Merge branch 'ingela/maint-20/ssl/extend-hostname-check/OTP-14632/OTP-14655/OTP-14766' into maint-20

* ingela/maint-20/ssl/extend-hostname-check/OTP-14632/OTP-14655/OTP-14766:
  ssl: Fix test cases to work on all test platforms
  public_key: Fix dialyzer spec
  ssl: Sessions must be registered with SNI if exists
  ssl: Extend hostname check to fallback to checking IP-address
  public_key, ssl: Handles keys so that APIs are preserved correctly
  ssl: Use ?FUNCTION_NAME

9 files changed, 360 insertions, 145 deletions

diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml
index ca2dcbb761..e80fd59a7f 100644
--- a/lib/ssl/doc/src/ssl.xml
+++ b/lib/ssl/doc/src/ssl.xml
@@ -589,22 +589,19 @@ fun(srp, Username :: string(), UserState :: term()) ->
 
       <tag><c>{server_name_indication, HostName :: hostname()}</c></tag>
       <item><p>Specify the hostname to be used in TLS Server Name Indication extension.
-      Is usefull when upgrading a TCP socket to a TLS socket or if the hostname can not be 
-      derived from the Host argument to <seealso marker="ssl#connect-3">ssl:connect/3</seealso>.
-      Will also cause the client to preform host name verification of the peer certificate
-      <seealso marker="public_key:public_key#pkix_verify_hostname-2">public_key:pkix_verify_hostname(PeerCert, [{dns_id, HostName}])</seealso>
-      </p> during the x509-path validation. If the check fails the error {bad_cert, hostname_check_failiure} will be
-      propagated to the path validation fun <seealso marker="#verify_fun">verify_fun</seealso>
-      </item>
-
-	<tag><c>{server_name_indication, disable}</c></tag>
-      <item>
-        <p>When starting a TLS connection without upgrade, the Server Name
-        Indication extension is sent if possible that is can be derived from the Host argument 
-        to <seealso marker="ssl#connect-3">ssl:connect/3</seealso>.  
-	This option can be used to disable that behavior.</p>
-	<note><p> Note that this also disables the default host name verification check of the peer certificate.</p></note>
+      If not specified it will default to the <c>Host</c> argument of <seealso marker="#connect-3">connect/[3,4]</seealso>
+      unless it is of type inet:ipaddress().</p>
+      <p>
+	The <c>HostName</c> will also be used in the hostname verification of the peer certificate using
+	<seealso marker="public_key:public_key#pkix_verify_hostname-2">public_key:pkix_verify_hostname/2</seealso>.
+      </p>
       </item>
+      <tag><c>{server_name_indication, disable}</c></tag>
+	<item>
+          <p> Prevents the Server Name Indication extension from being sent and
+	  disables the hostname verification check
+	  <seealso marker="public_key:public_key#pkix_verify_hostname-2">public_key:pkix_verify_hostname/2</seealso> </p>
+	</item>
       <tag><c>{fallback, boolean()}</c></tag>
       <item>
 	<p> Send special cipher suite TLS_FALLBACK_SCSV to avoid undesired TLS version downgrade.
@@ -881,6 +878,12 @@ fun(srp, Username :: string(), UserState :: term()) ->
       <desc><p>Upgrades a <c>gen_tcp</c>, or equivalent,
 	  connected socket to an SSL socket, that is, performs the
 	  client-side ssl handshake.</p>
+	  
+	  <note><p>If the option <c>verify</c> is set to <c>verify_peer</c>
+	  the option <c>server_name_indication</c> shall also be specified,
+	  if it is not no Server Name Indication extension will be sent,
+	  and <seealso marker="public_key:public_key#pkix_verify_hostname-2">public_key:pkix_verify_hostname/2</seealso>
+	  will be called with the IP-address of the connection as <c>ReferenceID</c>, which is proably not what you want.</p></note>
     </desc>
     </func>
 
@@ -897,7 +900,24 @@ fun(srp, Username :: string(), UserState :: term()) ->
 	  <v>SslSocket = sslsocket()</v>
 	  <v>Reason = term()</v>
       </type>
-      <desc><p>Opens an SSL connection to <c>Host</c>, <c>Port</c>.</p></desc>
+      <desc><p>Opens an SSL connection to <c>Host</c>, <c>Port</c>.</p>
+      
+      <p> When the option <c>verify</c> is set to <c>verify_peer</c> the check 
+      <seealso marker="public_key:public_key#pkix_verify_hostname-2">public_key:pkix_verify_hostname/2</seealso> 
+      will be performed in addition to the usual x509-path validation checks. If the check fails the error {bad_cert, hostname_check_failed} will
+      be propagated to the path validation fun <seealso marker="#verify_fun">verify_fun</seealso>, where it is possible to do customized
+      checks by using the full possibilitis of the <seealso marker="public_key:public_key#pkix_verify_hostname-2">public_key:pkix_verify_hostname/2</seealso> API.
+      
+      When the option <c>server_name_indication</c> is provided, its value (the DNS name) will be used as <c>ReferenceID</c>
+      to <seealso marker="public_key:public_key#pkix_verify_hostname-2">public_key:pkix_verify_hostname/2</seealso>.
+      When no <c>server_name_indication</c> option is given, the <c>Host</c> argument will be used as
+      Server Name Indication extension. The <c>Host</c> argument will also be used for the
+      <seealso marker="public_key:public_key#pkix_verify_hostname-2">public_key:pkix_verify_hostname/2</seealso> check and if the <c>Host</c>
+      argument is an <c>inet:ip_address()</c> the <c>ReferenceID</c> used for the check will be <c>{ip, Host}</c> otherwise
+      <c>dns_id</c> will be assumed with a fallback to <c>ip</c> if that fails. </p>
+      <note><p>According to good practices certificates should not use IP-addresses as "server names". It would
+      be very surprising if this happen outside a closed network. </p></note> 
+      </desc>
     </func>
 
     <func>
diff --git a/lib/ssl/src/dtls_connection.erl b/lib/ssl/src/dtls_connection.erl
index 260ae8769c..78458f8379 100644
--- a/lib/ssl/src/dtls_connection.erl
+++ b/lib/ssl/src/dtls_connection.erl
@@ -273,28 +273,28 @@ init({call, From}, {start, Timeout},
     {Record, State} = next_record(State3),
     next_event(hello, Record, State, Actions);
 init({call, _} = Type, Event, #state{role = server, transport_cb = gen_udp} = State) ->
-    Result = ssl_connection:init(Type, Event, 
-                                 State#state{flight_state = {retransmit, ?INITIAL_RETRANSMIT_TIMEOUT},
-                                             protocol_specific = #{current_cookie_secret => dtls_v1:cookie_secret(), 
-                                                                   previous_cookie_secret => <<>>,
-                                                                   ignored_alerts => 0,
-                                                                   max_ignored_alerts => 10}},
-                                 ?MODULE),
+    Result = ssl_connection:?FUNCTION_NAME(Type, Event, 
+                                           State#state{flight_state = {retransmit, ?INITIAL_RETRANSMIT_TIMEOUT},
+                                                       protocol_specific = #{current_cookie_secret => dtls_v1:cookie_secret(), 
+                                                                             previous_cookie_secret => <<>>,
+                                                                             ignored_alerts => 0,
+                                                                             max_ignored_alerts => 10}},
+                                           ?MODULE),
     erlang:send_after(dtls_v1:cookie_timeout(), self(), new_cookie_secret),
     Result;
-                                     
+
 init({call, _} = Type, Event, #state{role = server} = State) ->
     %% I.E. DTLS over sctp
-    ssl_connection:init(Type, Event, State#state{flight_state = reliable}, ?MODULE);
+    ssl_connection:?FUNCTION_NAME(Type, Event, State#state{flight_state = reliable}, ?MODULE);
 init(Type, Event, State) ->
-    ssl_connection:init(Type, Event, State, ?MODULE).
+    ssl_connection:?FUNCTION_NAME(Type, Event, State, ?MODULE).
  
 error(enter, _, State) ->
     {keep_state, State};     
 error({call, From}, {start, _Timeout}, {Error, State}) ->
     {stop_and_reply, normal, {reply, From, {error, Error}}, State};
 error({call, From}, Msg, State) ->
-    handle_call(Msg, From, error, State);
+    handle_call(Msg, From, ?FUNCTION_NAME, State);
 error(_, _, _) ->
      {keep_state_and_data, [postpone]}.
 
@@ -326,7 +326,7 @@ hello(internal, #client_hello{cookie = <<>>,
     State1 = prepare_flight(State0#state{negotiated_version = Version}),
     {State2, Actions} = send_handshake(VerifyRequest, State1),
     {Record, State} = next_record(State2),
-    next_event(hello, Record, State#state{tls_handshake_history = ssl_handshake:init_handshake_history()}, Actions);
+    next_event(?FUNCTION_NAME, Record, State#state{tls_handshake_history = ssl_handshake:init_handshake_history()}, Actions);
 hello(internal, #client_hello{cookie = Cookie} = Hello, #state{role = server,
 							       transport_cb = Transport,
 							       socket = Socket,
@@ -367,7 +367,7 @@ hello(internal, #hello_verify_request{cookie = Cookie}, #state{role = client,
 			      Session0#session{session_id = 
 						   Hello#client_hello.session_id}},
     {Record, State} = next_record(State3),
-    next_event(hello, Record, State, Actions);
+    next_event(?FUNCTION_NAME, Record, State, Actions);
 hello(internal, #server_hello{} = Hello,
       #state{connection_states = ConnectionStates0,
 	     negotiated_version = ReqVersion,
@@ -376,80 +376,80 @@ hello(internal, #server_hello{} = Hello,
 	     ssl_options = SslOptions} = State) ->
     case dtls_handshake:hello(Hello, SslOptions, ConnectionStates0, Renegotiation) of
 	#alert{} = Alert ->
-	    handle_own_alert(Alert, ReqVersion, hello, State);
+	    handle_own_alert(Alert, ReqVersion, ?FUNCTION_NAME, State);
 	{Version, NewId, ConnectionStates, ProtoExt, Protocol} ->
 	    ssl_connection:handle_session(Hello, 
 					  Version, NewId, ConnectionStates, ProtoExt, Protocol, State)
     end;
 hello(internal, {handshake, {#client_hello{cookie = <<>>} = Handshake, _}}, State) ->
     %% Initial hello should not be in handshake history
-    {next_state, hello, State, [{next_event, internal, Handshake}]};
+    {next_state, ?FUNCTION_NAME, State, [{next_event, internal, Handshake}]};
 hello(internal, {handshake, {#hello_verify_request{} = Handshake, _}}, State) ->
     %% hello_verify should not be in handshake history
-    {next_state, hello, State, [{next_event, internal, Handshake}]};
+    {next_state, ?FUNCTION_NAME, State, [{next_event, internal, Handshake}]};
 hello(info, Event, State) ->
-    handle_info(Event, hello, State);
+    handle_info(Event, ?FUNCTION_NAME, State);
 hello(state_timeout, Event, State) ->
-    handle_state_timeout(Event, hello, State);
+    handle_state_timeout(Event, ?FUNCTION_NAME, State);
 hello(Type, Event, State) ->
-    ssl_connection:hello(Type, Event, State, ?MODULE).
+    ssl_connection:?FUNCTION_NAME(Type, Event, State, ?MODULE).
 
 abbreviated(enter, _, State0) ->
     {State, Actions} = handle_flight_timer(State0),
     {keep_state, State, Actions}; 
 abbreviated(info, Event, State) ->
-    handle_info(Event, abbreviated, State);
+    handle_info(Event, ?FUNCTION_NAME, State);
 abbreviated(internal = Type, 
 	    #change_cipher_spec{type = <<1>>} = Event, 
 	    #state{connection_states = ConnectionStates0} = State) ->
     ConnectionStates1 = dtls_record:save_current_connection_state(ConnectionStates0, read),
     ConnectionStates = dtls_record:next_epoch(ConnectionStates1, read),
-    ssl_connection:abbreviated(Type, Event, State#state{connection_states = ConnectionStates}, ?MODULE);
+    ssl_connection:?FUNCTION_NAME(Type, Event, State#state{connection_states = ConnectionStates}, ?MODULE);
 abbreviated(internal = Type, #finished{} = Event, #state{connection_states = ConnectionStates} = State) ->
-    ssl_connection:abbreviated(Type, Event, 
-                               prepare_flight(State#state{connection_states = ConnectionStates,
-                                                          flight_state = connection}), ?MODULE);
+    ssl_connection:?FUNCTION_NAME(Type, Event, 
+                                  prepare_flight(State#state{connection_states = ConnectionStates,
+                                                             flight_state = connection}), ?MODULE);
 abbreviated(state_timeout, Event, State) ->
-    handle_state_timeout(Event, abbreviated, State);
+    handle_state_timeout(Event, ?FUNCTION_NAME, State);
 abbreviated(Type, Event, State) ->
-    ssl_connection:abbreviated(Type, Event, State, ?MODULE).
+    ssl_connection:?FUNCTION_NAME(Type, Event, State, ?MODULE).
 
 certify(enter, _, State0) ->
     {State, Actions} = handle_flight_timer(State0),
     {keep_state, State, Actions}; 
 certify(info, Event, State) ->
-    handle_info(Event, certify, State);
+    handle_info(Event, ?FUNCTION_NAME, State);
 certify(internal = Type, #server_hello_done{} = Event, State) ->
     ssl_connection:certify(Type, Event, prepare_flight(State), ?MODULE);
 certify(state_timeout, Event, State) ->
-    handle_state_timeout(Event, certify, State);
+    handle_state_timeout(Event, ?FUNCTION_NAME, State);
 certify(Type, Event, State) ->
-    ssl_connection:certify(Type, Event, State, ?MODULE).
+    ssl_connection:?FUNCTION_NAME(Type, Event, State, ?MODULE).
 
 cipher(enter, _, State0) ->
     {State, Actions} = handle_flight_timer(State0),
     {keep_state, State, Actions}; 
 cipher(info, Event, State) ->
-    handle_info(Event, cipher, State);
+    handle_info(Event, ?FUNCTION_NAME, State);
 cipher(internal = Type, #change_cipher_spec{type = <<1>>} = Event,  
        #state{connection_states = ConnectionStates0} = State) ->
     ConnectionStates1 = dtls_record:save_current_connection_state(ConnectionStates0, read),
     ConnectionStates = dtls_record:next_epoch(ConnectionStates1, read),
-    ssl_connection:cipher(Type, Event, State#state{connection_states = ConnectionStates}, ?MODULE);
+    ssl_connection:?FUNCTION_NAME(Type, Event, State#state{connection_states = ConnectionStates}, ?MODULE);
 cipher(internal = Type, #finished{} = Event, #state{connection_states = ConnectionStates} = State) ->
-    ssl_connection:cipher(Type, Event, 
-			  prepare_flight(State#state{connection_states = ConnectionStates,
-                                                     flight_state = connection}), 
-                          ?MODULE);
+    ssl_connection:?FUNCTION_NAME(Type, Event, 
+                                  prepare_flight(State#state{connection_states = ConnectionStates,
+                                                             flight_state = connection}), 
+                                  ?MODULE);
 cipher(state_timeout, Event, State) ->
-    handle_state_timeout(Event, cipher, State);
+    handle_state_timeout(Event, ?FUNCTION_NAME, State);
 cipher(Type, Event, State) ->
-     ssl_connection:cipher(Type, Event, State, ?MODULE).
+     ssl_connection:?FUNCTION_NAME(Type, Event, State, ?MODULE).
 
 connection(enter, _, State) ->
     {keep_state, State};     
 connection(info, Event, State) ->
-    handle_info(Event, connection, State);
+    handle_info(Event, ?FUNCTION_NAME, State);
 connection(internal, #hello_request{}, #state{host = Host, port = Port,
 				    session = #session{own_certificate = Cert} = Session0,
 				    session_cache = Cache, session_cache_cb = CacheCb,
@@ -476,15 +476,15 @@ connection(internal, #client_hello{}, #state{role = server, allow_renegotiate =
     Alert = ?ALERT_REC(?WARNING, ?NO_RENEGOTIATION),
     State1 = send_alert(Alert, State0),
     {Record, State} = ssl_connection:prepare_connection(State1, ?MODULE),
-    next_event(connection, Record, State);
+    next_event(?FUNCTION_NAME, Record, State);
 connection(Type, Event, State) ->
-     ssl_connection:connection(Type, Event, State, ?MODULE).
+     ssl_connection:?FUNCTION_NAME(Type, Event, State, ?MODULE).
 
 %%TODO does this make sense for DTLS ?
 downgrade(enter, _, State) ->
     {keep_state, State};
 downgrade(Type, Event, State) ->
-     ssl_connection:downgrade(Type, Event, State, ?MODULE).
+     ssl_connection:?FUNCTION_NAME(Type, Event, State, ?MODULE).
 
 %%--------------------------------------------------------------------
 %% Description: This function is called by a gen_fsm when it receives any
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 4e592c02ec..054e3b7ae3 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -1003,7 +1003,7 @@ validate_option(server_name_indication = Opt, Value) when is_list(Value) ->
 validate_option(server_name_indication, undefined = Value) ->
     Value;
 validate_option(server_name_indication, disable) ->
-    undefined;
+    disable;
 
 validate_option(sni_hosts, []) ->
     [];
diff --git a/lib/ssl/src/ssl_certificate.erl b/lib/ssl/src/ssl_certificate.erl
index 0dd5e5c5cf..a3333d35e9 100644
--- a/lib/ssl/src/ssl_certificate.erl
+++ b/lib/ssl/src/ssl_certificate.erl
@@ -138,13 +138,8 @@ validate(_, {bad_cert, _} = Reason, _) ->
     {fail, Reason};
 validate(_, valid, UserState) ->
     {valid, UserState};
-validate(Cert, valid_peer, UserState = {client, _,_, Hostname, _, _}) when Hostname =/= undefined ->
-    case public_key:pkix_verify_hostname(Cert, [{dns_id, Hostname}]) of
-        true ->
-            {valid, UserState};
-        false ->
-            {fail, {bad_cert, hostname_check_failed}}
-    end;
+validate(Cert, valid_peer, UserState = {client, _,_, Hostname, _, _}) when Hostname =/= disable ->
+    verify_hostname(Hostname, Cert, UserState);  
 validate(_, valid_peer, UserState) ->    
    {valid, UserState}.
 
@@ -337,3 +332,32 @@ new_trusteded_chain(DerCert, [_ | Rest]) ->
     new_trusteded_chain(DerCert, Rest);
 new_trusteded_chain(_, []) ->
     unknown_ca.
+
+verify_hostname({fallback, Hostname}, Cert, UserState) when is_list(Hostname) ->
+    case public_key:pkix_verify_hostname(Cert, [{dns_id, Hostname}]) of
+        true ->
+            {valid, UserState};
+        false ->
+            case public_key:pkix_verify_hostname(Cert, [{ip, Hostname}]) of
+                true ->
+                    {valid, UserState};
+                false ->
+                    {fail, {bad_cert, hostname_check_failed}}
+            end
+    end;
+
+verify_hostname({fallback, Hostname}, Cert, UserState) ->
+    case public_key:pkix_verify_hostname(Cert, [{ip, Hostname}]) of
+        true ->
+            {valid, UserState};
+        false ->
+            {fail, {bad_cert, hostname_check_failed}}
+    end;
+
+verify_hostname(Hostname, Cert, UserState) ->
+    case public_key:pkix_verify_hostname(Cert, [{dns_id, Hostname}]) of
+        true ->
+            {valid, UserState};
+        false ->
+            {fail, {bad_cert, hostname_check_failed}}
+    end.
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index b33ce63c32..6a1df3c56d 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -366,7 +366,7 @@ init({call, From}, {start, {Opts, EmOpts}, Timeout},
 	    {stop_and_reply, normal, {reply, From, {error, Error}}}
     end;
 init({call, From}, Msg, State, Connection) ->
-    handle_call(Msg, From, init, State, Connection);
+    handle_call(Msg, From, ?FUNCTION_NAME, State, Connection);
 init(_Type, _Event, _State, _Connection) ->
     {keep_state_and_data, [postpone]}.
 	
@@ -377,13 +377,13 @@ init(_Type, _Event, _State, _Connection) ->
 		   gen_statem:state_function_result().
 %%--------------------------------------------------------------------
 hello({call, From}, Msg, State, Connection) ->
-    handle_call(Msg, From, hello, State, Connection);
+    handle_call(Msg, From, ?FUNCTION_NAME, State, Connection);
 hello(internal, {common_client_hello, Type, ServerHelloExt}, State, Connection) ->
     do_server_hello(Type, ServerHelloExt, State, Connection);
 hello(info, Msg, State, _) ->
-    handle_info(Msg, hello, State);
+    handle_info(Msg, ?FUNCTION_NAME, State);
 hello(Type, Msg, State, Connection) ->
-    handle_common_event(Type, Msg, hello, State, Connection).
+    handle_common_event(Type, Msg, ?FUNCTION_NAME, State, Connection).
 
 %%--------------------------------------------------------------------
 -spec abbreviated(gen_statem:event_type(),
@@ -392,7 +392,7 @@ hello(Type, Msg, State, Connection) ->
 			 gen_statem:state_function_result().
 %%--------------------------------------------------------------------
 abbreviated({call, From}, Msg, State, Connection) ->
-    handle_call(Msg, From, abbreviated, State, Connection);
+    handle_call(Msg, From, ?FUNCTION_NAME, State, Connection);
 
 abbreviated(internal, #finished{verify_data = Data} = Finished,
 	    #state{role = server,
@@ -412,7 +412,7 @@ abbreviated(internal, #finished{verify_data = Data} = Finished,
 							      expecting_finished = false}, Connection),
 	    Connection:next_event(connection, Record, State);
 	#alert{} = Alert ->
-	    handle_own_alert(Alert, Version, abbreviated, State0)
+	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State0)
     end;
 
 abbreviated(internal, #finished{verify_data = Data} = Finished,
@@ -428,11 +428,11 @@ abbreviated(internal, #finished{verify_data = Data} = Finished,
 		ssl_record:set_server_verify_data(current_read, Data, ConnectionStates0),
 	    {State1, Actions} =
 		finalize_handshake(State0#state{connection_states = ConnectionStates1},
-				   abbreviated, Connection),
+				   ?FUNCTION_NAME, Connection),
 	    {Record, State} = prepare_connection(State1#state{expecting_finished = false}, Connection),
 	    Connection:next_event(connection, Record, State, Actions);
 	#alert{} = Alert ->
-	    handle_own_alert(Alert, Version, abbreviated, State0)
+	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State0)
     end;
 
 %% only allowed to send next_protocol message after change cipher spec
@@ -442,7 +442,7 @@ abbreviated(internal, #next_protocol{selected_protocol = SelectedProtocol},
 	    Connection) ->
     {Record, State} =
 	Connection:next_record(State0#state{negotiated_protocol = SelectedProtocol}),
-    Connection:next_event(abbreviated, Record, 
+    Connection:next_event(?FUNCTION_NAME, Record, 
 			  State#state{expecting_next_protocol_negotiation = false});
 abbreviated(internal, 
 	    #change_cipher_spec{type = <<1>>},  #state{connection_states = ConnectionStates0} =
@@ -451,11 +451,11 @@ abbreviated(internal,
 	ssl_record:activate_pending_connection_state(ConnectionStates0, read),
     {Record, State} = Connection:next_record(State0#state{connection_states = 
 							      ConnectionStates1}),
-    Connection:next_event(abbreviated, Record, State#state{expecting_finished = true});
+    Connection:next_event(?FUNCTION_NAME, Record, State#state{expecting_finished = true});
 abbreviated(info, Msg, State, _) ->
-    handle_info(Msg, abbreviated, State);
+    handle_info(Msg, ?FUNCTION_NAME, State);
 abbreviated(Type, Msg, State, Connection) ->
-    handle_common_event(Type, Msg, abbreviated, State, Connection).
+    handle_common_event(Type, Msg, ?FUNCTION_NAME, State, Connection).
  
 %%--------------------------------------------------------------------
 -spec certify(gen_statem:event_type(),
@@ -465,16 +465,16 @@ abbreviated(Type, Msg, State, Connection) ->
 		     gen_statem:state_function_result().
 %%--------------------------------------------------------------------
 certify({call, From}, Msg, State, Connection) ->
-    handle_call(Msg, From, certify, State, Connection);
+    handle_call(Msg, From, ?FUNCTION_NAME, State, Connection);
 certify(info, Msg, State, _) ->
-    handle_info(Msg, certify, State);
+    handle_info(Msg, ?FUNCTION_NAME, State);
 certify(internal, #certificate{asn1_certificates = []},
 	#state{role = server, negotiated_version = Version,
 	       ssl_options = #ssl_options{verify = verify_peer,
 					  fail_if_no_peer_cert = true}} =
 	    State, _) ->
     Alert =  ?ALERT_REC(?FATAL,?HANDSHAKE_FAILURE),
-    handle_own_alert(Alert, Version, certify, State);
+    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State);
 
 certify(internal, #certificate{asn1_certificates = []},
 	#state{role = server,
@@ -483,7 +483,7 @@ certify(internal, #certificate{asn1_certificates = []},
 	State0, Connection) ->
     {Record, State} = 
 	Connection:next_record(State0#state{client_certificate_requested = false}),
-    Connection:next_event(certify, Record, State);
+    Connection:next_event(?FUNCTION_NAME, Record, State);
 
 certify(internal, #certificate{},
 	#state{role = server,
@@ -491,22 +491,23 @@ certify(internal, #certificate{},
 	       ssl_options = #ssl_options{verify = verify_none}} =
 	    State, _) ->
     Alert =  ?ALERT_REC(?FATAL,?UNEXPECTED_MESSAGE, unrequested_certificate),
-    handle_own_alert(Alert, Version, certify, State);
+    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State);
 
 certify(internal, #certificate{} = Cert,
         #state{negotiated_version = Version,
 	       role = Role,
+               host = Host,
 	       cert_db = CertDbHandle,
 	       cert_db_ref = CertDbRef,
 	       crl_db = CRLDbInfo,
 	       ssl_options = Opts} = State, Connection) ->
     case ssl_handshake:certify(Cert, CertDbHandle, CertDbRef, 
-			       Opts, CRLDbInfo, Role) of
+			       Opts, CRLDbInfo, Role, Host) of
         {PeerCert, PublicKeyInfo} ->
 	    handle_peer_cert(Role, PeerCert, PublicKeyInfo,
 			     State#state{client_certificate_requested = false}, Connection);
 	#alert{} = Alert ->
-            handle_own_alert(Alert, Version, certify, State)
+            handle_own_alert(Alert, Version, ?FUNCTION_NAME, State)
     end;
 
 certify(internal, #server_key_exchange{exchange_keys = Keys},
@@ -538,7 +539,7 @@ certify(internal, #server_key_exchange{exchange_keys = Keys},
 				     Connection);
 		false ->
 		    handle_own_alert(?ALERT_REC(?FATAL, ?DECRYPT_ERROR),
-						Version, certify, State)
+						Version, ?FUNCTION_NAME, State)
 	    end
     end;
 
@@ -549,10 +550,10 @@ certify(internal, #certificate_request{} = CertRequest,
 	       negotiated_version = Version} = State0, Connection) ->
     case ssl_handshake:select_hashsign(CertRequest, Cert, SupportedHashSigns, ssl:tls_version(Version)) of
 	#alert {} = Alert ->
-	    handle_own_alert(Alert, Version, certify, State0);
+	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State0);
 	NegotiatedHashSign -> 
 	    {Record, State} = Connection:next_record(State0#state{client_certificate_requested = true}),
-	    Connection:next_event(certify, Record,
+	    Connection:next_event(?FUNCTION_NAME, Record,
 				  State#state{cert_hashsign_algorithm = NegotiatedHashSign})
     end;
 
@@ -568,7 +569,7 @@ certify(internal, #server_hello_done{},
   when Alg == psk ->
     case ssl_handshake:premaster_secret({Alg, PSKIdentity}, PSKLookup) of
 	#alert{} = Alert ->
-	    handle_own_alert(Alert, Version, certify, State0);
+	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State0);
 	PremasterSecret ->
 	    State = master_secret(PremasterSecret,
 				  State0#state{premaster_secret = PremasterSecret}),
@@ -589,7 +590,7 @@ certify(internal, #server_hello_done{},
     case ssl_handshake:premaster_secret({Alg, PSKIdentity}, PSKLookup, 
 					RSAPremasterSecret) of
 	#alert{} = Alert ->
-	    handle_own_alert(Alert, Version, certify, State0);
+	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State0);
 	PremasterSecret ->
 	    State = master_secret(PremasterSecret, 
 				  State0#state{premaster_secret = RSAPremasterSecret}),
@@ -609,7 +610,7 @@ certify(internal, #server_hello_done{},
 	    State = State0#state{connection_states = ConnectionStates},
 	    client_certify_and_key_exchange(State, Connection);
 	#alert{} = Alert ->
-	    handle_own_alert(Alert, Version, certify, State0)
+	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State0)
     end;
 
 %% Master secret is calculated from premaster_secret
@@ -627,7 +628,7 @@ certify(internal, #server_hello_done{},
 				 session = Session},
 	    client_certify_and_key_exchange(State, Connection);
 	#alert{} = Alert ->
-	    handle_own_alert(Alert, Version, certify, State0)
+	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State0)
     end;
 
 certify(internal = Type, #client_key_exchange{} = Msg,
@@ -636,7 +637,7 @@ certify(internal = Type, #client_key_exchange{} = Msg,
 	       ssl_options = #ssl_options{fail_if_no_peer_cert = true}} = State, 
 	Connection) ->
     %% We expect a certificate here
-    handle_common_event(Type, Msg, certify, State, Connection);
+    handle_common_event(Type, Msg, ?FUNCTION_NAME, State, Connection);
 
 certify(internal, #client_key_exchange{exchange_keys = Keys},
 	State = #state{key_algorithm = KeyAlg, negotiated_version = Version}, Connection) ->
@@ -645,11 +646,11 @@ certify(internal, #client_key_exchange{exchange_keys = Keys},
 				    State, Connection)
     catch
 	#alert{} = Alert ->
-	    handle_own_alert(Alert, Version, certify, State)
+	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State)
     end;
 
 certify(Type, Msg, State, Connection) ->
-    handle_common_event(Type, Msg, certify, State, Connection).
+    handle_common_event(Type, Msg, ?FUNCTION_NAME, State, Connection).
  
 %%--------------------------------------------------------------------
 -spec cipher(gen_statem:event_type(),
@@ -658,10 +659,10 @@ certify(Type, Msg, State, Connection) ->
 		    gen_statem:state_function_result().
 %%--------------------------------------------------------------------
 cipher({call, From}, Msg, State, Connection) ->
-    handle_call(Msg, From, cipher, State, Connection);
+    handle_call(Msg, From, ?FUNCTION_NAME, State, Connection);
 
 cipher(info, Msg, State, _) ->
-    handle_info(Msg, cipher, State);
+    handle_info(Msg, ?FUNCTION_NAME, State);
 
 cipher(internal, #certificate_verify{signature = Signature, 
 				     hashsign_algorithm = CertHashSign},
@@ -680,10 +681,10 @@ cipher(internal, #certificate_verify{signature = Signature,
 					  TLSVersion, HashSign, MasterSecret, Handshake) of
 	valid ->
 	    {Record, State} = Connection:next_record(State0),
-	    Connection:next_event(cipher, Record,
+	    Connection:next_event(?FUNCTION_NAME, Record,
 				  State#state{cert_hashsign_algorithm = HashSign});
 	#alert{} = Alert ->
-	    handle_own_alert(Alert, Version, cipher, State0)
+	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State0)
     end;
 
 %% client must send a next protocol message if we are expecting it
@@ -691,7 +692,7 @@ cipher(internal, #finished{},
        #state{role = server, expecting_next_protocol_negotiation = true,
 	      negotiated_protocol = undefined, negotiated_version = Version} = State0,
        _Connection) ->
-    handle_own_alert(?ALERT_REC(?FATAL,?UNEXPECTED_MESSAGE), Version, cipher, State0);
+    handle_own_alert(?ALERT_REC(?FATAL,?UNEXPECTED_MESSAGE), Version, ?FUNCTION_NAME, State0);
 
 cipher(internal, #finished{verify_data = Data} = Finished,
        #state{negotiated_version = Version,
@@ -701,6 +702,7 @@ cipher(internal, #finished{verify_data = Data} = Finished,
 	      expecting_finished = true,
 	      session = #session{master_secret = MasterSecret}
 	      = Session0,
+              ssl_options = SslOpts,
 	      connection_states = ConnectionStates0,
 	      tls_handshake_history = Handshake0} = State, Connection) ->
     case ssl_handshake:verify_connection(ssl:tls_version(Version), Finished,
@@ -708,11 +710,11 @@ cipher(internal, #finished{verify_data = Data} = Finished,
 					 get_current_prf(ConnectionStates0, read),
 					 MasterSecret, Handshake0) of
         verified ->
-	    Session = register_session(Role, Host, Port, Session0),
+	    Session = register_session(Role, host_id(Role, Host, SslOpts), Port, Session0),
 	    cipher_role(Role, Data, Session, 
 			State#state{expecting_finished = false}, Connection);
         #alert{} = Alert ->
-	    handle_own_alert(Alert, Version, cipher, State)
+	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State)
     end;
 
 %% only allowed to send next_protocol message after change cipher spec
@@ -722,7 +724,7 @@ cipher(internal, #next_protocol{selected_protocol = SelectedProtocol},
 	      expecting_finished = true} = State0, Connection) ->
     {Record, State} = 
 	Connection:next_record(State0#state{negotiated_protocol = SelectedProtocol}),
-    Connection:next_event(cipher, Record, 
+    Connection:next_event(?FUNCTION_NAME, Record, 
 			  State#state{expecting_next_protocol_negotiation = false});
 cipher(internal, #change_cipher_spec{type = <<1>>},  #state{connection_states = ConnectionStates0} =
 	   State0, Connection) ->
@@ -730,9 +732,9 @@ cipher(internal, #change_cipher_spec{type = <<1>>},  #state{connection_states =
 	ssl_record:activate_pending_connection_state(ConnectionStates0, read),
     {Record, State} = Connection:next_record(State0#state{connection_states = 
 							      ConnectionStates1}),
-    Connection:next_event(cipher, Record, State#state{expecting_finished = true});
+    Connection:next_event(?FUNCTION_NAME, Record, State#state{expecting_finished = true});
 cipher(Type, Msg, State, Connection) ->
-    handle_common_event(Type, Msg, cipher, State, Connection).
+    handle_common_event(Type, Msg, ?FUNCTION_NAME, State, Connection).
 
 %%--------------------------------------------------------------------
 -spec connection(gen_statem:event_type(), term(), 
@@ -747,7 +749,7 @@ connection({call, From}, {application_data, Data},
      try
 	 write_application_data(Data, From, State)
      catch throw:Error ->
-	     hibernate_after(connection, State, [{reply, From, Error}])
+	     hibernate_after(?FUNCTION_NAME, State, [{reply, From, Error}])
      end;
 connection({call, RecvFrom}, {recv, N, Timeout},  
 	   #state{protocol_cb = Connection,  socket_options =
@@ -755,34 +757,34 @@ connection({call, RecvFrom}, {recv, N, Timeout},
     Timer = start_or_recv_cancel_timer(Timeout, RecvFrom),
     Connection:passive_receive(State0#state{bytes_to_read = N,
 					    start_or_recv_from = RecvFrom, 
-					    timer = Timer}, connection);
+					    timer = Timer}, ?FUNCTION_NAME);
 connection({call, From}, renegotiate, #state{protocol_cb = Connection} = State, 
 	   Connection) ->
     Connection:renegotiate(State#state{renegotiation = {true, From}}, []);
 connection({call, From}, peer_certificate, 
 	   #state{session = #session{peer_certificate = Cert}} = State, _) ->
-    hibernate_after(connection, State, [{reply, From,  {ok, Cert}}]); 
+    hibernate_after(?FUNCTION_NAME, State, [{reply, From,  {ok, Cert}}]); 
 connection({call, From}, {connection_information, true}, State, _) ->
     Info = connection_info(State) ++ security_info(State),
-    hibernate_after(connection, State, [{reply, From, {ok, Info}}]);
+    hibernate_after(?FUNCTION_NAME, State, [{reply, From, {ok, Info}}]);
 connection({call, From}, {connection_information, false}, State, _) ->
     Info = connection_info(State),
-    hibernate_after(connection, State, [{reply, From, {ok, Info}}]);
+    hibernate_after(?FUNCTION_NAME, State, [{reply, From, {ok, Info}}]);
 connection({call, From}, negotiated_protocol, 
 	   #state{negotiated_protocol = undefined} = State, _) ->
-    hibernate_after(connection, State, [{reply, From, {error, protocol_not_negotiated}}]);
+    hibernate_after(?FUNCTION_NAME, State, [{reply, From, {error, protocol_not_negotiated}}]);
 connection({call, From}, negotiated_protocol, 
 	   #state{negotiated_protocol = SelectedProtocol} = State, _) ->
-    hibernate_after(connection, State,
+    hibernate_after(?FUNCTION_NAME, State,
 		    [{reply, From, {ok, SelectedProtocol}}]);
 connection({call, From}, Msg, State, Connection) ->
-    handle_call(Msg, From, connection, State, Connection);
+    handle_call(Msg, From, ?FUNCTION_NAME, State, Connection);
 connection(info, Msg, State, _) ->
-    handle_info(Msg, connection, State);
+    handle_info(Msg, ?FUNCTION_NAME, State);
 connection(internal, {recv, _}, State, Connection) ->
-    Connection:passive_receive(State, connection);
+    Connection:passive_receive(State, ?FUNCTION_NAME);
 connection(Type, Msg, State, Connection) ->
-    handle_common_event(Type, Msg, connection, State, Connection).
+    handle_common_event(Type, Msg, ?FUNCTION_NAME, State, Connection).
 
 %%--------------------------------------------------------------------
 -spec downgrade(gen_statem:event_type(), term(), 
@@ -800,7 +802,7 @@ downgrade(timeout, downgrade, #state{downgrade = {_, From}} = State, _) ->
     gen_statem:reply(From, {error, timeout}),
     {stop, normal, State};
 downgrade(Type, Event, State, Connection) ->
-    handle_common_event(Type, Event, downgrade, State, Connection).
+    handle_common_event(Type, Event, ?FUNCTION_NAME, State, Connection).
 
 %%--------------------------------------------------------------------
 %% Event handling functions called by state functions to handle
@@ -2113,6 +2115,11 @@ register_session(server, _, Port, #session{is_resumable = new} = Session0) ->
 register_session(_, _, _, Session) ->
     Session. %% Already registered
 
+host_id(client, _Host, #ssl_options{server_name_indication = Hostname}) when is_list(Hostname) ->
+    Hostname;
+host_id(_, Host, _) ->
+    Host.
+
 handle_new_session(NewId, CipherSuite, Compression, 
 		   #state{session = Session0,
 			  protocol_cb = Connection} = State0) ->
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index b1661624b5..0ee9ee3322 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -50,7 +50,7 @@
 	 finished/5,  next_protocol/1]).
 
 %% Handle handshake messages
--export([certify/6, client_certificate_verify/6, certificate_verify/6, verify_signature/5,
+-export([certify/7, client_certificate_verify/6, certificate_verify/6, verify_signature/5,
 	 master_secret/4, server_key_exchange_hash/2, verify_connection/6,
 	 init_handshake_history/0, update_handshake_history/3, verify_server_key/5
 	]).
@@ -389,21 +389,21 @@ verify_signature(_, Hash, {HashAlgo, _SignAlg}, Signature,
 
 %%--------------------------------------------------------------------
 -spec certify(#certificate{}, db_handle(), certdb_ref(), #ssl_options{}, term(),
-	      client | server) ->  {der_cert(), public_key_info()} | #alert{}.
+	      client | server, inet:hostname() | inet:ip_address()) ->  {der_cert(), public_key_info()} | #alert{}.
 %%
 %% Description: Handles a certificate handshake message
 %%--------------------------------------------------------------------
 certify(#certificate{asn1_certificates = ASN1Certs}, CertDbHandle, CertDbRef,
-        Opts, CRLDbHandle, Role) ->    
+        Opts, CRLDbHandle, Role, Host) ->    
 
+    ServerName = server_name(Opts#ssl_options.server_name_indication, Host, Role),
     [PeerCert | _] = ASN1Certs,       
     try
 	{TrustedCert, CertPath}  =
 	    ssl_certificate:trusted_cert_and_path(ASN1Certs, CertDbHandle, CertDbRef,  
                                                   Opts#ssl_options.partial_chain),
         ValidationFunAndState = validation_fun_and_state(Opts#ssl_options.verify_fun, Role, 
-                                                         CertDbHandle, CertDbRef,  
-                                                         Opts#ssl_options.server_name_indication,
+                                                         CertDbHandle, CertDbRef, ServerName,
                                                          Opts#ssl_options.crl_check, CRLDbHandle, CertPath),
 	case public_key:pkix_path_validation(TrustedCert,
 					     CertPath,
@@ -1528,6 +1528,8 @@ select_shared_curve([Curve | Rest], Curves) ->
 
 sni(undefined) ->
     undefined;
+sni(disable) ->
+    undefined;
 sni(Hostname) ->
     #sni{hostname = Hostname}.
 
@@ -2353,3 +2355,9 @@ available_signature_algs(#hash_sign_algos{hash_sign_algos = ClientHashSigns}, Su
 available_signature_algs(_, _, _, _) -> 
     undefined.
 
+server_name(_, _, server) ->
+    undefined; %% Not interesting to check your own name.
+server_name(undefined, Host, client) ->
+    {fallback, Host}; %% Fallback to Host argument to connect
+server_name(SNI, _, client) ->
+    SNI. %% If Server Name Indication is available
diff --git a/lib/ssl/src/tls_connection.erl b/lib/ssl/src/tls_connection.erl
index 7861287a22..b566551143 100644
--- a/lib/ssl/src/tls_connection.erl
+++ b/lib/ssl/src/tls_connection.erl
@@ -241,7 +241,7 @@ init({call, From}, {start, Timeout},
     {Record, State} = next_record(State1),
     next_event(hello, Record, State);
 init(Type, Event, State) ->
-    gen_handshake(ssl_connection, init, Type, Event, State).
+    gen_handshake(ssl_connection, ?FUNCTION_NAME, Type, Event, State).
  
 %%--------------------------------------------------------------------
 -spec error(gen_statem:event_type(),
@@ -252,7 +252,7 @@ init(Type, Event, State) ->
 error({call, From}, {start, _Timeout}, {Error, State}) ->
     {stop_and_reply, normal, {reply, From, {error, Error}}, State};
 error({call, From}, Msg, State) ->
-    handle_call(Msg, From, error, State);
+    handle_call(Msg, From, ?FUNCTION_NAME, State);
 error(_, _, _) ->
      {keep_state_and_data, [postpone]}.
  
@@ -305,36 +305,36 @@ hello(internal, #server_hello{} = Hello,
 					  Version, NewId, ConnectionStates, ProtoExt, Protocol, State)
     end;
 hello(info, Event, State) ->
-    gen_info(Event, hello, State);
+    gen_info(Event, ?FUNCTION_NAME, State);
 hello(Type, Event, State) ->
-    gen_handshake(ssl_connection, hello, Type, Event, State).
+    gen_handshake(ssl_connection, ?FUNCTION_NAME, Type, Event, State).
 
 %%--------------------------------------------------------------------
 -spec abbreviated(gen_statem:event_type(), term(), #state{}) ->
 			 gen_statem:state_function_result().
 %%--------------------------------------------------------------------
 abbreviated(info, Event, State) ->
-    gen_info(Event, abbreviated, State);
+    gen_info(Event, ?FUNCTION_NAME, State);
 abbreviated(Type, Event, State) ->
-    gen_handshake(ssl_connection, abbreviated, Type, Event, State).
+    gen_handshake(ssl_connection, ?FUNCTION_NAME, Type, Event, State).
 
 %%--------------------------------------------------------------------
 -spec certify(gen_statem:event_type(), term(), #state{}) ->
 		     gen_statem:state_function_result().
 %%--------------------------------------------------------------------
 certify(info, Event, State) ->
-    gen_info(Event, certify, State);
+    gen_info(Event, ?FUNCTION_NAME, State);
 certify(Type, Event, State) ->
-    gen_handshake(ssl_connection, certify, Type, Event, State).
+    gen_handshake(ssl_connection, ?FUNCTION_NAME, Type, Event, State).
 
 %%--------------------------------------------------------------------
 -spec cipher(gen_statem:event_type(), term(), #state{}) ->
 		    gen_statem:state_function_result().
 %%--------------------------------------------------------------------
 cipher(info, Event, State) ->
-    gen_info(Event, cipher, State);
+    gen_info(Event, ?FUNCTION_NAME, State);
 cipher(Type, Event, State) ->
-     gen_handshake(ssl_connection, cipher, Type, Event, State).
+     gen_handshake(ssl_connection, ?FUNCTION_NAME, Type, Event, State).
 
 %%--------------------------------------------------------------------
 -spec connection(gen_statem:event_type(),  
@@ -342,7 +342,7 @@ cipher(Type, Event, State) ->
 			gen_statem:state_function_result().
 %%--------------------------------------------------------------------
 connection(info, Event, State) ->
-    gen_info(Event, connection, State);
+    gen_info(Event, ?FUNCTION_NAME, State);
 connection(internal, #hello_request{},
 	   #state{role = client, host = Host, port = Port,
 		  session = #session{own_certificate = Cert} = Session0,
@@ -374,16 +374,16 @@ connection(internal, #client_hello{},
     Alert = ?ALERT_REC(?WARNING, ?NO_RENEGOTIATION),
     State1 = send_alert(Alert, State0),
     {Record, State} = ssl_connection:prepare_connection(State1, ?MODULE),
-    next_event(connection, Record, State);
+    next_event(?FUNCTION_NAME, Record, State);
 connection(Type, Event, State) ->
-    ssl_connection:connection(Type, Event, State, ?MODULE).
+    ssl_connection:?FUNCTION_NAME(Type, Event, State, ?MODULE).
 
 %%--------------------------------------------------------------------
 -spec downgrade(gen_statem:event_type(), term(), #state{}) ->
 		       gen_statem:state_function_result().
 %%--------------------------------------------------------------------
 downgrade(Type, Event, State) ->
-     ssl_connection:downgrade(Type, Event, State, ?MODULE).
+     ssl_connection:?FUNCTION_NAME(Type, Event, State, ?MODULE).
 
 %%--------------------------------------------------------------------
 %% Event handling functions called by state functions to handle
diff --git a/lib/ssl/test/ssl_sni_SUITE.erl b/lib/ssl/test/ssl_sni_SUITE.erl
index 03676cb828..7e78c41444 100644
--- a/lib/ssl/test/ssl_sni_SUITE.erl
+++ b/lib/ssl/test/ssl_sni_SUITE.erl
@@ -25,6 +25,8 @@
 
 -include_lib("common_test/include/ct.hrl").
 -include_lib("public_key/include/public_key.hrl").
+-include_lib("kernel/include/inet.hrl").
+
 
 %%--------------------------------------------------------------------
 %% Common Test interface functions -----------------------------------
@@ -55,7 +57,11 @@ sni_tests() ->
      sni_no_match,
      no_sni_header_fun, 
      sni_match_fun, 
-     sni_no_match_fun].
+     sni_no_match_fun,
+     dns_name,
+     ip_fallback,
+     no_ip_fallback,
+     dns_name_reuse].
 
 init_per_suite(Config0) ->
     catch crypto:stop(),
@@ -82,6 +88,13 @@ end_per_suite(_) ->
     ssl:stop(),
     application:stop(crypto).
 
+init_per_testcase(TestCase, Config) when TestCase == ip_fallback;
+                                         TestCase == no_ip_fallback;
+                                         TestCase == dns_name_reuse ->
+    ssl_test_lib:ct_log_supported_protocol_versions(Config),
+    ct:log("Ciphers: ~p~n ", [ ssl:cipher_suites()]),
+    ct:timetrap({seconds, 20}),
+    Config;
 init_per_testcase(_TestCase, Config) ->
     ssl_test_lib:ct_log_supported_protocol_versions(Config),
     ct:log("Ciphers: ~p~n ", [ ssl:cipher_suites()]),
@@ -112,7 +125,119 @@ sni_no_match(Config) ->
 sni_no_match_fun(Config) ->
     run_sni_fun_handshake(Config, "c.server", undefined, "server Peer cert").
 
+dns_name(Config) ->
+    Hostname = "OTP.test.server",
+    #{server_config := ServerConf,
+      client_config := ClientConf} = public_key:pkix_test_data(#{server_chain => 
+                                                                     #{root => [{key, ssl_test_lib:hardcode_rsa_key(1)}],
+                                                                       intermediates => [[{key, ssl_test_lib:hardcode_rsa_key(2)}]],
+                                                                       peer => [{extensions,  [#'Extension'{extnID = 
+                                                                                                                ?'id-ce-subjectAltName',
+                                                                                                            extnValue = [{dNSName, Hostname}],
+                                                                                                            critical = false}]},
+                                                                                {key, ssl_test_lib:hardcode_rsa_key(3)}]},
+                                                                 client_chain => 
+                                                                     #{root => [{key, ssl_test_lib:hardcode_rsa_key(4)}],
+                                                                       intermediates => [[{key, ssl_test_lib:hardcode_rsa_key(5)}]],
+                                                                       peer => [{key, ssl_test_lib:hardcode_rsa_key(6)}]}}),
+    unsuccessfull_connect(ServerConf, [{verify, verify_peer} | ClientConf], undefined, Config),
+    successfull_connect(ServerConf, [{verify, verify_peer}, {server_name_indication, Hostname} | ClientConf], undefined, Config),
+    unsuccessfull_connect(ServerConf, [{verify, verify_peer}, {server_name_indication, "foo"} | ClientConf], undefined, Config),
+    successfull_connect(ServerConf, [{verify, verify_peer}, {server_name_indication, disable} | ClientConf], undefined, Config).
+
+ip_fallback(Config) ->
+    Hostname = net_adm:localhost(),
+    {ok, #hostent{h_addr_list = [IP |_]}} = inet:gethostbyname(net_adm:localhost()),
+    IPStr = tuple_to_list(IP),
+    #{server_config := ServerConf,
+      client_config := ClientConf} = public_key:pkix_test_data(#{server_chain => 
+                                                                     #{root => [{key, ssl_test_lib:hardcode_rsa_key(1)}],
+                                                                       intermediates => [[{key, ssl_test_lib:hardcode_rsa_key(2)}]],
+                                                                       peer => [{extensions, [#'Extension'{extnID = 
+                                                                                                               ?'id-ce-subjectAltName',
+                                                                                                           extnValue = [{dNSName, Hostname},
+                                                                                                                        {iPAddress, IPStr}],
+                                                                                                           critical = false}]},
+                                                                                {key, ssl_test_lib:hardcode_rsa_key(3)}]},
+                                                                 client_chain => 
+                                                                     #{root => [{key, ssl_test_lib:hardcode_rsa_key(4)}],
+                                                                       intermediates => [[{key, ssl_test_lib:hardcode_rsa_key(5)}]],
+                                                                       peer => [{key, ssl_test_lib:hardcode_rsa_key(6)}]}}),
+    successfull_connect(ServerConf, [{verify, verify_peer} | ClientConf], Hostname, Config),
+    successfull_connect(ServerConf, [{verify, verify_peer} | ClientConf], IP, Config).
+
+no_ip_fallback(Config) ->
+    Hostname = net_adm:localhost(),
+    {ok, #hostent{h_addr_list = [IP |_]}} = inet:gethostbyname(net_adm:localhost()),
+    #{server_config := ServerConf,
+      client_config := ClientConf} = public_key:pkix_test_data(#{server_chain => 
+                                                                     #{root => [{key, ssl_test_lib:hardcode_rsa_key(1)}],
+                                                                       intermediates => [[{key, ssl_test_lib:hardcode_rsa_key(2)}]],
+                                                                       peer => [{extensions, [#'Extension'{extnID = 
+                                                                                                               ?'id-ce-subjectAltName',
+                                                                                                           extnValue = [{dNSName, Hostname}],
+                                                                                                           critical = false}]},
+                                                                                {key, ssl_test_lib:hardcode_rsa_key(3)}
+                                                                               ]},
+                                                                 client_chain => 
+                                                                     #{root => [{key, ssl_test_lib:hardcode_rsa_key(4)}],
+                                                                       intermediates => [[{key, ssl_test_lib:hardcode_rsa_key(5)}]],
+                                                                       peer => [{key, ssl_test_lib:hardcode_rsa_key(6)}]}}),
+    successfull_connect(ServerConf, [{verify, verify_peer} | ClientConf], Hostname, Config),
+    unsuccessfull_connect(ServerConf, [{verify, verify_peer} | ClientConf], IP, Config).
 
+dns_name_reuse(Config) ->
+    SNIHostname = "OTP.test.server",
+    #{server_config := ServerConf,
+      client_config := ClientConf} = public_key:pkix_test_data(#{server_chain => 
+                                                                     #{root => [{key, ssl_test_lib:hardcode_rsa_key(1)}],
+                                                                       intermediates => [[{key, ssl_test_lib:hardcode_rsa_key(2)}]],
+                                                                       peer => [{extensions,  [#'Extension'{extnID = 
+                                                                                                                ?'id-ce-subjectAltName',
+                                                                                                            extnValue = [{dNSName, SNIHostname}],
+                                                                                                            critical = false}
+                                                                                              ]},
+                                                                                {key, ssl_test_lib:hardcode_rsa_key(3)}
+                                                                               ]},
+                                                                 client_chain => 
+                                                                     #{root => [{key, ssl_test_lib:hardcode_rsa_key(4)}],
+                                                                       intermediates => [[{key, ssl_test_lib:hardcode_rsa_key(5)}]],
+                                                                       peer => [{key, ssl_test_lib:hardcode_rsa_key(6)}]}}),
+    
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+  
+    unsuccessfull_connect(ServerConf, [{verify, verify_peer} | ClientConf], undefined, Config),
+    
+    Server = 
+	ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
+				   {from, self()},
+				   {mfa, {ssl_test_lib, session_info_result, []}},
+				   {options, ServerConf}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client0 =
+	ssl_test_lib:start_client([{node, ClientNode}, 
+                                   {port, Port}, {host, Hostname},
+				   {mfa, {ssl_test_lib, no_result, []}},
+                                   {from, self()}, {options, [{verify, verify_peer}, 
+                                                              {server_name_indication, SNIHostname} | ClientConf]}]),   
+    receive
+        {Server, _} ->
+            ok
+    end,
+    
+    Server ! {listen, {mfa, {ssl_test_lib, no_result, []}}},
+    
+    %% Make sure session is registered
+    ct:sleep(1000),
+    
+    Client1 =
+	ssl_test_lib:start_client_error([{node, ClientNode},
+                                         {port, Port}, {host, Hostname},
+                                         {mfa, {ssl_test_lib, session_info_result, []}},
+                                         {from, self()},  {options, [{verify, verify_peer} | ClientConf]}]),
+    
+    ssl_test_lib:check_result(Client1, {error, {tls_alert, "handshake failure"}}),
+    ssl_test_lib:close(Client0).
 %%--------------------------------------------------------------------
 %% Internal Functions ------------------------------------------------
 %%--------------------------------------------------------------------
@@ -217,3 +342,37 @@ run_handshake(Config, SNIHostname, ExpectedSNIHostname, ExpectedCN) ->
     ssl_test_lib:check_result(Server, ExpectedSNIHostname, Client, ExpectedCN),
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client).
+
+successfull_connect(ServerOptions, ClientOptions, Hostname0, Config) ->  
+    {ClientNode, ServerNode, Hostname1} = ssl_test_lib:run_where(Config),
+    Hostname = host_name(Hostname0, Hostname1),
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+                                        {from, self()}, {mfa, {ssl_test_lib, send_recv_result_active, []}},
+                                        {options, ServerOptions}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+                                        {host, Hostname}, {from, self()},
+                                        {mfa, {ssl_test_lib, send_recv_result_active, []}},
+                                        {options, ClientOptions}]),
+    ssl_test_lib:check_result(Server, ok, Client, ok),
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close(Client).
+
+unsuccessfull_connect(ServerOptions, ClientOptions, Hostname0, Config) ->
+    {ClientNode, ServerNode, Hostname1} = ssl_test_lib:run_where(Config),
+    Hostname = host_name(Hostname0, Hostname1),
+    Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
+					      {from, self()},
+					      {options, ServerOptions}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client_error([{node, ClientNode}, {port, Port},
+					      {host, Hostname},
+					      {from, self()}, 
+					      {options, ClientOptions}]),
+    
+    ssl_test_lib:check_result(Server, {error, {tls_alert, "handshake failure"}},
+			      Client, {error, {tls_alert, "handshake failure"}}).
+host_name(undefined, Hostname) ->
+    Hostname;
+host_name(Hostname, _) ->
+    Hostname.
diff --git a/lib/ssl/test/x509_test.erl b/lib/ssl/test/x509_test.erl
index 031fad1216..fea01efdaf 100644
--- a/lib/ssl/test/x509_test.erl
+++ b/lib/ssl/test/x509_test.erl
@@ -64,15 +64,12 @@ do_gen_pem_config_files(Config, CertFile, KeyFile, CAFile) ->
 cert_entry(Cert) ->
     {'Certificate', Cert, not_encrypted}.
 
-key_entry(Key = #'RSAPrivateKey'{}) ->
-    Der = public_key:der_encode('RSAPrivateKey', Key),
-    {'RSAPrivateKey', Der, not_encrypted};
-key_entry(Key = #'DSAPrivateKey'{}) ->
-    Der =  public_key:der_encode('DSAPrivateKey', Key),
-    {'DSAPrivateKey', Der, not_encrypted};
-key_entry(Key = #'ECPrivateKey'{}) ->
-    Der =  public_key:der_encode('ECPrivateKey', Key),
-    {'ECPrivateKey', Der, not_encrypted}.
+key_entry({'RSAPrivateKey', DERKey}) ->
+    {'RSAPrivateKey', DERKey, not_encrypted};
+key_entry({'DSAPrivateKey', DERKey}) ->
+    {'DSAPrivateKey', DERKey, not_encrypted};
+key_entry({'ECPrivateKey', DERKey}) ->
+    {'ECPrivateKey', DERKey, not_encrypted}.
 
 ca_entries(CAs) ->
     [{'Certificate', CACert, not_encrypted} || CACert <- CAs].