Merge branch 'ingela/ssl/test-data'

* ingela/ssl/test-data:
  ssl: Rewrite test data generation

4 files changed, 268 insertions, 412 deletions

diff --git a/lib/ssl/test/ssl_ECC_SUITE.erl b/lib/ssl/test/ssl_ECC_SUITE.erl
index b77f909dfa..b05e2c74db 100644
--- a/lib/ssl/test/ssl_ECC_SUITE.erl
+++ b/lib/ssl/test/ssl_ECC_SUITE.erl
@@ -91,11 +91,7 @@ init_per_suite(Config0) ->
     end_per_suite(Config0),
     try crypto:start() of
 	ok ->
-	    %% make rsa certs using oppenssl
-	    Config1 = ssl_test_lib:make_rsa_cert(Config0),
-	    Config2 = ssl_test_lib:make_ecdsa_cert(Config1),
-            Config = ssl_test_lib:make_ecdh_rsa_cert(Config2),
-	    ssl_test_lib:cert_options(Config)
+           Config0
     catch _:_ ->
 	    {skip, "Crypto did not start"}
     end.
diff --git a/lib/ssl/test/ssl_certificate_verify_SUITE.erl b/lib/ssl/test/ssl_certificate_verify_SUITE.erl
index 66b0c09b73..45bcdf1f78 100644
--- a/lib/ssl/test/ssl_certificate_verify_SUITE.erl
+++ b/lib/ssl/test/ssl_certificate_verify_SUITE.erl
@@ -74,7 +74,7 @@ tests() ->
      cert_expired,
      invalid_signature_client,
      invalid_signature_server,
-     extended_key_usage_verify_client,
+     extended_key_usage_verify_both,
      extended_key_usage_verify_server,
      critical_extension_verify_client,
      critical_extension_verify_server,
@@ -88,18 +88,14 @@ error_handling_tests()->
      unknown_server_ca_accept_verify_peer,
      unknown_server_ca_accept_backwardscompatibility,
      no_authority_key_identifier,
-     no_authority_key_identifier_and_nonstandard_encoding].
+     no_authority_key_identifier_keyEncipherment].
 
-init_per_suite(Config0) ->
+init_per_suite(Config) ->
     catch crypto:stop(),
     try crypto:start() of
 	ok ->
-            ssl_test_lib:clean_start(),
-	    %% make rsa certs using oppenssl
-	    {ok, _} = make_certs:all(proplists:get_value(data_dir, Config0),
-				     proplists:get_value(priv_dir, Config0)),
-	    Config = ssl_test_lib:make_dsa_cert(Config0),
-	    ssl_test_lib:cert_options(Config)
+            ssl_test_lib:clean_start(), 
+            ssl_test_lib:make_rsa_cert(Config)            
     catch _:_ ->
 	    {skip, "Crypto did not start"}
     end.
@@ -108,49 +104,39 @@ end_per_suite(_Config) ->
     ssl:stop(),
     application:stop(crypto).
 
-init_per_group(tls, Config) ->
+init_per_group(tls, Config0) ->
     Version = tls_record:protocol_version(tls_record:highest_protocol_version([])),
     ssl:stop(),
     application:load(ssl),
     application:set_env(ssl, protocol_version, Version),
-    application:set_env(ssl, bypass_pem_cache, Version),
     ssl:start(),
-    NewConfig = proplists:delete(protocol, Config),
-    [{protocol, tls}, {version, tls_record:protocol_version(Version)} | NewConfig];
+    Config = proplists:delete(protocol, Config0),
+    [{protocol, tls}, {version, tls_record:protocol_version(Version)} | Config];
 
-init_per_group(dtls, Config) ->
+init_per_group(dtls, Config0) ->
     Version = dtls_record:protocol_version(dtls_record:highest_protocol_version([])),
     ssl:stop(),
     application:load(ssl),
     application:set_env(ssl, protocol_version, Version),
-    application:set_env(ssl, bypass_pem_cache, Version),
     ssl:start(),
-    NewConfig = proplists:delete(protocol_opts, proplists:delete(protocol, Config)),
-    [{protocol, dtls}, {protocol_opts, [{protocol, dtls}]}, {version, dtls_record:protocol_version(Version)} | NewConfig];
+    Config = proplists:delete(protocol_opts, proplists:delete(protocol, Config0)),
+    [{protocol, dtls}, {protocol_opts, [{protocol, dtls}]}, {version, dtls_record:protocol_version(Version)} | Config];
 
 init_per_group(active, Config) ->
-    [{active, true}, {receive_function, send_recv_result_active}  | Config];
+    [{active, true}, {receive_function, send_recv_result_active} | Config];
 init_per_group(active_once, Config) ->
-    [{active, once}, {receive_function, send_recv_result_active_once}  | Config];
+    [{active, once}, {receive_function, send_recv_result_active_once} | Config];
 init_per_group(passive, Config) ->
-    [{active, false}, {receive_function, send_recv_result} |  Config];
+    [{active, false}, {receive_function, send_recv_result} | Config];
+init_per_group(error_handling, Config) ->
+    [{active, false}, {receive_function, send_recv_result} | Config];
+
 init_per_group(_, Config) ->
     Config.
 
 end_per_group(_GroupName, Config) ->
     Config.
 
-init_per_testcase(TestCase, Config) when TestCase == cert_expired;
-					 TestCase == invalid_signature_client;
-					 TestCase == invalid_signature_server;
-					 TestCase == extended_key_usage_verify_none;
-					 TestCase == extended_key_usage_verify_peer;
-					 TestCase == critical_extension_verify_none;
-					 TestCase == critical_extension_verify_peer;
-					 TestCase == no_authority_key_identifier;
-					 TestCase == no_authority_key_identifier_and_nonstandard_encoding->
-    ssl:clear_pem_cache(),
-    init_per_testcase(common, Config);
 init_per_testcase(_TestCase, Config) ->
     ssl:stop(),
     ssl:start(),
@@ -168,23 +154,23 @@ end_per_testcase(_TestCase, Config) ->
 verify_peer() ->
     [{doc,"Test option verify_peer"}].
 verify_peer(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_verification_opts, Config),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
     Active = proplists:get_value(active, Config),
     ReceiveFunction =  proplists:get_value(receive_function, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
 					{from, self()},
-			   {mfa, {ssl_test_lib, ReceiveFunction, []}},
-			   {options, [{active, Active}, {verify, verify_peer}
-				      | ServerOpts]}]),
+                                        {mfa, {ssl_test_lib, ReceiveFunction, []}},
+                                        {options, [{active, Active}, {verify, verify_peer}
+                                                   | ServerOpts]}]),
     Port  = ssl_test_lib:inet_port(Server),
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					{host, Hostname},
-			   {from, self()},
-			   {mfa, {ssl_test_lib, ReceiveFunction, []}},
-			   {options, [{active, Active} | ClientOpts]}]),
-
+                                        {from, self()},
+                                        {mfa, {ssl_test_lib, ReceiveFunction, []}},
+                                        {options, [{active, Active}, {verify, verify_peer} | ClientOpts]}]),
+    
     ssl_test_lib:check_result(Server, ok, Client, ok),
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client).
@@ -194,23 +180,24 @@ verify_none() ->
     [{doc,"Test option verify_none"}].
 
 verify_none(Config) when is_list(Config) ->
-    ClientOpts =  ssl_test_lib:ssl_options(client_verification_opts, Config),
-    ServerOpts =  ssl_test_lib:ssl_options(server_verification_opts, Config),
+    ClientOpts =  ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts =  ssl_test_lib:ssl_options(server_rsa_opts, Config),
     Active = proplists:get_value(active, Config),
     ReceiveFunction =  proplists:get_value(receive_function, Config),
 
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
 					{from, self()},
-			   {mfa, {ssl_test_lib, ReceiveFunction, []}},
-			   {options, [{active, Active}, {verify, verify_none}
-				      | ServerOpts]}]),
+                                        {mfa, {ssl_test_lib, ReceiveFunction, []}},
+                                        {options, [{active, Active}, {verify, verify_none}
+                                                   | ServerOpts]}]),
     Port  = ssl_test_lib:inet_port(Server),
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					{host, Hostname},
-			   {from, self()},
-			   {mfa, {ssl_test_lib, ReceiveFunction, []}},
-			   {options, [{active, Active} | ClientOpts]}]),
+                                        {from, self()},
+                                        {mfa, {ssl_test_lib, ReceiveFunction, []}},
+                                        {options, [{active, Active}, 
+                                                   {verify, verify_none} | ClientOpts]}]),
 
     ssl_test_lib:check_result(Server, ok, Client, ok),
     ssl_test_lib:close(Server),
@@ -222,8 +209,8 @@ server_verify_client_once() ->
     [{doc,"Test server option verify_client_once"}].
 
 server_verify_client_once(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, []),
-    ServerOpts =  ssl_test_lib:ssl_options(server_verification_opts, Config),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, []),
+    ServerOpts =  ssl_test_lib:ssl_options(server_rsa_opts, Config),
     Active = proplists:get_value(active, Config),
     ReceiveFunction =  proplists:get_value(receive_function, Config),
 
@@ -239,7 +226,7 @@ server_verify_client_once(Config) when is_list(Config) ->
 					{host, Hostname},
 					{from, self()},
 					{mfa, {ssl_test_lib, ReceiveFunction, []}},
-					{options, [{active, Active} | ClientOpts]}]),
+                                         {options, [{active, Active} | ClientOpts]}]),
 
     ssl_test_lib:check_result(Server, ok, Client0, ok),
     Server ! {listen, {mfa, {ssl_test_lib, no_result, []}}},
@@ -261,8 +248,8 @@ server_require_peer_cert_ok() ->
 
 server_require_peer_cert_ok(Config) when is_list(Config) ->
     ServerOpts = [{verify, verify_peer}, {fail_if_no_peer_cert, true}
-		  | ssl_test_lib:ssl_options(server_verification_opts, Config)],
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
+		  | ssl_test_lib:ssl_options(server_rsa_opts, Config)],
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
     Active = proplists:get_value(active, Config),
     ReceiveFunction =  proplists:get_value(receive_function, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
@@ -290,20 +277,21 @@ server_require_peer_cert_fail() ->
 
 server_require_peer_cert_fail(Config) when is_list(Config) ->
     ServerOpts = [{verify, verify_peer}, {fail_if_no_peer_cert, true}
-		  | ssl_test_lib:ssl_options(server_verification_opts, Config)],
+		  | ssl_test_lib:ssl_options(server_rsa_opts, Config)],
     BadClientOpts = ssl_test_lib:ssl_options(empty_client_opts, Config),
+    Active = proplists:get_value(active, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
     Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
 					      {from, self()},
-			   {options, [{active, false} | ServerOpts]}]),
+			   {options, [{active, Active} | ServerOpts]}]),
 
     Port  = ssl_test_lib:inet_port(Server),
 
     Client = ssl_test_lib:start_client_error([{node, ClientNode}, {port, Port},
 					      {host, Hostname},
 					      {from, self()},
-					      {options, [{active, false} | BadClientOpts]}]),
+					      {options, [{active, Active} | BadClientOpts]}]),
     receive
 	{Server, {error, {tls_alert, "handshake failure"}}} ->
 	    receive
@@ -321,24 +309,25 @@ server_require_peer_cert_partial_chain() ->
 
 server_require_peer_cert_partial_chain(Config) when is_list(Config) ->
     ServerOpts = [{verify, verify_peer}, {fail_if_no_peer_cert, true}
-		  | ssl_test_lib:ssl_options(server_verification_opts, Config)],
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
+		  | ssl_test_lib:ssl_options(server_rsa_opts, Config)],
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    Active = proplists:get_value(active, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
     {ok, ClientCAs} = file:read_file(proplists:get_value(cacertfile, ClientOpts)),
-    [{_,RootCA,_}, {_, _, _}] = public_key:pem_decode(ClientCAs),
+    [{_,RootCA,_} | _] = public_key:pem_decode(ClientCAs),
 
 
     Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
 					      {from, self()},
 					      {mfa, {ssl_test_lib, no_result, []}},
-					      {options, [{active, false} | ServerOpts]}]),
+					      {options, [{active, Active} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
     Client = ssl_test_lib:start_client_error([{node, ClientNode}, {port, Port},
 					      {host, Hostname},
 					      {from, self()},
 					      {mfa, {ssl_test_lib, no_result, []}},
-					      {options, [{active, false},
+					      {options, [{active, Active},
 							 {cacerts, [RootCA]} |
 							 proplists:delete(cacertfile, ClientOpts)]}]),
     receive
@@ -356,14 +345,14 @@ server_require_peer_cert_allow_partial_chain() ->
 
 server_require_peer_cert_allow_partial_chain(Config) when is_list(Config) ->
     ServerOpts = [{verify, verify_peer}, {fail_if_no_peer_cert, true}
-		  | ssl_test_lib:ssl_options(server_verification_opts, Config)],
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
+		  | ssl_test_lib:ssl_options(server_rsa_opts, Config)],
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     Active = proplists:get_value(active, Config),
     ReceiveFunction =  proplists:get_value(receive_function, Config),
 
     {ok, ClientCAs} = file:read_file(proplists:get_value(cacertfile, ClientOpts)),
-    [{_,_,_}, {_, IntermidiateCA, _}] = public_key:pem_decode(ClientCAs),
+    [{_,_,_}, {_, IntermidiateCA, _} | _] = public_key:pem_decode(ClientCAs),
 
     PartialChain =  fun(CertChain) ->
 			    case lists:member(IntermidiateCA, CertChain) of
@@ -398,12 +387,12 @@ server_require_peer_cert_do_not_allow_partial_chain() ->
 
 server_require_peer_cert_do_not_allow_partial_chain(Config) when is_list(Config) ->
     ServerOpts = [{verify, verify_peer}, {fail_if_no_peer_cert, true}
-		  | ssl_test_lib:ssl_options(server_verification_opts, Config)],
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
+		  | ssl_test_lib:ssl_options(server_rsa_opts, Config)],
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
     {ok, ServerCAs} = file:read_file(proplists:get_value(cacertfile, ServerOpts)),
-    [{_,_,_}, {_, IntermidiateCA, _}] = public_key:pem_decode(ServerCAs),
+    [{_,_,_}, {_, IntermidiateCA, _} | _] = public_key:pem_decode(ServerCAs),
 
     PartialChain =  fun(_CertChain) ->
 			    unknown_ca
@@ -439,12 +428,12 @@ server_require_peer_cert_partial_chain_fun_fail() ->
 
 server_require_peer_cert_partial_chain_fun_fail(Config) when is_list(Config) ->
     ServerOpts = [{verify, verify_peer}, {fail_if_no_peer_cert, true}
-		  | ssl_test_lib:ssl_options(server_verification_opts, Config)],
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
+		  | ssl_test_lib:ssl_options(server_rsa_opts, Config)],
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
     {ok, ServerCAs} = file:read_file(proplists:get_value(cacertfile, ServerOpts)),
-    [{_,_,_}, {_, IntermidiateCA, _}] = public_key:pem_decode(ServerCAs),
+    [{_,_,_}, {_, IntermidiateCA, _} | _] = public_key:pem_decode(ServerCAs),
 
     PartialChain =  fun(_CertChain) ->
 			   ture = false %% crash on purpose
@@ -479,8 +468,8 @@ verify_fun_always_run_client() ->
     [{doc,"Verify that user verify_fun is always run (for valid and valid_peer not only unknown_extension)"}].
 
 verify_fun_always_run_client(Config) when is_list(Config) ->
-    ClientOpts =  ssl_test_lib:ssl_options(client_verification_opts, Config),
-    ServerOpts =  ssl_test_lib:ssl_options(server_opts, Config),
+    ClientOpts =  ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts =  ssl_test_lib:ssl_options(server_rsa_opts, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
 					      {from, self()},
@@ -524,8 +513,8 @@ verify_fun_always_run_client(Config) when is_list(Config) ->
 verify_fun_always_run_server() ->
     [{doc,"Verify that user verify_fun is always run (for valid and valid_peer not only unknown_extension)"}].
 verify_fun_always_run_server(Config) when is_list(Config) ->
-    ClientOpts =  ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts =  ssl_test_lib:ssl_options(server_verification_opts, Config),
+    ClientOpts =  ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts =  ssl_test_lib:ssl_options(server_rsa_verify_opts, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
     %% If user verify fun is called correctly we fail the connection.
@@ -573,63 +562,28 @@ cert_expired() ->
     [{doc,"Test server with expired certificate"}].
 
 cert_expired(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_verification_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    PrivDir = proplists:get_value(priv_dir, Config),
-
-    KeyFile = filename:join(PrivDir, "otpCA/private/key.pem"),
-    [KeyEntry] = ssl_test_lib:pem_to_der(KeyFile),
-    Key = ssl_test_lib:public_key(public_key:pem_entry_decode(KeyEntry)),
-
-    ServerCertFile = proplists:get_value(certfile, ServerOpts),
-    NewServerCertFile = filename:join(PrivDir, "server/expired_cert.pem"),
-    [{'Certificate', DerCert, _}] = ssl_test_lib:pem_to_der(ServerCertFile),
-    OTPCert = public_key:pkix_decode_cert(DerCert, otp),
-    OTPTbsCert = OTPCert#'OTPCertificate'.tbsCertificate,
-
     {Year, Month, Day} = date(),
-    {Hours, Min, Sec} = time(),
-    NotBeforeStr = lists:flatten(io_lib:format("~p~s~s~s~s~sZ",[Year-2,
-								two_digits_str(Month),
-								two_digits_str(Day),
-								two_digits_str(Hours),
-								two_digits_str(Min),
-								two_digits_str(Sec)])),
-    NotAfterStr = lists:flatten(io_lib:format("~p~s~s~s~s~sZ",[Year-1,
-							       two_digits_str(Month),
-							       two_digits_str(Day),
-							       two_digits_str(Hours),
-							       two_digits_str(Min),
-							       two_digits_str(Sec)])),
-    NewValidity = {'Validity', {generalTime, NotBeforeStr}, {generalTime, NotAfterStr}},
-
-    ct:log("Validity: ~p ~n NewValidity: ~p ~n",
-		       [OTPTbsCert#'OTPTBSCertificate'.validity, NewValidity]),
-
-    NewOTPTbsCert =  OTPTbsCert#'OTPTBSCertificate'{validity = NewValidity},
-    NewServerDerCert = public_key:pkix_sign(NewOTPTbsCert, Key),
-    ssl_test_lib:der_to_pem(NewServerCertFile, [{'Certificate', NewServerDerCert, not_encrypted}]),
-    NewServerOpts = [{certfile, NewServerCertFile} | proplists:delete(certfile, ServerOpts)],
-
+    Active = proplists:get_value(active, Config),
+    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_ca_0, 
+                                                                     [{validity, {{Year-2, Month, Day}, 
+                                                                                  {Year-1, Month, Day}}}]}], 
+                                                                   Config, "_expired"),
+    ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
+    ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),                                                     
+    
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
     Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
 					      {from, self()},
-					      {options, NewServerOpts}]),
+					      {options, [{active, Active}| ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
     Client = ssl_test_lib:start_client_error([{node, ClientNode}, {port, Port},
 					      {host, Hostname},
 					      {from, self()},
-					      {options, [{verify, verify_peer} | ClientOpts]}]),    
-     receive
-	{Client, {error, {tls_alert, "certificate expired"}}} ->
-	    receive
-		{Server, {error, {tls_alert, "certificate expired"}}} ->
-		    ok;
-		{Server, {error, closed}} ->
-		    ok
-	    end
-    end.
+					      {options, [{verify, verify_peer}, {active, Active}  | ClientOpts]}]),    
+    
+    tcp_delivery_workaround(Server, {error, {tls_alert, "certificate expired"}},
+			    Client, {error, {tls_alert, "certificate expired"}}).
 
 two_digits_str(N) when N < 10 ->
     lists:flatten(io_lib:format("0~p", [N]));
@@ -638,60 +592,32 @@ two_digits_str(N) ->
 
 %%--------------------------------------------------------------------
 extended_key_usage_verify_server() ->
-    [{doc,"Test cert that has a critical extended_key_usage extension in verify_peer mode for server"}].
-
-extended_key_usage_verify_server(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_verification_opts, Config),
-    PrivDir = proplists:get_value(priv_dir, Config),
+    [{doc,"Test cert that has a critical extended_key_usage extension in server cert"}].
+
+extended_key_usage_verify_server(Config) when is_list(Config) -> 
+    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_peer_opts, 
+                                                                     [{extensions, 
+                                                                       [{?'id-ce-extKeyUsage',
+                                                                         [?'id-kp-serverAuth'], true}]
+                                                                      }]}], Config, "_keyusage_server"),
+    ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
+    ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),                                                     
     Active = proplists:get_value(active, Config),
     ReceiveFunction =  proplists:get_value(receive_function, Config),
 
-    KeyFile = filename:join(PrivDir, "otpCA/private/key.pem"),
-    [KeyEntry] = ssl_test_lib:pem_to_der(KeyFile),
-    Key = ssl_test_lib:public_key(public_key:pem_entry_decode(KeyEntry)),
-
-    ServerCertFile = proplists:get_value(certfile, ServerOpts),
-    NewServerCertFile = filename:join(PrivDir, "server/new_cert.pem"),
-    [{'Certificate', ServerDerCert, _}] = ssl_test_lib:pem_to_der(ServerCertFile),
-    ServerOTPCert = public_key:pkix_decode_cert(ServerDerCert, otp),
-    ServerExtKeyUsageExt = {'Extension', ?'id-ce-extKeyUsage', true, [?'id-kp-serverAuth']},
-    ServerOTPTbsCert = ServerOTPCert#'OTPCertificate'.tbsCertificate,
-    ServerExtensions =  ServerOTPTbsCert#'OTPTBSCertificate'.extensions,
-    NewServerOTPTbsCert = ServerOTPTbsCert#'OTPTBSCertificate'{extensions =
-							       [ServerExtKeyUsageExt |
-								ServerExtensions]},
-    NewServerDerCert = public_key:pkix_sign(NewServerOTPTbsCert, Key),
-    ssl_test_lib:der_to_pem(NewServerCertFile, [{'Certificate', NewServerDerCert, not_encrypted}]),
-    NewServerOpts = [{certfile, NewServerCertFile} | proplists:delete(certfile, ServerOpts)],
-
-    ClientCertFile = proplists:get_value(certfile, ClientOpts),
-    NewClientCertFile = filename:join(PrivDir, "client/new_cert.pem"),
-    [{'Certificate', ClientDerCert, _}] = ssl_test_lib:pem_to_der(ClientCertFile),
-    ClientOTPCert = public_key:pkix_decode_cert(ClientDerCert, otp),
-    ClientExtKeyUsageExt = {'Extension', ?'id-ce-extKeyUsage', true, [?'id-kp-clientAuth']},
-    ClientOTPTbsCert = ClientOTPCert#'OTPCertificate'.tbsCertificate,
-    ClientExtensions =  ClientOTPTbsCert#'OTPTBSCertificate'.extensions,
-    NewClientOTPTbsCert = ClientOTPTbsCert#'OTPTBSCertificate'{extensions =
-							       [ClientExtKeyUsageExt |
-								ClientExtensions]},
-    NewClientDerCert = public_key:pkix_sign(NewClientOTPTbsCert, Key),
-    ssl_test_lib:der_to_pem(NewClientCertFile, [{'Certificate', NewClientDerCert, not_encrypted}]),
-    NewClientOpts = [{certfile, NewClientCertFile} | proplists:delete(certfile, ClientOpts)],
-
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
 					{from, self()},
 			   {mfa, {ssl_test_lib,  ReceiveFunction, []}},
-			   {options, [{verify, verify_peer}, {active, Active} | NewServerOpts]}]),
+			   {options, [{verify, verify_none}, {active, Active} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					{host, Hostname},
 			   {from, self()},
 			   {mfa, {ssl_test_lib, ReceiveFunction, []}},
-					{options, [{verify, verify_none}, {active, Active} |
-						   NewClientOpts]}]),
+					{options, [{verify, verify_peer}, {active, Active} |
+						   ClientOpts]}]),
 
     ssl_test_lib:check_result(Server, ok, Client, ok),
 
@@ -699,60 +625,35 @@ extended_key_usage_verify_server(Config) when is_list(Config) ->
     ssl_test_lib:close(Client).
 
 %%--------------------------------------------------------------------
-extended_key_usage_verify_client() ->
+extended_key_usage_verify_both() ->
     [{doc,"Test cert that has a critical extended_key_usage extension in client verify_peer mode"}].
 
-extended_key_usage_verify_client(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_verification_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    PrivDir = proplists:get_value(priv_dir, Config),
+extended_key_usage_verify_both(Config) when is_list(Config) ->
+     {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_peer_opts, 
+                                                                      [{extensions, [{?'id-ce-extKeyUsage',
+                                                                                      [?'id-kp-serverAuth'], true}]
+                                                                      }]},
+                                                                     {client_peer_opts, 
+                                                                      [{extensions, [{?'id-ce-extKeyUsage',
+                                                                                      [?'id-kp-clientAuth'], true}]
+                                                                      }]}], Config, "_keyusage_both"),
+    ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
+    ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),        
     Active = proplists:get_value(active, Config),
     ReceiveFunction =  proplists:get_value(receive_function, Config),
 
-    KeyFile = filename:join(PrivDir, "otpCA/private/key.pem"),
-    [KeyEntry] = ssl_test_lib:pem_to_der(KeyFile),
-    Key = ssl_test_lib:public_key(public_key:pem_entry_decode(KeyEntry)),
-
-    ServerCertFile = proplists:get_value(certfile, ServerOpts),
-    NewServerCertFile = filename:join(PrivDir, "server/new_cert.pem"),
-    [{'Certificate', ServerDerCert, _}] = ssl_test_lib:pem_to_der(ServerCertFile),
-    ServerOTPCert = public_key:pkix_decode_cert(ServerDerCert, otp),
-    ServerExtKeyUsageExt = {'Extension', ?'id-ce-extKeyUsage', true, [?'id-kp-serverAuth']},
-    ServerOTPTbsCert = ServerOTPCert#'OTPCertificate'.tbsCertificate,
-    ServerExtensions =  ServerOTPTbsCert#'OTPTBSCertificate'.extensions,
-    NewServerOTPTbsCert = ServerOTPTbsCert#'OTPTBSCertificate'{extensions =
-							       [ServerExtKeyUsageExt |
-								ServerExtensions]},
-    NewServerDerCert = public_key:pkix_sign(NewServerOTPTbsCert, Key),
-    ssl_test_lib:der_to_pem(NewServerCertFile, [{'Certificate', NewServerDerCert, not_encrypted}]),
-    NewServerOpts = [{certfile, NewServerCertFile} | proplists:delete(certfile, ServerOpts)],
-
-    ClientCertFile = proplists:get_value(certfile, ClientOpts),
-    NewClientCertFile = filename:join(PrivDir, "client/new_cert.pem"),
-    [{'Certificate', ClientDerCert, _}] = ssl_test_lib:pem_to_der(ClientCertFile),
-    ClientOTPCert = public_key:pkix_decode_cert(ClientDerCert, otp),
-    ClientExtKeyUsageExt = {'Extension', ?'id-ce-extKeyUsage', true, [?'id-kp-clientAuth']},
-    ClientOTPTbsCert = ClientOTPCert#'OTPCertificate'.tbsCertificate,
-    ClientExtensions =  ClientOTPTbsCert#'OTPTBSCertificate'.extensions,
-    NewClientOTPTbsCert = ClientOTPTbsCert#'OTPTBSCertificate'{extensions =
-								   [ClientExtKeyUsageExt |
-								    ClientExtensions]},
-    NewClientDerCert = public_key:pkix_sign(NewClientOTPTbsCert, Key),
-    ssl_test_lib:der_to_pem(NewClientCertFile, [{'Certificate', NewClientDerCert, not_encrypted}]),
-    NewClientOpts = [{certfile, NewClientCertFile} | proplists:delete(certfile, ClientOpts)],
-
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
 					{from, self()},
 			   {mfa, {ssl_test_lib, ReceiveFunction, []}},
-			   {options, [{verify, verify_none}, {active, Active} | NewServerOpts]}]),
+			   {options, [{verify, verify_peer}, {active, Active} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					{host, Hostname},
 			   {from, self()},
 			   {mfa, {ssl_test_lib, ReceiveFunction, []}},
-					{options, [{verify, verify_none}, {active, Active} | NewClientOpts]}]),
+					{options, [{verify, verify_peer}, {active, Active} | ClientOpts]}]),
 
     ssl_test_lib:check_result(Server, ok, Client, ok),
 
@@ -764,132 +665,103 @@ critical_extension_verify_server() ->
     [{doc,"Test cert that has a critical unknown extension in verify_peer mode"}].
 
 critical_extension_verify_server(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_verification_opts, Config),
-    PrivDir = proplists:get_value(priv_dir, Config),
+    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{client_peer_opts, 
+                                                                     [{extensions, [{{2,16,840,1,113730,1,1},
+                                                                                      <<3,2,6,192>>, true}]
+                                                                      }]}], Config, "_client_unknown_extension"),
+    ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
+    ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),              
     Active = proplists:get_value(active, Config),
     ReceiveFunction =  proplists:get_value(receive_function, Config),
 
-    KeyFile = filename:join(PrivDir, "otpCA/private/key.pem"),
-    NewCertName = integer_to_list(erlang:unique_integer()) ++ ".pem",
-
-    ServerCertFile = proplists:get_value(certfile, ServerOpts),
-    NewServerCertFile = filename:join([PrivDir, "server", NewCertName]),
-    add_critical_netscape_cert_type(ServerCertFile, NewServerCertFile, KeyFile),
-    NewServerOpts = [{certfile, NewServerCertFile} | proplists:delete(certfile, ServerOpts)],
-
-    ClientCertFile = proplists:get_value(certfile, ClientOpts),
-    NewClientCertFile = filename:join([PrivDir, "client", NewCertName]),
-    add_critical_netscape_cert_type(ClientCertFile, NewClientCertFile, KeyFile),
-    NewClientOpts = [{certfile, NewClientCertFile} | proplists:delete(certfile, ClientOpts)],
-
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
     Server = ssl_test_lib:start_server_error(
                [{node, ServerNode}, {port, 0},
                 {from, self()},
                 {mfa, {ssl_test_lib,  ReceiveFunction, []}},
-                {options, [{verify, verify_peer}, {active, Active} | NewServerOpts]}]),
+                {options, [{verify, verify_peer}, {active, Active} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
     Client = ssl_test_lib:start_client_error(
                [{node, ClientNode}, {port, Port},
                 {host, Hostname},
                 {from, self()},
                 {mfa, {ssl_test_lib, ReceiveFunction, []}},
-                {options, [{verify, verify_none}, {active, Active} | NewClientOpts]}]),
+                {options, [{verify, verify_none}, {active, Active} | ClientOpts]}]),
 
     %% This certificate has a critical extension that we don't
-    %% understand.  Therefore, verification should fail.
-    tcp_delivery_workaround(Server, {error, {tls_alert, "unsupported certificate"}},
-                            Client, {error, {tls_alert, "unsupported certificate"}}),
+    %% understand.  Therefore, verification should fail.      
 
-    ssl_test_lib:close(Server),
-    ok.
+    tcp_delivery_workaround(Server, {error, {tls_alert, "unsupported certificate"}},
+			    Client, {error, {tls_alert, "unsupported certificate"}}),
+    
+    ssl_test_lib:close(Server).
 %%--------------------------------------------------------------------
 
 critical_extension_verify_client() ->
     [{doc,"Test cert that has a critical unknown extension in verify_peer mode"}].
 
 critical_extension_verify_client(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_verification_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    PrivDir = proplists:get_value(priv_dir, Config),
+    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_peer_opts, 
+                                                                     [{extensions, [{{2,16,840,1,113730,1,1},
+                                                                                     <<3,2,6,192>>, true}]
+                                                                      }]}], Config, "_server_unknown_extensions"),
+    ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
+    ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),              
     Active = proplists:get_value(active, Config),
     ReceiveFunction =  proplists:get_value(receive_function, Config),
 
-    KeyFile = filename:join(PrivDir, "otpCA/private/key.pem"),
-    NewCertName = integer_to_list(erlang:unique_integer()) ++ ".pem",
-
-    ServerCertFile = proplists:get_value(certfile, ServerOpts),
-    NewServerCertFile = filename:join([PrivDir, "server", NewCertName]),
-    add_critical_netscape_cert_type(ServerCertFile, NewServerCertFile, KeyFile),
-    NewServerOpts = [{certfile, NewServerCertFile} | proplists:delete(certfile, ServerOpts)],
-
-    ClientCertFile = proplists:get_value(certfile, ClientOpts),
-    NewClientCertFile = filename:join([PrivDir, "client", NewCertName]),
-    add_critical_netscape_cert_type(ClientCertFile, NewClientCertFile, KeyFile),
-    NewClientOpts = [{certfile, NewClientCertFile} | proplists:delete(certfile, ClientOpts)],
-
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
     Server = ssl_test_lib:start_server_error(
                [{node, ServerNode}, {port, 0},
                 {from, self()},
                 {mfa, {ssl_test_lib,  ReceiveFunction, []}},
-                {options, [{verify, verify_none}, {active, Active} | NewServerOpts]}]),
+                {options, [{verify, verify_none}, {active, Active} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
     Client = ssl_test_lib:start_client_error(
                [{node, ClientNode}, {port, Port},
                 {host, Hostname},
                 {from, self()},
                 {mfa, {ssl_test_lib, ReceiveFunction, []}},
-                {options, [{verify, verify_peer}, {active, Active} | NewClientOpts]}]),
+                {options, [{verify, verify_peer}, {active, Active} | ClientOpts]}]),
 
     %% This certificate has a critical extension that we don't
     %% understand.  Therefore, verification should fail.
-    tcp_delivery_workaround(Server, {error, {tls_alert, "unsupported certificate"}},
-                            Client, {error, {tls_alert, "unsupported certificate"}}),
+    ssl_test_lib:check_result(Server, {error, {tls_alert, "unsupported certificate"}},
+                              Client, {error, {tls_alert, "unsupported certificate"}}),
+
+    ssl_test_lib:close(Server).
 
-    ssl_test_lib:close(Server),
-    ok.
 %%--------------------------------------------------------------------
 critical_extension_verify_none() ->
     [{doc,"Test cert that has a critical unknown extension in verify_none mode"}].
 
 critical_extension_verify_none(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_verification_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    PrivDir = proplists:get_value(priv_dir, Config),
+    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{client_peer_opts, 
+                                                                     [{extensions, 
+                                                                       [{{2,16,840,1,113730,1,1},
+                                                                          <<3,2,6,192>>, true}]
+                                                                      }]}], Config, "_unknown_extensions"),
+    ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
+    ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),             
     Active = proplists:get_value(active, Config),
     ReceiveFunction =  proplists:get_value(receive_function, Config),
 
-    KeyFile = filename:join(PrivDir, "otpCA/private/key.pem"),
-    NewCertName = integer_to_list(erlang:unique_integer()) ++ ".pem",
-
-    ServerCertFile = proplists:get_value(certfile, ServerOpts),
-    NewServerCertFile = filename:join([PrivDir, "server", NewCertName]),
-    add_critical_netscape_cert_type(ServerCertFile, NewServerCertFile, KeyFile),
-    NewServerOpts = [{certfile, NewServerCertFile} | proplists:delete(certfile, ServerOpts)],
-
-    ClientCertFile = proplists:get_value(certfile, ClientOpts),
-    NewClientCertFile = filename:join([PrivDir, "client", NewCertName]),
-    add_critical_netscape_cert_type(ClientCertFile, NewClientCertFile, KeyFile),
-    NewClientOpts = [{certfile, NewClientCertFile} | proplists:delete(certfile, ClientOpts)],
-
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
     Server = ssl_test_lib:start_server(
                [{node, ServerNode}, {port, 0},
                 {from, self()},
                 {mfa, {ssl_test_lib, ReceiveFunction, []}},
-                {options, [{verify, verify_none}, {active, Active} | NewServerOpts]}]),
+                {options, [{verify, verify_none}, {active, Active} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
     Client = ssl_test_lib:start_client(
                [{node, ClientNode}, {port, Port},
                 {host, Hostname},
                 {from, self()},
                 {mfa, {ssl_test_lib, ReceiveFunction, []}},
-                {options, [{verify, verify_none}, {active, Active} | NewClientOpts]}]),
+                {options, [{verify, verify_none}, {active, Active} | ClientOpts]}]),
 
     %% This certificate has a critical extension that we don't
     %% understand.  But we're using `verify_none', so verification
@@ -897,28 +769,7 @@ critical_extension_verify_none(Config) when is_list(Config) ->
     ssl_test_lib:check_result(Server, ok, Client, ok),
 
     ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client),
-    ok.
-
-add_critical_netscape_cert_type(CertFile, NewCertFile, KeyFile) ->
-    [KeyEntry] = ssl_test_lib:pem_to_der(KeyFile),
-    Key = ssl_test_lib:public_key(public_key:pem_entry_decode(KeyEntry)),
-
-    [{'Certificate', DerCert, _}] = ssl_test_lib:pem_to_der(CertFile),
-    OTPCert = public_key:pkix_decode_cert(DerCert, otp),
-    %% This is the "Netscape Cert Type" extension, telling us that the
-    %% certificate can be used for SSL clients and SSL servers.
-    NetscapeCertTypeExt = #'Extension'{
-                             extnID = {2,16,840,1,113730,1,1},
-                             critical = true,
-                             extnValue = <<3,2,6,192>>},
-    OTPTbsCert = OTPCert#'OTPCertificate'.tbsCertificate,
-    Extensions =  OTPTbsCert#'OTPTBSCertificate'.extensions,
-    NewOTPTbsCert = OTPTbsCert#'OTPTBSCertificate'{
-                      extensions = [NetscapeCertTypeExt] ++ Extensions},
-    NewDerCert = public_key:pkix_sign(NewOTPTbsCert, Key),
-    ssl_test_lib:der_to_pem(NewCertFile, [{'Certificate', NewDerCert, not_encrypted}]),
-    ok.
+    ssl_test_lib:close(Client).
 
 %%--------------------------------------------------------------------
 no_authority_key_identifier() ->
@@ -926,35 +777,21 @@ no_authority_key_identifier() ->
       " but are present in trusted certs db."}].
 
 no_authority_key_identifier(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_verification_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_verification_opts, Config),
-    PrivDir = proplists:get_value(priv_dir, Config),
-
-    KeyFile = filename:join(PrivDir, "otpCA/private/key.pem"),
-    [KeyEntry] = ssl_test_lib:pem_to_der(KeyFile),
-    Key = ssl_test_lib:public_key(public_key:pem_entry_decode(KeyEntry)),
-
-    CertFile = proplists:get_value(certfile, ServerOpts),
-    NewCertFile = filename:join(PrivDir, "server/new_cert.pem"),
-    [{'Certificate', DerCert, _}] = ssl_test_lib:pem_to_der(CertFile),
-    OTPCert = public_key:pkix_decode_cert(DerCert, otp),
-    OTPTbsCert = OTPCert#'OTPCertificate'.tbsCertificate,
-    Extensions =  OTPTbsCert#'OTPTBSCertificate'.extensions,
-    NewExtensions =  delete_authority_key_extension(Extensions, []),
-    NewOTPTbsCert =  OTPTbsCert#'OTPTBSCertificate'{extensions = NewExtensions},
-
-    ct:log("Extensions ~p~n, NewExtensions: ~p~n", [Extensions, NewExtensions]),
-
-    NewDerCert = public_key:pkix_sign(NewOTPTbsCert, Key),
-    ssl_test_lib:der_to_pem(NewCertFile, [{'Certificate', NewDerCert, not_encrypted}]),
-    NewServerOpts = [{certfile, NewCertFile} | proplists:delete(certfile, ServerOpts)],
+   {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_peer_opts, 
+                                                                      [{extensions, [{auth_key_id, undefined}]
+                                                                      }]},
+                                                                     {client_peer_opts, 
+                                                                      [{extensions, [{auth_key_id, undefined}]
+                                                                       }]}], Config, "_peer_no_auth_key_id"),
+    ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
+    ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),        
 
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
 					{from, self()},
 			   {mfa, {ssl_test_lib, send_recv_result_active, []}},
-			   {options, NewServerOpts}]),
+			   {options, ServerOpts}]),
     Port = ssl_test_lib:inet_port(Server),
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					{host, Hostname},
@@ -970,53 +807,35 @@ no_authority_key_identifier(Config) when is_list(Config) ->
 delete_authority_key_extension([], Acc) ->
     lists:reverse(Acc);
 delete_authority_key_extension([#'Extension'{extnID = ?'id-ce-authorityKeyIdentifier'} | Rest],
-			       Acc) ->
+ 			       Acc) ->
     delete_authority_key_extension(Rest, Acc);
 delete_authority_key_extension([Head | Rest], Acc) ->
     delete_authority_key_extension(Rest, [Head | Acc]).
 
 %%--------------------------------------------------------------------
 
-no_authority_key_identifier_and_nonstandard_encoding() ->
-    [{doc, "Test cert with nonstandard encoding that does not have"
-      " authorityKeyIdentifier extension but are present in trusted certs db."}].
-
-no_authority_key_identifier_and_nonstandard_encoding(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_verification_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_verification_opts, Config),
-    PrivDir = proplists:get_value(priv_dir, Config),
-
-    KeyFile = filename:join(PrivDir, "otpCA/private/key.pem"),
-    [KeyEntry] = ssl_test_lib:pem_to_der(KeyFile),
-    Key = ssl_test_lib:public_key(public_key:pem_entry_decode(KeyEntry)),
-
-    CertFile = proplists:get_value(certfile, ServerOpts),
-    NewCertFile = filename:join(PrivDir, "server/new_cert.pem"),
-    [{'Certificate', DerCert, _}] = ssl_test_lib:pem_to_der(CertFile),
-    ServerCert = public_key:pkix_decode_cert(DerCert, plain),
-    ServerTbsCert = ServerCert#'Certificate'.tbsCertificate,
-    Extensions0 =  ServerTbsCert#'TBSCertificate'.extensions,
-    %% need to remove authorityKeyIdentifier extension to cause DB lookup by signature
-    Extensions = delete_authority_key_extension(Extensions0, []),
-    NewExtensions = replace_key_usage_extension(Extensions, []),
-    NewServerTbsCert = ServerTbsCert#'TBSCertificate'{extensions = NewExtensions},
-
-    ct:log("Extensions ~p~n, NewExtensions: ~p~n", [Extensions, NewExtensions]),
-
-    TbsDer = public_key:pkix_encode('TBSCertificate', NewServerTbsCert, plain),
-    Sig = public_key:sign(TbsDer, md5, Key),
-    NewServerCert = ServerCert#'Certificate'{tbsCertificate = NewServerTbsCert, signature = Sig},
-    NewDerCert = public_key:pkix_encode('Certificate', NewServerCert, plain),
-    ssl_test_lib:der_to_pem(NewCertFile, [{'Certificate', NewDerCert, not_encrypted}]),
-    NewServerOpts = [{certfile, NewCertFile} | proplists:delete(certfile, ServerOpts)],
-
+no_authority_key_identifier_keyEncipherment() ->
+    [{doc, "Test cert with keyEncipherment key_usage an no"
+      " authorityKeyIdentifier extension, but are present in trusted certs db."}].
+
+no_authority_key_identifier_keyEncipherment(Config) when is_list(Config) ->
+    {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{server_peer_opts, 
+                                                                      [{extensions, [{auth_key_id, undefined},
+                                                                                     {key_usage, [digitalSignature,
+                                                                                                  keyEncipherment]}]
+                                                                      }]},
+                                                                     {client_peer_opts, 
+                                                                      [{extensions, [{auth_key_id, undefined}]
+                                                                       }]}], Config, "_peer_keyEncipherment"),
+    ClientOpts = ssl_test_lib:ssl_options(ClientOpts0, Config),
+    ServerOpts = ssl_test_lib:ssl_options(ServerOpts0, Config),        
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
 					{from, self()},
 					{mfa, {ssl_test_lib,
 					       send_recv_result_active, []}},
-					{options, [{active, true} | NewServerOpts]}]),
+					{options, [{active, true} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					{host, Hostname},
@@ -1028,14 +847,6 @@ no_authority_key_identifier_and_nonstandard_encoding(Config) when is_list(Config
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client).
 
-replace_key_usage_extension([], Acc) ->
-    lists:reverse(Acc);
-replace_key_usage_extension([#'Extension'{extnID = ?'id-ce-keyUsage'} = E | Rest], Acc) ->
-    %% A nonstandard DER encoding of [digitalSignature, keyEncipherment]
-    Val = <<3, 2, 0, 16#A0>>,
-    replace_key_usage_extension(Rest, [E#'Extension'{extnValue = Val} | Acc]);
-replace_key_usage_extension([Head | Rest], Acc) ->
-    replace_key_usage_extension(Rest, [Head | Acc]).
 
 %%--------------------------------------------------------------------
 
@@ -1043,16 +854,16 @@ invalid_signature_server() ->
     [{doc,"Test client with invalid signature"}].
 
 invalid_signature_server(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_verification_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_verification_opts, Config),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
     PrivDir = proplists:get_value(priv_dir, Config),
 
-    KeyFile = filename:join(PrivDir, "server/key.pem"),
+    KeyFile =  proplists:get_value(keyfile, ServerOpts),
     [KeyEntry] = ssl_test_lib:pem_to_der(KeyFile),
     Key = ssl_test_lib:public_key(public_key:pem_entry_decode(KeyEntry)),
 
     ServerCertFile = proplists:get_value(certfile, ServerOpts),
-    NewServerCertFile = filename:join(PrivDir, "server/invalid_cert.pem"),
+    NewServerCertFile = filename:join(PrivDir, "server_invalid_cert.pem"),
     [{'Certificate', ServerDerCert, _}] = ssl_test_lib:pem_to_der(ServerCertFile),
     ServerOTPCert = public_key:pkix_decode_cert(ServerDerCert, otp),
     ServerOTPTbsCert = ServerOTPCert#'OTPCertificate'.tbsCertificate,
@@ -1071,8 +882,8 @@ invalid_signature_server(Config) when is_list(Config) ->
 					      {from, self()},
 					      {options, [{verify, verify_peer} | ClientOpts]}]),
 
-    tcp_delivery_workaround(Server, {error, {tls_alert, "bad certificate"}},
-			    Client, {error, {tls_alert, "bad certificate"}}).
+    tcp_delivery_workaround(Server, {error, {tls_alert, "unknown ca"}},
+			    Client, {error, {tls_alert, "unknown ca"}}).
 
 %%--------------------------------------------------------------------
 
@@ -1080,16 +891,16 @@ invalid_signature_client() ->
     [{doc,"Test server with invalid signature"}].
 
 invalid_signature_client(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_verification_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_verification_opts, Config),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
     PrivDir = proplists:get_value(priv_dir, Config),
 
-    KeyFile = filename:join(PrivDir, "client/key.pem"),
+    KeyFile =  proplists:get_value(keyfile, ClientOpts),
     [KeyEntry] = ssl_test_lib:pem_to_der(KeyFile),
     Key = ssl_test_lib:public_key(public_key:pem_entry_decode(KeyEntry)),
 
     ClientCertFile = proplists:get_value(certfile, ClientOpts),
-    NewClientCertFile = filename:join(PrivDir, "client/invalid_cert.pem"),
+    NewClientCertFile = filename:join(PrivDir, "client_invalid_cert.pem"),
     [{'Certificate', ClientDerCert, _}] = ssl_test_lib:pem_to_der(ClientCertFile),
     ClientOTPCert = public_key:pkix_decode_cert(ClientDerCert, otp),
     ClientOTPTbsCert = ClientOTPCert#'OTPCertificate'.tbsCertificate,
@@ -1108,8 +919,8 @@ invalid_signature_client(Config) when is_list(Config) ->
 					      {from, self()},
 					      {options, NewClientOpts}]),
 
-    tcp_delivery_workaround(Server, {error, {tls_alert, "bad certificate"}},
-			    Client, {error, {tls_alert, "bad certificate"}}).
+    tcp_delivery_workaround(Server, {error, {tls_alert, "unknown ca"}},
+			    Client, {error, {tls_alert, "unknown ca"}}).
 
 
 %%--------------------------------------------------------------------
@@ -1118,8 +929,14 @@ client_with_cert_cipher_suites_handshake() ->
     [{doc, "Test that client with a certificate without keyEncipherment usage "
     " extension can connect to a server with restricted cipher suites "}].
 client_with_cert_cipher_suites_handshake(Config) when is_list(Config) ->
-    ClientOpts =  ssl_test_lib:ssl_options(client_verification_opts_digital_signature_only, Config),
-    ServerOpts =  ssl_test_lib:ssl_options(server_verification_opts, Config),
+  {ClientOpts0, ServerOpts0} = ssl_test_lib:make_rsa_cert_chains([{client_peer_opts, 
+                                                                     [{extensions, 
+                                                                       [{key_usage, [digitalSignature]}]
+                                                                      }]}], Config, "_sign_only_extensions"),
+    
+
+    ClientOpts =  ssl_test_lib:ssl_options(ClientOpts0, Config),
+    ServerOpts =  ssl_test_lib:ssl_options(ServerOpts0, Config),
 
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
@@ -1148,7 +965,7 @@ client_with_cert_cipher_suites_handshake(Config) when is_list(Config) ->
 server_verify_no_cacerts() ->
     [{doc,"Test server must have cacerts if it wants to verify client"}].
 server_verify_no_cacerts(Config) when is_list(Config) ->
-    ServerOpts =  proplists:delete(cacertfile, ssl_test_lib:ssl_options(server_opts, Config)),
+    ServerOpts =  proplists:delete(cacertfile, ssl_test_lib:ssl_options(server_rsa_opts, Config)),
     {_, ServerNode, _} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
 					      {from, self()},
@@ -1163,7 +980,7 @@ unknown_server_ca_fail() ->
     [{doc,"Test that the client fails if the ca is unknown in verify_peer mode"}].
 unknown_server_ca_fail(Config) when is_list(Config) ->
     ClientOpts = ssl_test_lib:ssl_options(empty_client_opts, Config),
-    ServerOpts =  ssl_test_lib:ssl_options(server_verification_opts, Config),
+    ServerOpts =  ssl_test_lib:ssl_options(server_rsa_verify_opts, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
 					      {from, self()},
@@ -1207,7 +1024,7 @@ unknown_server_ca_accept_verify_none() ->
     [{doc,"Test that the client succeds if the ca is unknown in verify_none mode"}].
 unknown_server_ca_accept_verify_none(Config) when is_list(Config) ->
     ClientOpts = ssl_test_lib:ssl_options(empty_client_opts, Config),
-    ServerOpts =  ssl_test_lib:ssl_options(server_verification_opts, Config),
+    ServerOpts =  ssl_test_lib:ssl_options(server_rsa_verify_opts, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
 					{from, self()},
@@ -1232,7 +1049,7 @@ unknown_server_ca_accept_verify_peer() ->
      " with a verify_fun that accepts the unknown ca error"}].
 unknown_server_ca_accept_verify_peer(Config) when is_list(Config) ->
     ClientOpts = ssl_test_lib:ssl_options(empty_client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_verification_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_verify_opts, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
 					{from, self()},
@@ -1271,7 +1088,7 @@ unknown_server_ca_accept_backwardscompatibility() ->
     [{doc,"Test that old style verify_funs will work"}].
 unknown_server_ca_accept_backwardscompatibility(Config) when is_list(Config) ->
     ClientOpts = ssl_test_lib:ssl_options(empty_client_opts, Config),
-    ServerOpts =  ssl_test_lib:ssl_options(server_verification_opts, Config),
+    ServerOpts =  ssl_test_lib:ssl_options(server_rsa_verify_opts, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
 					{from, self()},
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index 302b5178a5..b8fd5dc975 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -485,6 +485,18 @@ make_dsa_cert(Config) ->
 		       {certfile, ClientCertFile}, {keyfile, ClientKeyFile}]}
      | Config].
 
+make_rsa_cert_chains(ChainConf, Config, Suffix) ->
+   CryptoSupport = crypto:supports(),
+    KeyGenSpec = key_gen_info(rsa, rsa),
+    ClientFileBase = filename:join([proplists:get_value(priv_dir, Config), "rsa" ++ Suffix]),
+    ServerFileBase = filename:join([proplists:get_value(priv_dir, Config), "rsa" ++ Suffix]),
+    GenCertData = x509_test:gen_test_certs([{digest, appropriate_sha(CryptoSupport)} | KeyGenSpec] ++ ChainConf),
+    [{server_config, ServerConf}, 
+     {client_config, ClientConf}] = 
+        x509_test:gen_pem_config_files(GenCertData, ClientFileBase, ServerFileBase),               
+    {[{verify, verify_peer} | ClientConf],
+     [{reuseaddr, true}, {verify, verify_peer} | ServerConf]
+    }.
 
 make_ec_cert_chains(ClientChainType, ServerChainType, Config) ->
     CryptoSupport = crypto:supports(),
@@ -524,6 +536,11 @@ key_gen_spec(Role, ecdhe_rsa) ->
     [{list_to_atom(Role ++ "_key_gen"),  hardcode_rsa_key(1)},
      {list_to_atom(Role ++ "_key_gen_chain"),  [hardcode_rsa_key(2),
                                                 hardcode_rsa_key(3)]}
+    ];
+key_gen_spec(Role, rsa) ->
+    [{list_to_atom(Role ++ "_key_gen"),  hardcode_rsa_key(1)},
+     {list_to_atom(Role ++ "_key_gen_chain"),  [hardcode_rsa_key(2),
+                                                hardcode_rsa_key(3)]}
     ].
 make_ecdsa_cert(Config) ->
     CryptoSupport = crypto:supports(),
@@ -571,7 +588,8 @@ make_rsa_cert(Config) ->
              
 	     {server_rsa_verify_opts, [{ssl_imp, new}, {reuseaddr, true},
 					 {verify, verify_peer} | ServerConf]},
-	     {client_rsa_opts, ClientConf}
+	     {client_rsa_opts, ClientConf},
+             {client_rsa_verify_opts,  [{verify, verify_peer} |ClientConf]}
 	     | Config];
 	false ->
 	    Config
@@ -935,9 +953,9 @@ available_suites(Version) ->
 
 rsa_non_signed_suites(Version) ->
     lists:filter(fun({rsa, _, _}) ->
-			 true;
+			 false;
 		    (_) ->
-			 false
+			 true
 		 end,
 		 available_suites(Version)).
 
@@ -1398,10 +1416,13 @@ do_supports_ssl_tls_version(Port) ->
 	    true
     end.
 
-ssl_options(Option, Config) ->
+ssl_options(Option, Config) when is_atom(Option) ->
     ProtocolOpts = proplists:get_value(protocol_opts, Config, []),
     Opts = proplists:get_value(Option, Config, []),
-    Opts ++ ProtocolOpts.
+    Opts ++ ProtocolOpts;
+ssl_options(Options, Config) ->
+    ProtocolOpts = proplists:get_value(protocol_opts, Config, []),
+    Options ++ ProtocolOpts.
 
 protocol_version(Config) ->
    protocol_version(Config, atom).
diff --git a/lib/ssl/test/x509_test.erl b/lib/ssl/test/x509_test.erl
index 13f8dfdaa9..c36e96013b 100644
--- a/lib/ssl/test/x509_test.erl
+++ b/lib/ssl/test/x509_test.erl
@@ -96,7 +96,7 @@ gen_pem_config_files(GenCertData, ClientBase, ServerBase) ->
              public_key:generate_key(KeyGen)
      end.
 
- root_cert(Role, PrivKey, Opts) ->
+root_cert(Role, PrivKey, Opts) ->
      TBS = cert_template(),
      Issuer = issuer("root", Role, " ROOT CA"),
      OTPTBS = TBS#'OTPTBSCertificate'{
@@ -105,7 +105,7 @@ gen_pem_config_files(GenCertData, ClientBase, ServerBase) ->
                 validity = validity(Opts),  
                 subject = Issuer,
                 subjectPublicKeyInfo = public_key(PrivKey),
-                extensions = extensions(Opts)
+                extensions = extensions(ca, Opts)
                },
      public_key:pkix_sign(OTPTBS, PrivKey).
 
@@ -175,32 +175,31 @@ validity(Opts) ->
     #'Validity'{notBefore={generalTime, Format(DefFrom)},
 		notAfter ={generalTime, Format(DefTo)}}.
 
-extensions(Opts) ->
-    case proplists:get_value(extensions, Opts, []) of
-	false -> 
-	    asn1_NOVALUE;
-	Exts  -> 
-	    lists:flatten([extension(Ext) || Ext <- default_extensions(Exts)])
-    end.
+extensions(Type, Opts) ->
+    Exts  = proplists:get_value(extensions, Opts, []),
+    lists:flatten([extension(Ext) || Ext <- default_extensions(Type, Exts)]).
+
+%% Common extension: name_constraints, policy_constraints, ext_key_usage, inhibit_any, 
+%% auth_key_id, subject_key_id, policy_mapping,
+
+default_extensions(ca, Exts) ->
+    Def = [{key_usage,  [keyCertSign, cRLSign]}, 
+	   {basic_constraints, default}],
+    add_default_extensions(Def, Exts);
 
-default_extensions(Exts) ->
-    Def = [{key_usage,undefined}, 
-	   {subject_altname, undefined},
-	   {issuer_altname, undefined},
-	   {basic_constraints, default},
-	   {name_constraints, undefined},
-	   {policy_constraints, undefined},
-	   {ext_key_usage, undefined},
-	   {inhibit_any, undefined},
-	   {auth_key_id, undefined},
-	   {subject_key_id, undefined},
-	   {policy_mapping, undefined}],
+default_extensions(peer, Exts) ->
+    Def = [{key_usage, [digitalSignature, keyAgreement]}],
+    add_default_extensions(Def, Exts).
+    
+add_default_extensions(Def, Exts) ->
     Filter = fun({Key, _}, D) -> 
-                     lists:keydelete(Key, 1, D) 
+                     lists:keydelete(Key, 1, D); 
+                ({Key, _, _}, D) -> 
+                     lists:keydelete(Key, 1, D)
              end,
     Exts ++ lists:foldl(Filter, Def, Exts).
-       	
-extension({_, undefined}) -> 
+
+extension({_, undefined}) ->
     [];
 extension({basic_constraints, Data}) ->
     case Data of
@@ -218,6 +217,17 @@ extension({basic_constraints, Data}) ->
 	    #'Extension'{extnID = ?'id-ce-basicConstraints',
 			 extnValue = Data}
     end;
+extension({auth_key_id, {Oid, Issuer, SNr}}) ->
+    #'Extension'{extnID = ?'id-ce-authorityKeyIdentifier',
+                 extnValue = #'AuthorityKeyIdentifier'{
+                                keyIdentifier = Oid,	    
+                                authorityCertIssuer = Issuer,     
+                                authorityCertSerialNumber = SNr},
+                 critical = false};
+extension({key_usage, Value}) ->
+    #'Extension'{extnID = ?'id-ce-keyUsage',
+                 extnValue = Value,
+                 critical = false};
 extension({Id, Data, Critical}) ->
     #'Extension'{extnID = Id, extnValue = Data, critical = Critical}.
 
@@ -277,24 +287,31 @@ cert_chain(Role, Root, RootKey, Opts, Keys) ->
     cert_chain(Role, Root, RootKey, Opts, Keys, 0, []).
 
 cert_chain(Role, IssuerCert, IssuerKey, Opts, [Key], _, Acc) ->
+    PeerOpts = list_to_atom(atom_to_list(Role) ++ "_peer_opts"),
     Cert = cert(Role, public_key:pkix_decode_cert(IssuerCert, otp), 
-                IssuerKey, Key, "admin", " Peer cert", Opts),
+                IssuerKey, Key, "admin", " Peer cert", Opts, PeerOpts, peer),
     [{Cert, Key}, {IssuerCert, IssuerKey} | Acc];
 cert_chain(Role, IssuerCert, IssuerKey, Opts, [Key | Keys], N, Acc) ->
+    CAOpts = list_to_atom(atom_to_list(Role) ++ "_ca_" ++ integer_to_list(N)),
     Cert = cert(Role, public_key:pkix_decode_cert(IssuerCert, otp), IssuerKey, Key, "webadmin", 
-                " Intermidiate CA " ++ integer_to_list(N), Opts),
+                " Intermidiate CA " ++ integer_to_list(N), Opts, CAOpts, ca),
     cert_chain(Role, Cert, Key, Opts, Keys, N+1, [{IssuerCert, IssuerKey} | Acc]).
         
-cert(Role, #'OTPCertificate'{tbsCertificate = #'OTPTBSCertificate'{subject = Issuer}}, 
-     PrivKey, Key, Contact, Name, Opts) ->
+cert(Role, #'OTPCertificate'{tbsCertificate = #'OTPTBSCertificate'{subject = Issuer,
+                                                                   serialNumber = SNr
+                                                                  }}, 
+     PrivKey, Key, Contact, Name, Opts, CertOptsName, Type) ->
+    CertOpts = proplists:get_value(CertOptsName, Opts, []),
     TBS = cert_template(),         
     OTPTBS = TBS#'OTPTBSCertificate'{
                signature = sign_algorithm(PrivKey, Opts),
                issuer =  Issuer,
-               validity = validity(Opts),  
+               validity = validity(CertOpts),  
                subject = subject(Contact, atom_to_list(Role) ++ Name),
                subjectPublicKeyInfo = public_key(Key),
-               extensions = extensions(Opts)
+               extensions = extensions(Type, 
+                                       add_default_extensions([{auth_key_id, {auth_key_oid(Role), Issuer, SNr}}],
+                                                              CertOpts))
               },
     public_key:pkix_sign(OTPTBS, PrivKey).
 
@@ -319,3 +336,8 @@ default_key_gen() ->
             [{namedCurve, hd(tls_v1:ecc_curves(0))},
              {namedCurve, hd(tls_v1:ecc_curves(0))}]
     end.
+
+auth_key_oid(server) ->
+    ?'id-kp-serverAuth';
+auth_key_oid(client) ->
+    ?'id-kp-clientAuth'.