key:der_decode('DSAPrivateKey', iolist_to_binary(Key));
-
+private_key(#'PrivateKeyInfo'{privateKeyAlgorithm = 
+                                  #'PrivateKeyInfo_privateKeyAlgorithm'{algorithm = ?'id-ecPublicKey',
+                                                                        parameters =  {asn1_OPENTYPE, Parameters}},
+                              privateKey = Key}) ->
+    ECKey = public_key:der_decode('ECPrivateKey',  iolist_to_binary(Key)),
+    ECParameters = public_key:der_decode('EcpkParameters', Parameters),
+    ECKey#'ECPrivateKey'{parameters = ECParameters};
 private_key(Key) ->
     Key.
 
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index 3f8c1f97f9..ec034af44c 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -1472,7 +1472,7 @@ connection_info(#state{sni_hostname = SNIHostname,
     RecordCB = record_cb(Connection),
     CipherSuiteDef = #{key_exchange := KexAlg} = ssl_cipher:suite_definition(CipherSuite),
     IsNamedCurveSuite = lists:member(KexAlg,
-                                     [ecdh_ecdsa, ecdhe_ecdsa, ecdh_anon]),
+                                     [ecdh_ecdsa, ecdhe_ecdsa, ecdh_rsa, ecdh_anon]),
     CurveInfo = case ECCCurve of
 		    {namedCurve, Curve} when IsNamedCurveSuite ->
 			[{ecc, {named_curve, pubkey_cert_records:namedCurves(Curve)}}];
@@ -1572,11 +1572,14 @@ handle_peer_cert(Role, PeerCert, PublicKeyInfo,
 handle_peer_cert_key(client, _,
 		     {?'id-ecPublicKey',  #'ECPoint'{point = _ECPoint} = PublicKey,
 		      PublicKeyParams},
-		     KeyAlg, State)  when KeyAlg == ecdh_rsa;
-					  KeyAlg == ecdh_ecdsa ->
+		     KeyAlg, #state{session = Session} = State)  when KeyAlg == ecdh_rsa;
+                                                                      KeyAlg == ecdh_ecdsa ->
     ECDHKey = public_key:generate_key(PublicKeyParams),
+    {namedCurve, Oid} = PublicKeyParams,
+    Curve = pubkey_cert_records:namedCurves(Oid), %% Need API function
     PremasterSecret = ssl_handshake:premaster_secret(PublicKey, ECDHKey),
-    master_secret(PremasterSecret, State#state{diffie_hellman_keys = ECDHKey});
+    master_secret(PremasterSecret, State#state{diffie_hellman_keys = ECDHKey,
+                                               session = Session#session{ecc = {named_curve, Curve}}});
 %% We do currently not support cipher suites that use fixed DH.
 %% If we want to implement that the following clause can be used
 %% to extract DH parameters form cert.
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index 8ddd4623c1..090e7b69b7 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -772,11 +772,12 @@ available_suites(UserSuites, Version) ->
     lists:filtermap(fun(Suite) -> lists:member(Suite, VersionSuites) end, UserSuites).
 
 available_suites(ServerCert, UserSuites, Version, undefined, Curve) ->
-    ssl_cipher:filter(ServerCert, available_suites(UserSuites, Version))
-	-- unavailable_ecc_suites(Curve);
+    Suites = ssl_cipher:filter(ServerCert, available_suites(UserSuites, Version), Version),
+    filter_unavailable_ecc_suites(Curve, Suites);
 available_suites(ServerCert, UserSuites, Version, HashSigns, Curve) ->
     Suites = available_suites(ServerCert, UserSuites, Version, undefined, Curve),
-    filter_hashsigns(Suites, [ssl_cipher:suite_definition(Suite) || Suite <- Suites], HashSigns, []).
+    filter_hashsigns(Suites, [ssl_cipher:suite_definition(Suite) || Suite <- Suites], HashSigns, 
+                     Version, []).
 
 available_signature_algs(undefined, _)  ->
     undefined;
@@ -814,7 +815,7 @@ prf({3,0}, _, _, _, _, _) ->
 prf({3,_N}, PRFAlgo, Secret, Label, Seed, WantedLength) ->
     {ok, tls_v1:prf(PRFAlgo, Secret, Label, Seed, WantedLength)}.
 
-select_session(SuggestedSessionId, CipherSuites, HashSigns, Compressions, Port, #session{ecc = ECCCurve} = 
+select_session(SuggestedSessionId, CipherSuites, HashSigns, Compressions, Port, #session{ecc = ECCCurve0} = 
 		   Session, Version,
 	       #ssl_options{ciphers = UserSuites, honor_cipher_order = HonorCipherOrder} = SslOpts,
 	       Cache, CacheCb, Cert) ->
@@ -823,10 +824,12 @@ select_session(SuggestedSessionId, CipherSuites, HashSigns, Compressions, Port,
 						 Cache, CacheCb),
     case Resumed of
         undefined ->
-	    Suites = available_suites(Cert, UserSuites, Version, HashSigns, ECCCurve),
-	    CipherSuite = select_cipher_suite(CipherSuites, Suites, HonorCipherOrder),
+	    Suites = available_suites(Cert, UserSuites, Version, HashSigns, ECCCurve0),
+	    CipherSuite0 = select_cipher_suite(CipherSuites, Suites, HonorCipherOrder),
+            {ECCCurve, CipherSuite} = cert_curve(Cert, ECCCurve0, CipherSuite0),
 	    Compression = select_compression(Compressions),
 	    {new, Session#session{session_id = SessionId,
+                                  ecc = ECCCurve,
 				  cipher_suite = CipherSuite,
 				  compression_method = Compression}};
 	_ ->
@@ -1066,11 +1069,11 @@ select_hashsign(#hash_sign_algos{hash_sign_algos = HashSigns}, Cert, KeyExAlgo,
      	TBSCert#'OTPTBSCertificate'.subjectPublicKeyInfo,
 
     Sign = sign_algo(SignAlgo),
-    SubSing = sign_algo(SubjAlgo),
-
-    case lists:filter(fun({_, S} = Algos) when S == Sign ->
+    SubSign = sign_algo(SubjAlgo),
+    
+    case lists:filter(fun({_, S} = Algos) when S == SubSign ->
 			      is_acceptable_hash_sign(Algos, Sign,
-						      SubSing, KeyExAlgo, SupportedHashSigns);
+						      SubSign, KeyExAlgo, SupportedHashSigns);
 			 (_)  ->
 			      false
 		      end, HashSigns) of
@@ -2075,25 +2078,26 @@ handle_psk_identity(_PSKIdentity, LookupFun)
 handle_psk_identity(PSKIdentity, {Fun, UserState}) ->
     Fun(psk, PSKIdentity, UserState).
 
-filter_hashsigns([], [], _, Acc) ->
-    lists:reverse(Acc);
-filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], HashSigns,
-		 Acc) when KeyExchange == dhe_ecdsa;
-			   KeyExchange == ecdhe_ecdsa ->
-    do_filter_hashsigns(ecdsa, Suite, Suites, Algos, HashSigns, Acc);
 
-filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], HashSigns,
+filter_hashsigns([], [], _, _, Acc) ->
+    lists:reverse(Acc);
+filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], HashSigns, Version,
+ 		 Acc) when KeyExchange == dhe_ecdsa;
+ 			   KeyExchange == ecdhe_ecdsa ->
+    do_filter_hashsigns(ecdsa, Suite, Suites, Algos, HashSigns, Version, Acc); 
+filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], HashSigns, Version,
 		 Acc) when KeyExchange == rsa;
 			   KeyExchange == dhe_rsa;
 			   KeyExchange == ecdhe_rsa;
 			   KeyExchange == srp_rsa;
 			   KeyExchange == rsa_psk ->
-    do_filter_hashsigns(rsa, Suite, Suites, Algos, HashSigns, Acc);
-filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], HashSigns, Acc) when 
+    do_filter_hashsigns(rsa, Suite, Suites, Algos, HashSigns, Version, Acc);
+filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], HashSigns, Version, Acc) when 
       KeyExchange == dhe_dss;
       KeyExchange == srp_dss ->							       
-    do_filter_hashsigns(dsa, Suite, Suites, Algos, HashSigns, Acc);
-filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], HashSigns, Acc) when 
+    do_filter_hashsigns(dsa, Suite, Suites, Algos, HashSigns, Version, Acc);
+filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], HashSigns, Verion,
+                 Acc) when 
       KeyExchange == dh_dss; 
       KeyExchange == dh_rsa; 
       KeyExchange == dh_ecdsa;
@@ -2102,8 +2106,9 @@ filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], Has
       %%  Fixed DH certificates MAY be signed with any hash/signature
       %%  algorithm pair appearing in the hash_sign extension.  The names
     %%  DH_DSS, DH_RSA, ECDH_ECDSA, and ECDH_RSA are historical.
-    filter_hashsigns(Suites, Algos, HashSigns, [Suite| Acc]);
-filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], HashSigns, Acc) when 
+    filter_hashsigns(Suites, Algos, HashSigns, Verion, [Suite| Acc]);
+filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], HashSigns, Version,
+                 Acc) when 
       KeyExchange == dh_anon;
       KeyExchange == ecdh_anon;
       KeyExchange == srp_anon;
@@ -2111,20 +2116,28 @@ filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], Has
       KeyExchange == dhe_psk;
       KeyExchange == ecdhe_psk ->
     %% In this case hashsigns is not used as the kexchange is anonaymous
-    filter_hashsigns(Suites, Algos, HashSigns, [Suite| Acc]).
+    filter_hashsigns(Suites, Algos, HashSigns, Version, [Suite| Acc]).
 
-do_filter_hashsigns(SignAlgo, Suite, Suites, Algos, HashSigns, Acc) ->
+do_filter_hashsigns(SignAlgo, Suite, Suites, Algos, HashSigns, Version, Acc) ->
     case lists:keymember(SignAlgo, 2, HashSigns) of
 	true ->
-	    filter_hashsigns(Suites, Algos, HashSigns, [Suite| Acc]);
+	    filter_hashsigns(Suites, Algos, HashSigns, Version, [Suite| Acc]);
 	false ->
-	    filter_hashsigns(Suites, Algos, HashSigns, Acc)
+	    filter_hashsigns(Suites, Algos, HashSigns, Version, Acc)
     end.
 
-unavailable_ecc_suites(no_curve) ->
-    ssl_cipher:ec_keyed_suites();
-unavailable_ecc_suites(_) ->
-    [].
+filter_unavailable_ecc_suites(no_curve, Suites) ->
+    ECCSuites = ssl_cipher:filter_suites(Suites, #{key_exchange_filters => [fun(ecdh_ecdsa) -> true; 
+                                                                               (ecdhe_ecdsa) -> true; 
+                                                                               (ecdh_rsa) -> true; 
+                                                                               (_) -> false 
+                                                                            end],
+                                                   cipher_filters => [],
+                                                   mac_filters => [],
+                                                   prf_filters => []}),
+    Suites -- ECCSuites;       
+filter_unavailable_ecc_suites(_, Suites) ->
+    Suites.
 %%-------------Extension handling --------------------------------
 
 handle_renegotiation_extension(Role, RecordCB, Version, Info, Random, NegotiatedCipherSuite, 
@@ -2220,8 +2233,11 @@ sign_algo(Alg) ->
 is_acceptable_hash_sign(Algos, _, _, KeyExAlgo, SupportedHashSigns) when 
       KeyExAlgo == dh_dss;
       KeyExAlgo == dh_rsa;
-      KeyExAlgo == dh_ecdsa ->
-    %% dh_* could be called only dh in TLS-1.2
+      KeyExAlgo == ecdh_ecdsa;
+      KeyExAlgo == ecdh_rsa;
+      KeyExAlgo == ecdh_ecdsa
+      ->
+    %% *dh_* could be called only *dh in TLS-1.2
     is_acceptable_hash_sign(Algos, SupportedHashSigns); 
 is_acceptable_hash_sign(Algos, rsa, ecdsa, ecdh_rsa, SupportedHashSigns) ->
     is_acceptable_hash_sign(Algos, SupportedHashSigns); 
@@ -2436,3 +2452,27 @@ handle_renegotiation_info(_RecordCB, ConnectionStates, SecureRenegotation) ->
 	{false, false} ->
 	    {ok, ConnectionStates}
     end.
+
+cert_curve(_, _, no_suite) ->
+    {no_curve, no_suite};
+cert_curve(Cert, ECCCurve0, CipherSuite) ->
+    case ssl_cipher:suite_definition(CipherSuite) of
+        #{key_exchange := Kex} when Kex == ecdh_ecdsa; 
+                                    Kex == ecdh_rsa ->
+            OtpCert = public_key:pkix_decode_cert(Cert, otp),
+            TBSCert = OtpCert#'OTPCertificate'.tbsCertificate,
+            #'OTPSubjectPublicKeyInfo'{algorithm = AlgInfo} 
+                = TBSCert#'OTPTBSCertificate'.subjectPublicKeyInfo,
+            {namedCurve, Oid}  = AlgInfo#'PublicKeyAlgorithm'.parameters,
+            try pubkey_cert_records:namedCurves(Oid) of
+                Curve ->
+                    {{named_curve, Curve}, CipherSuite}
+            catch 
+                _:_ ->
+                    {no_curve, no_suite}
+            end;
+        _ ->
+            {ECCCurve0, CipherSuite}
+    end.
+
+   
diff --git a/lib/ssl/test/ssl_ECC.erl b/lib/ssl/test/ssl_ECC.erl
index 489a72e50e..2096cf8166 100644
--- a/lib/ssl/test/ssl_ECC.erl
+++ b/lib/ssl/test/ssl_ECC.erl
@@ -89,7 +89,7 @@ client_ecdhe_ecdsa_server_ecdhe_rsa(Config)  when is_list(Config) ->
 
 %% ECDH_ECDSA
 client_ecdh_ecdsa_server_ecdh_ecdsa(Config)  when is_list(Config) ->
-    Ext = x509_test:extensions([{key_usage, [keyEncipherment]}]),
+    Ext = x509_test:extensions([{key_usage, [keyAgreement]}]),
     {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, 
                                                         [[], [], [{extensions, Ext}]]},
                                                        {client_chain,
@@ -99,7 +99,7 @@ client_ecdh_ecdsa_server_ecdh_ecdsa(Config)  when is_list(Config) ->
                ssl_test_lib:ssl_options(SOpts, Config),
                [{check_keyex, ecdh_ecdsa} | proplists:delete(check_keyex, Config)]).
 client_ecdhe_rsa_server_ecdh_ecdsa(Config)  when is_list(Config) ->
-     Ext = x509_test:extensions([{key_usage, [keyEncipherment]}]),
+     Ext = x509_test:extensions([{key_usage, [keyAgreement]}]),
      {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, 
                                                          [[], [], [{extensions, Ext}]]},
                                                         {client_chain,
@@ -110,7 +110,7 @@ client_ecdhe_rsa_server_ecdh_ecdsa(Config)  when is_list(Config) ->
                [{check_keyex, ecdh_ecdsa} | proplists:delete(check_keyex, Config)]).
 
 client_ecdhe_ecdsa_server_ecdh_ecdsa(Config)  when is_list(Config) ->
-    Ext = x509_test:extensions([{key_usage, [keyEncipherment]}]),
+    Ext = x509_test:extensions([{key_usage, [keyAgreement]}]),
     {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, 
                                                         [[], [], [{extensions, Ext}]]},
                                                        {client_chain,
diff --git a/lib/ssl/test/ssl_ECC_openssl_SUITE.erl b/lib/ssl/test/ssl_ECC_openssl_SUITE.erl
index ba609aa0dc..280fa94ecb 100644
--- a/lib/ssl/test/ssl_ECC_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_ECC_openssl_SUITE.erl
@@ -33,39 +33,57 @@
 %%--------------------------------------------------------------------
 
 all() ->
-    [
-     {group, 'tlsv1.2'},
-     {group, 'tlsv1.1'},
-     {group, 'tlsv1'},
-     {group, 'dtlsv1.2'},
-     {group, 'dtlsv1'}
-    ].
+    case test_cases() of
+        [_|_] ->
+            all_groups();
+        [] ->
+            [skip]
+    end.
+
+all_groups() ->
+    case ssl_test_lib:openssl_sane_dtls() of 
+        true ->
+            [{group, 'tlsv1.2'},
+             {group, 'tlsv1.1'},
+             {group, 'tlsv1'},
+             {group, 'dtlsv1.2'},
+             {group, 'dtlsv1'}];
+        false ->
+            [{group, 'tlsv1.2'},
+             {group, 'tlsv1.1'},
+             {group, 'tlsv1'}]
+    end.
 
 groups() ->
-    [
-     {'tlsv1.2', [], test_cases()},
-     {'tlsv1.1', [], test_cases()},
-     {'tlsv1', [], test_cases()},
-     {'dtlsv1.2', [], test_cases()},
-     {'dtlsv1', [], test_cases()}     
-    ].
+    case ssl_test_lib:openssl_sane_dtls() of 
+        true ->
+            [{'tlsv1.2', [], test_cases()},
+             {'tlsv1.1', [], test_cases()},
+             {'tlsv1', [], test_cases()},
+             {'dtlsv1.2', [], test_cases()},
+             {'dtlsv1', [], test_cases()}];
+        false ->
+            [{'tlsv1.2', [], test_cases()},
+             {'tlsv1.1', [], test_cases()},
+             {'tlsv1', [], test_cases()}]
+    end.
 
 test_cases()->
-   %% cert_combinations().
-    server_ecdh_rsa(). 
+   cert_combinations().
+  
 cert_combinations() ->
-     lists:append(lists:filtermap(fun({Name, Suites}) -> 
-                             case ssl_test_lib:openssl_filter(Name) of
-                                [] ->
-                                     false;
-                                [_|_] ->
-                                     {true, Suites}
-                             end
-                    end, [{"ECDH-RSA", server_ecdh_rsa()},
-                           {"ECDHE-RSA", server_ecdhe_rsa()},
-                          {"ECDH-ECDSA", server_ecdh_ecdsa()},
-                          {"ECDHE-ECDSA", server_ecdhe_ecdsa()}
-                         ])).
+    lists:append(lists:map(fun({Name, Suites}) -> 
+                                   case ssl_test_lib:openssl_filter(Name) of
+                                       [] ->
+                                           [];
+                                       [_|_] ->
+                                           Suites
+                                   end
+                           end, [{"ECDH-ECDSA", server_ecdh_ecdsa()},
+                                 {"ECDH-RSA", server_ecdh_rsa()},
+                                 {"ECDHE-RSA", server_ecdhe_rsa()},
+                                 {"ECDHE-ECDSA", server_ecdhe_ecdsa()}
+                                ])).
 server_ecdh_rsa() ->
     [client_ecdh_rsa_server_ecdh_rsa,
      client_ecdhe_rsa_server_ecdh_rsa,     
@@ -91,11 +109,11 @@ init_per_suite(Config0) ->
     end_per_suite(Config0),
     try crypto:start() of
 	ok ->
-            case ssl_test_lib:sufficient_crypto_support(cipher_ec) of
+            case  ssl_test_lib:sufficient_crypto_support(cipher_ec) of
                 true ->
                     Config0;
                 false ->
-                    {skip, "Crypto does not support ECC"}
+                    {skip, "Openssl does not support ECC"}
             end
     catch _:_ ->
             {skip, "Crypto did not start"}
@@ -131,7 +149,8 @@ end_per_group(GroupName, Config0) ->
   end.
 
 %%--------------------------------------------------------------------
-
+init_per_testcase(skip, Config) ->
+    Config;
 init_per_testcase(TestCase, Config) ->
     ssl_test_lib:ct_log_supported_protocol_versions(Config),
     Version = proplists:get_value(tls_version, Config),
@@ -149,6 +168,9 @@ end_per_testcase(_TestCase, Config) ->
 %% Test Cases --------------------------------------------------------
 %%--------------------------------------------------------------------
 
+skip(Config) when is_list(Config) ->
+    {skip, openssl_does_not_support_ECC}.
+
 %% Test diffrent certificate chain types, note that it is the servers
 %% chain that affect what cipher suit that will be choosen
 
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index 3a7e844cf8..4022f49077 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -1434,16 +1434,33 @@ sufficient_crypto_support(_) ->
 check_key_exchange_send_active(Socket, false) ->
     send_recv_result_active(Socket);
 check_key_exchange_send_active(Socket, KeyEx) ->
-    {ok, [{cipher_suite, Suite}]} = ssl:connection_information(Socket, [cipher_suite]),
-    true = check_key_exchange(Suite, KeyEx), 
+    {ok, Info} =
+        ssl:connection_information(Socket, [cipher_suite, protocol]),
+    Suite = proplists:get_value(cipher_suite, Info),
+    Version = proplists:get_value(protocol, Info),
+    true = check_key_exchange(Suite, KeyEx, Version), 
     send_recv_result_active(Socket).
 
-check_key_exchange({KeyEx,_, _}, KeyEx) ->
+check_key_exchange({KeyEx,_, _}, KeyEx, _) ->
     true;
-check_key_exchange({KeyEx,_,_,_}, KeyEx) ->
+check_key_exchange({KeyEx,_,_,_}, KeyEx, _) ->
     true;
-check_key_exchange(KeyEx1, KeyEx2) ->
-    ct:pal("Negotiated ~p  Expected ~p", [KeyEx1, KeyEx2]),
+check_key_exchange(KeyEx1, KeyEx2, Version) ->
+    case Version of
+        'tlsv1.2' ->
+            v_1_2_check(element(1, KeyEx1), KeyEx2);
+        'dtlsv1.2' ->
+            v_1_2_check(element(1, KeyEx1), KeyEx2);
+        _ ->       
+            ct:pal("Negotiated ~p  Expected ~p", [KeyEx1, KeyEx2]),
+            false
+    end.
+
+v_1_2_check(ecdh_ecdsa, ecdh_rsa) ->
+    true;
+v_1_2_check(ecdh_rsa, ecdh_ecdsa) ->
+    true;
+v_1_2_check(_, _) ->
     false.
 
 send_recv_result_active(Socket) ->
@@ -1567,12 +1584,60 @@ openssl_dsa_support() ->
             true
     end.
 
+%% Acctual support is tested elsewhere, this is to exclude some LibreSSL and OpenSSL versions
+openssl_sane_dtls() -> 
+    case os:cmd("openssl version") of
+        "OpenSSL 0." ++ _ ->
+            false;
+        "OpenSSL 1.0.1s-freebsd" ++ _ ->
+            false;
+        "OpenSSL 1.0.2k-freebsd" ++ _ ->
+            false;
+        "OpenSSL 1.0.2d" ++ _ ->
+            false;
+        "OpenSSL 1.0.2n" ++ _ ->
+            false;
+        "OpenSSL 1.0.0" ++ _ ->
+            false;
+        "OpenSSL" ++ _ ->
+            true;
+        "LibreSSL 2.7" ++ _ ->
+            true;
+        _ ->
+            false
+        end.
+openssl_sane_client_cert() -> 
+    case os:cmd("openssl version") of
+        "LibreSSL 2.5.2" ++ _ ->
+            true;
+        "LibreSSL 2.4" ++ _ ->
+            false;
+        "LibreSSL 2.3" ++ _ ->
+            false; 
+         "LibreSSL 2.1" ++ _ ->
+            false; 
+         "LibreSSL 2.0" ++ _ ->
+            false; 
+         "LibreSSL 2.0" ++ _ ->
+            false; 
+        "OpenSSL 1.0.1s-freebsd" ->
+            false;
+        "OpenSSL 1.0.0" ++ _ ->
+            false; 
+        _ ->
+            true
+    end.
+
 check_sane_openssl_version(Version) ->
     case supports_ssl_tls_version(Version) of 
 	true ->
 	    case {Version, os:cmd("openssl version")} of
                 {'sslv3', "OpenSSL 1.0.2" ++ _} ->
                     false;
+                {'dtlsv1', _} ->
+		    not is_fips(openssl);
+		{'dtlsv1.2', _} ->
+		    not is_fips(openssl);
 		{_, "OpenSSL 1.0.2" ++ _} ->
 		    true;
 		{_, "OpenSSL 1.0.1" ++ _} ->
@@ -1581,7 +1646,7 @@ check_sane_openssl_version(Version) ->
 		    false;
 		{'tlsv1.1', "OpenSSL 1.0.0" ++ _} ->
 		    false;
-                {'dtlsv1.2', "OpenSSL 1.0.0" ++ _} ->
+                {'dtlsv1.2', "OpenSSL 1.0.2" ++ _} ->
 		    false;
 		{'dtlsv1',  "OpenSSL 1.0.0" ++ _} ->
 		    false;
diff --git a/lib/ssl/test/ssl_to_openssl_SUITE.erl b/lib/ssl/test/ssl_to_openssl_SUITE.erl
index 9c60a6315e..a2e8ef8be0 100644
--- a/lib/ssl/test/ssl_to_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_to_openssl_SUITE.erl
@@ -37,26 +37,43 @@
 %%--------------------------------------------------------------------
 
 all() -> 
-    [
-     {group, basic},
-     {group, 'tlsv1.2'},
-     {group, 'tlsv1.1'},
-     {group, 'tlsv1'},
-     {group, 'sslv3'},
-     {group, 'dtlsv1.2'},
-     {group, 'dtlsv1'}
-    ].
+    case ssl_test_lib:openssl_sane_dtls() of 
+        true ->
+            [{group, basic},
+             {group, 'tlsv1.2'},
+             {group, 'tlsv1.1'},
+             {group, 'tlsv1'},
+             {group, 'sslv3'},
+             {group, 'dtlsv1.2'},
+             {group, 'dtlsv1'}];
+        false ->
+            [{group, basic},
+             {group, 'tlsv1.2'},
+             {group, 'tlsv1.1'},
+             {group, 'tlsv1'},
+             {group, 'sslv3'}]
+    end.
 
 groups() ->
-    [{basic, [], basic_tests()},
-     {'tlsv1.2', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
-     {'tlsv1.1', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
-      {'tlsv1', [], all_versions_tests()++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
-      {'sslv3', [], all_versions_tests()},
-      {'dtlsv1.2', [], dtls_all_versions_tests()},
-      {'dtlsv1', [], dtls_all_versions_tests()}
-     ].
-
+     case ssl_test_lib:openssl_sane_dtls() of 
+         true ->
+             [{basic, [], basic_tests()},
+              {'tlsv1.2', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
+              {'tlsv1.1', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
+              {'tlsv1', [], all_versions_tests()++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
+              {'sslv3', [], all_versions_tests()},
+              {'dtlsv1.2', [], dtls_all_versions_tests()},
+              {'dtlsv1', [], dtls_all_versions_tests()}
+             ];
+        false ->
+             [{basic, [], basic_tests()},
+              {'tlsv1.2', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
+              {'tlsv1.1', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
+              {'tlsv1', [], all_versions_tests()++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
+              {'sslv3', [], all_versions_tests()}
+           ]
+     end.
+  
 basic_tests() ->
     [basic_erlang_client_openssl_server,
      basic_erlang_server_openssl_client,
@@ -85,9 +102,20 @@ all_versions_tests() ->
      expired_session,
      ssl2_erlang_server_openssl_client
     ].
+
 dtls_all_versions_tests() ->
-    [
-     erlang_client_openssl_server,
+   case ssl_test_lib:openssl_sane_client_cert() of
+       true ->
+           [erlang_server_openssl_client_client_cert,
+            erlang_client_openssl_server_no_server_ca_cert,
+            erlang_client_openssl_server_client_cert
+            | dtls_all_versions_tests_2()];
+       false ->
+          dtls_all_versions_tests_2()
+   end. 
+  
+dtls_all_versions_tests_2() ->
+    [erlang_client_openssl_server,
      erlang_server_openssl_client,
      erlang_client_openssl_server_dsa_cert,
      erlang_server_openssl_client_dsa_cert,
@@ -98,12 +126,8 @@ dtls_all_versions_tests() ->
      erlang_client_openssl_server_renegotiate,
      erlang_client_openssl_server_nowrap_seqnum,
      erlang_server_openssl_client_nowrap_seqnum,
-     erlang_client_openssl_server_no_server_ca_cert,
-     erlang_client_openssl_server_client_cert,
-     erlang_server_openssl_client_client_cert,
      ciphers_rsa_signed_certs,
      ciphers_dsa_signed_certs
-     %%erlang_client_bad_openssl_server,
      %%expired_session
     ].
 
@@ -167,7 +191,15 @@ end_per_suite(_Config) ->
     application:stop(crypto).
 
 init_per_group(basic, Config0) ->
-    ssl_test_lib:clean_tls_version(Config0);
+    case ssl_test_lib:supports_ssl_tls_version('tlsv1.2')
+        orelse ssl_test_lib:supports_ssl_tls_version('tlsv1.1')
+        orelse ssl_test_lib:supports_ssl_tls_version('tlsv1')
+    of
+        true ->
+            ssl_test_lib:clean_tls_version(Config0);
+        false ->
+            {skip, "only sslv3 supported by OpenSSL"}
+    end;
 
 init_per_group(GroupName, Config) ->
     case ssl_test_lib:is_tls_version(GroupName) of
@@ -381,7 +413,7 @@ basic_erlang_server_openssl_client(Config) when is_list(Config) ->
     
     Exe = "openssl",
     Args = ["s_client", "-connect", hostname_format(Hostname) ++
-                ":" ++ integer_to_list(Port) ++ no_v2_flag() | workaround_openssl_s_clinent()],
+                ":" ++ integer_to_list(Port) ++ no_low_flag() | workaround_openssl_s_clinent()],
     
     OpenSslPort = ssl_test_lib:portable_open_port(Exe, Args), 
     true = port_command(OpenSslPort, Data),
@@ -1963,10 +1995,10 @@ hostname_format(Hostname) ->
             "localhost"   
     end.
 
-no_v2_flag() ->
+no_low_flag() ->
     case ssl_test_lib:supports_ssl_tls_version(sslv2) of
         true ->
-            " -no_ssl2 ";
+            " -no_ssl2 -no_ssl3";
         false ->
-            ""
+            " -no_ssl3"
     end.