24 files changed, 938 insertions, 500 deletions
diff --git a/lib/ssl/doc/src/notes.xml b/lib/ssl/doc/src/notes.xml
index 756c0d1b1f..8f81ccb567 100644
--- a/lib/ssl/doc/src/notes.xml
+++ b/lib/ssl/doc/src/notes.xml
@@ -31,7 +31,94 @@
   <p>This document describes the changes made to the SSL application.
     </p>
 
-    <section><title>SSL 4.1</title>
+    <section><title>SSL 4.1.3</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    Fixed error in cache-handling fix from ssl-4.1.2</p>
+          <p>
+	    Own Id: OTP-9018 Aux Id: seq11739 </p>
+        </item>
+        <item>
+          <p>
+	    Verification of a critical extended_key_usage-extension
+	    corrected</p>
+          <p>
+	    Own Id: OTP-9029 Aux Id: seq11541 </p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>SSL 4.1.2</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    The ssl application caches certificate files, it will now
+	    invalidate cache entries if the diskfile is changed.</p>
+          <p>
+	    Own Id: OTP-8965 Aux Id: seq11739 </p>
+        </item>
+        <item>
+          <p>
+	    Now runs the terminate function before returning from the
+	    call made by ssl:close/1, as before the caller of
+	    ssl:close/1 could get problems with the reuseaddr option.</p>
+          <p>
+	    Own Id: OTP-8992</p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>SSL 4.1.1</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    Correct handling of client certificate verify message
+	    When checking the client certificate verify message the
+	    server used the wrong algorithm identifier to determine
+	    the signing algorithm, causing a function clause error in
+	    the public_key application when the key-exchange
+	    algorithm and the public key algorithm of the client
+	    certificate happen to differ.</p>
+          <p>
+	    Own Id: OTP-8897</p>
+        </item>
+      </list>
+    </section>
+
+
+    <section><title>Improvements and New Features</title>
+      <list>
+        <item>
+          <p>
+	    For testing purposes ssl now also support some anonymous
+	    cipher suites when explicitly configured to do so.</p>
+          <p>
+	    Own Id: OTP-8870</p>
+        </item>
+        <item>
+          <p>
+	    Sends an error alert instead of crashing if a crypto
+	    function for the selected cipher suite fails.</p>
+          <p>
+	    Own Id: OTP-8930 Aux Id: seq11720 </p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>SSL 4.1</title>
 
     <section><title>Improvements and New Features</title>
       <list>
diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml
index 511f1e0bb2..daf7b77527 100644
--- a/lib/ssl/doc/src/ssl.xml
+++ b/lib/ssl/doc/src/ssl.xml
@@ -4,7 +4,7 @@
 <erlref>
   <header>
     <copyright>
-      <year>1999</year><year>2010</year>
+      <year>1999</year><year>2011</year>
       <holder>Ericsson AB. All Rights Reserved.</holder>
     </copyright>
     <legalnotice>
@@ -72,10 +72,10 @@
       {verify_fun, {fun(), term()}} |
       {fail_if_no_peer_cert, boolean()}
       {depth, integer()} |
-      {cert, der_bin()}| {certfile, path()} |
-      {key, der_bin()} | {keyfile, path()} | {password, string()} |
-      {cacerts, [der_bin()]} | {cacertfile, path()} |
-      |{dh, der_bin()} | {dhfile, path()} | {ciphers, ciphers()} |
+      {cert, der_encoded()}| {certfile, path()} |
+      {key, der_encoded()} | {keyfile, path()} | {password, string()} |
+      {cacerts, [der_encoded()]} | {cacertfile, path()} |
+      |{dh, der_encoded()} | {dhfile, path()} | {ciphers, ciphers()} |
       {ssl_imp, ssl_imp()} | {reuse_sessions, boolean()} | {reuse_session, fun()} 
     </c></p>
 
@@ -95,7 +95,7 @@
     
     <p><c>path() = string() - representing a file path.</c></p>
 
-    <p><c>der_bin() = binary() -Asn1 DER encoded entity as an erlang binary.</c></p>
+    <p><c>der_encoded() = binary() -Asn1 DER encoded entity as an erlang binary.</c></p>
     
     <p><c>host() = hostname() | ipaddress()</c></p>
         
@@ -136,14 +136,14 @@
     
     <taglist>
 
-      <tag>{cert, der_bin()}</tag>
+      <tag>{cert, der_encoded()}</tag>
       <item> The DER encoded users certificate. If this option
       is supplied it will override the certfile option.</item>
       
       <tag>{certfile, path()}</tag>
       <item>Path to a file containing the user's certificate.</item>
       
-      <tag>{key, der_bin()}</tag>
+      <tag>{key, der_encoded()}</tag>
       <item> The DER encoded users private key. If this option
       is supplied it will override the keyfile option.</item>
       
@@ -158,7 +158,7 @@
 	Only used if the private keyfile is password protected.
       </item>
 
-      <tag>{cacerts, [der_bin()]}</tag>
+      <tag>{cacerts, [der_encoded()]}</tag>
       <item> The DER encoded trusted certificates. If this option
       is supplied it will override the cacertfile option.</item>
 
@@ -218,12 +218,12 @@ fun(OtpCert :: #'OTPCertificate'{}, Event :: {bad_cert, Reason :: atom()} |
 	application is encountered. Additionally it will be called
 	when a certificate is considered valid by the path validation
 	to allow access to each certificate in the path to the user
-	application. Note that the it will differentiate between
-	the peer certificate and CA certificates by using valid_peer
-	or valid as the second argument to the verify fun.
-	See
-	<seealso marker="public_key:application">public_key(3)</seealso>
-	for definition of #'OTPCertificate'{} and #'Extension'{}.</p>
+	application. Note that the it will differentiate between the
+	peer certificate and CA certificates by using valid_peer or
+	valid as the second argument to the verify fun.  See <seealso
+	marker="public_key:cert_records">the public_key User's
+	Guide</seealso> for definition of #'OTPCertificate'{} and
+	#'Extension'{}.</p>
 
 	<p>If the verify callback fun returns {fail, Reason}, the
 	verification process is immediately stopped and an alert is
@@ -301,7 +301,7 @@ fun(OtpCert :: #'OTPCertificate'{}, Event :: {bad_cert, Reason :: atom()} |
 
     <taglist>
 
-      <tag>{dh, der_bin()}</tag>
+      <tag>{dh, der_encoded()}</tag>
       <item>The DER encoded Diffie Hellman parameters. If this option
       is supplied it will override the dhfile option.
       </item>
diff --git a/lib/ssl/src/inet_ssl_dist.erl b/lib/ssl/src/inet_ssl_dist.erl
index f62aefd35a..b10aa76246 100644
--- a/lib/ssl/src/inet_ssl_dist.erl
+++ b/lib/ssl/src/inet_ssl_dist.erl
@@ -135,6 +135,9 @@ accept_connection(AcceptPid, Socket, MyNode, Allowed, SetupTime) ->
 	       [self(), AcceptPid, Socket, MyNode,
 		Allowed, SetupTime]).
 
+%% Suppress dialyzer warning, we do not really care about old ssl code
+%% as we intend to remove it.
+-spec(do_accept/6 :: (_,_,_,_,_,_) -> no_return()).
 do_accept(Kernel, AcceptPid, Socket, MyNode, Allowed, SetupTime) ->
     process_flag(priority, max),
     receive
@@ -204,6 +207,9 @@ setup(Node, Type, MyNode, LongOrShortNames,SetupTime) ->
 				   LongOrShortNames,
 				   SetupTime]).
 
+%% Suppress dialyzer warning, we do not really care about old ssl code
+%% as we intend to remove it.
+-spec(do_setup/6 :: (_,_,_,_,_,_) -> no_return()).
 do_setup(Kernel, Node, Type, MyNode, LongOrShortNames,SetupTime) ->
     process_flag(priority, max),
     ?trace("~p~n",[{inet_ssl_dist,self(),setup,Node}]),
diff --git a/lib/ssl/src/ssl.appup.src b/lib/ssl/src/ssl.appup.src
index f4e6b59b6d..e6a8c557fc 100644
--- a/lib/ssl/src/ssl.appup.src
+++ b/lib/ssl/src/ssl.appup.src
@@ -1,9 +1,15 @@
 %% -*- erlang -*-
 {"%VSN%",
  [
+  {"4.1.2", [{restart_application, ssl}]},
+  {"4.1.1", [{restart_application, ssl}]},
+  {"4.1", [{restart_application, ssl}]},
   {"4.0.1", [{restart_application, ssl}]}
  ], 
  [
+  {"4.1.2", [{restart_application, ssl}]},
+  {"4.1.1", [{restart_application, ssl}]},
+  {"4.1", [{restart_application, ssl}]},
   {"4.0.1", [{restart_application, ssl}]}
  ]}.
 
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 7e5929d708..65b081937f 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 1999-2010. All Rights Reserved.
+%% Copyright Ericsson AB 1999-2011. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -49,6 +49,27 @@
 		 inet_ssl,          %% inet options for internal ssl socket 
 		 cb                 %% Callback info
 		}).
+-type option()       :: socketoption() | ssloption() | transportoption().
+-type socketoption() :: [{property(), term()}]. %% See gen_tcp and inet
+-type property()     :: atom().
+
+-type ssloption()    :: {verify, verify_type()} |
+			{verify_fun, {fun(), InitialUserState::term()}} |
+                        {fail_if_no_peer_cert, boolean()} | {depth, integer()} |
+                        {cert, der_encoded()} | {certfile, path()} | {key, der_encoded()} |
+                        {keyfile, path()} | {password, string()} | {cacerts, [der_encoded()]} |
+                        {cacertfile, path()} | {dh, der_encoded()} | {dhfile, path()} |
+                        {ciphers, ciphers()} | {ssl_imp, ssl_imp()} | {reuse_sessions, boolean()} |
+                        {reuse_session, fun()}.
+
+-type verify_type()  :: verify_none | verify_peer.
+-type path()         :: string().
+-type ciphers()      :: [erl_cipher_suite()] |
+			string(). % (according to old API)
+-type ssl_imp()      :: new | old.
+
+-type transportoption() :: {CallbackModule::atom(), DataTag::atom(), ClosedTag::atom()}.
+
 
 %%--------------------------------------------------------------------
 -spec start() -> ok.
@@ -77,9 +98,12 @@ stop() ->
     application:stop(ssl).
 
 %%--------------------------------------------------------------------
--spec connect(host() | port(), list()) -> {ok, #sslsocket{}}.
--spec connect(host() | port(), list() | port_num(), timeout() | list()) -> {ok, #sslsocket{}}.
--spec connect(host() | port(), port_num(), list(), timeout()) -> {ok, #sslsocket{}}.      
+-spec connect(host() | port(), [option()]) -> {ok, #sslsocket{}} |
+					      {error, reason()}.
+-spec connect(host() | port(), [option()] | port_num(), timeout() | list()) ->
+		     {ok, #sslsocket{}} | {error, reason()}.
+-spec connect(host() | port(), port_num(), list(), timeout()) ->
+		     {ok, #sslsocket{}} | {error, reason()}.
 
 %%
 %% Description: Connect to a ssl server.
@@ -126,7 +150,7 @@ connect(Host, Port, Options0, Timeout) ->
     end.
 
 %%--------------------------------------------------------------------
--spec listen(port_num(), list()) ->{ok, #sslsocket{}} | {error, reason()}.
+-spec listen(port_num(), [option()]) ->{ok, #sslsocket{}} | {error, reason()}.
 		    
 %%
 %% Description: Creates a ssl listen socket.
@@ -150,8 +174,10 @@ listen(Port, Options0) ->
     end.
 
 %%--------------------------------------------------------------------
--spec transport_accept(#sslsocket{}) -> {ok, #sslsocket{}}.
--spec transport_accept(#sslsocket{}, timeout()) -> {ok, #sslsocket{}}.
+-spec transport_accept(#sslsocket{}) -> {ok, #sslsocket{}} |
+					{error, reason()}.
+-spec transport_accept(#sslsocket{}, timeout()) -> {ok, #sslsocket{}} |
+						   {error, reason()}.
 %%
 %% Description: Performs transport accept on a ssl listen socket 
 %%--------------------------------------------------------------------
@@ -189,9 +215,10 @@ transport_accept(#sslsocket{} = ListenSocket, Timeout) ->
     ssl_broker:transport_accept(Pid, ListenSocket, Timeout).
 
 %%--------------------------------------------------------------------
--spec ssl_accept(#sslsocket{}) -> {ok, #sslsocket{}} | {error, reason()}.
--spec ssl_accept(#sslsocket{}, list() | timeout()) -> {ok, #sslsocket{}} | {error, reason()}.
--spec ssl_accept(port(), list(), timeout()) -> {ok, #sslsocket{}} | {error, reason()}.
+-spec ssl_accept(#sslsocket{}) -> ok | {error, reason()}.
+-spec ssl_accept(#sslsocket{} | port(), timeout()| [option()]) ->
+			ok | {ok, #sslsocket{}} | {error, reason()}.
+-spec ssl_accept(port(), [option()], timeout()) -> {ok, #sslsocket{}} | {error, reason()}.
 %%
 %% Description: Performs accept on a ssl listen socket. e.i. performs
 %%              ssl handshake. 
diff --git a/lib/ssl/src/ssl_certificate.erl b/lib/ssl/src/ssl_certificate.erl
index 5571fb01f6..8c0c2bfa5d 100644
--- a/lib/ssl/src/ssl_certificate.erl
+++ b/lib/ssl/src/ssl_certificate.erl
@@ -28,7 +28,6 @@
 -include("ssl_handshake.hrl").
 -include("ssl_alert.hrl").
 -include("ssl_internal.hrl").
--include("ssl_debug.hrl").
 -include_lib("public_key/include/public_key.hrl"). 
 
 -export([trusted_cert_and_path/2,
diff --git a/lib/ssl/src/ssl_certificate_db.erl b/lib/ssl/src/ssl_certificate_db.erl
index 2a5a7f3394..3eceefa304 100644
--- a/lib/ssl/src/ssl_certificate_db.erl
+++ b/lib/ssl/src/ssl_certificate_db.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2007-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2007-2011. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -27,7 +27,9 @@
 
 -export([create/0, remove/1, add_trusted_certs/3, 
 	 remove_trusted_certs/2, lookup_trusted_cert/3, issuer_candidate/1,
-	 lookup_cached_certs/1, cache_pem_file/3]).
+	 lookup_cached_certs/1, cache_pem_file/4, uncache_pem_file/2, lookup/2]).
+
+-type time()      :: {non_neg_integer(), non_neg_integer(), non_neg_integer()}.
 
 %%====================================================================
 %% Internal application API
@@ -98,17 +100,35 @@ add_trusted_certs(Pid, File, [CertsDb, FileToRefDb, PidToFileDb]) ->
     insert(Pid, File, PidToFileDb),
     {ok, Ref}.
 %%--------------------------------------------------------------------
--spec cache_pem_file(pid(), string(), certdb_ref()) -> term().
+-spec cache_pem_file(pid(), string(), time(), certdb_ref()) -> term().
 %%
 %% Description: Cache file as binary in DB
 %%--------------------------------------------------------------------
-cache_pem_file(Pid, File, [CertsDb, _FileToRefDb, PidToFileDb]) ->
+cache_pem_file(Pid, File, Time, [CertsDb, _FileToRefDb, PidToFileDb]) ->
     {ok, PemBin} = file:read_file(File), 
     Content = public_key:pem_decode(PemBin),
-    insert({file, File}, Content, CertsDb),
+    insert({file, File}, {Time, Content}, CertsDb),
     insert(Pid, File, PidToFileDb),
     {ok, Content}.
 
+%--------------------------------------------------------------------
+-spec uncache_pem_file(string(), certdb_ref()) -> no_return().
+%%
+%% Description: If a cached file is no longer valid (changed on disk)
+%% we must terminate the connections using the old file content, and
+%% when those processes are finish the cache will be cleaned. It is
+%% a rare but possible case a new ssl client/server is started with
+%% a filename with the same name as previously started client/server
+%% but with different content.
+%% --------------------------------------------------------------------
+uncache_pem_file(File, [_CertsDb, _FileToRefDb, PidToFileDb]) ->
+    Pids = select(PidToFileDb, [{{'$1', File},[],['$$']}]),
+    lists:foreach(fun([Pid]) ->
+			  exit(Pid, shutdown)
+		  end, Pids).
+
+
+
 %%--------------------------------------------------------------------
 -spec remove_trusted_certs(pid(), certdb_ref()) -> term().
 				  
@@ -174,6 +194,22 @@ issuer_candidate(PrevCandidateKey) ->
     end.
 
 %%--------------------------------------------------------------------
+-spec lookup(term(), term()) -> term() | undefined.
+%%
+%% Description: Looks up an element in a certificat <Db>.
+%%--------------------------------------------------------------------
+lookup(Key, Db) ->
+    case ets:lookup(Db, Key) of
+	[] ->
+	    undefined;
+	Contents  ->
+	    Pick = fun({_, Data}) -> Data;
+		      ({_,_,Data}) -> Data
+		   end,
+	    [Pick(Data) || Data <- Contents]
+    end.
+
+%%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
 certificate_db_name() ->
@@ -191,16 +227,8 @@ ref_count(Key, Db,N) ->
 delete(Key, Db) ->
     _ = ets:delete(Db, Key).
 
-lookup(Key, Db) ->
-    case ets:lookup(Db, Key) of
-	[] ->
-	    undefined;
-	Contents  ->
-	    Pick = fun({_, Data}) -> Data;
-		      ({_,_,Data}) -> Data
-		   end,
-	    [Pick(Data) || Data <- Contents]
-    end.
+select(Db, MatchSpec)->
+    ets:select(Db, MatchSpec).
 
 remove_certs(Ref, CertsDb) ->
     ets:match_delete(CertsDb, {{Ref, '_', '_'}, '_'}).
diff --git a/lib/ssl/src/ssl_cipher.erl b/lib/ssl/src/ssl_cipher.erl
index 9824e17fcd..72f02a4362 100644
--- a/lib/ssl/src/ssl_cipher.erl
+++ b/lib/ssl/src/ssl_cipher.erl
@@ -29,7 +29,6 @@
 -include("ssl_record.hrl").
 -include("ssl_cipher.hrl").
 -include("ssl_alert.hrl").
--include("ssl_debug.hrl").
 -include_lib("public_key/include/public_key.hrl").
 
 -export([security_parameters/2, suite_definition/1,
@@ -75,20 +74,12 @@ cipher(?RC4, CipherState, Mac, Fragment) ->
                  S -> S
              end,
     GenStreamCipherList = [Fragment, Mac],
-
-    ?DBG_HEX(GenStreamCipherList),
-    ?DBG_HEX(State0),
     {State1, T} = crypto:rc4_encrypt_with_state(State0, GenStreamCipherList),
-    ?DBG_HEX(T),
     {T, CipherState#cipher_state{state = State1}};
 cipher(?DES, CipherState, Mac, Fragment) ->
     block_cipher(fun(Key, IV, T) ->
 			 crypto:des_cbc_encrypt(Key, IV, T)
 		 end, block_size(des_cbc), CipherState, Mac, Fragment);
-%% cipher(?DES40, CipherState, Mac, Fragment) ->
-%%     block_cipher(fun(Key, IV, T) ->
-%% 			 crypto:des_cbc_encrypt(Key, IV, T)
-%% 		 end, block_size(des_cbc), CipherState, Mac, Fragment);
 cipher(?'3DES', CipherState, Mac, Fragment) ->
     block_cipher(fun(<<K1:8/binary, K2:8/binary, K3:8/binary>>, IV, T) ->
 			 crypto:des3_cbc_encrypt(K1, K2, K3, IV, T)
@@ -109,11 +100,7 @@ block_cipher(Fun, BlockSz, #cipher_state{key=Key, iv=IV} = CS0,
     TotSz = byte_size(Mac) + erlang:iolist_size(Fragment) + 1,
     {PaddingLength, Padding} = get_padding(TotSz, BlockSz),
     L = [Fragment, Mac, PaddingLength, Padding],
-    ?DBG_HEX(Key),
-    ?DBG_HEX(IV),
-    ?DBG_HEX(L),
     T = Fun(Key, IV, L),
-    ?DBG_HEX(T),
     NextIV = next_iv(T, IV),
     {T, CS0#cipher_state{iv=NextIV}}.
 
@@ -127,26 +114,29 @@ block_cipher(Fun, BlockSz, #cipher_state{key=Key, iv=IV} = CS0,
 decipher(?NULL, _HashSz, CipherState, Fragment, _) ->
     {Fragment, <<>>, CipherState};
 decipher(?RC4, HashSz, CipherState, Fragment, _) ->
-    ?DBG_TERM(CipherState#cipher_state.key),
     State0 = case CipherState#cipher_state.state of
                  undefined -> crypto:rc4_set_key(CipherState#cipher_state.key);
                  S -> S
              end,
-    ?DBG_HEX(State0),
-    ?DBG_HEX(Fragment),
-    {State1, T} = crypto:rc4_encrypt_with_state(State0, Fragment),
-    ?DBG_HEX(T),
-    GSC = generic_stream_cipher_from_bin(T, HashSz),
-    #generic_stream_cipher{content=Content, mac=Mac} = GSC,
-    {Content, Mac, CipherState#cipher_state{state=State1}};
+    try crypto:rc4_encrypt_with_state(State0, Fragment) of
+	{State, Text} ->
+	    GSC = generic_stream_cipher_from_bin(Text, HashSz),
+	    #generic_stream_cipher{content = Content, mac = Mac} = GSC,
+	    {Content, Mac, CipherState#cipher_state{state = State}}
+    catch
+	_:_ ->
+	    %% This is a DECRYPTION_FAILED but
+	    %% "differentiating between bad_record_mac and decryption_failed
+	    %% alerts may permit certain attacks against CBC mode as used in
+	    %% TLS [CBCATT].  It is preferable to uniformly use the
+	    %% bad_record_mac alert to hide the specific type of the error."
+	    ?ALERT_REC(?FATAL, ?BAD_RECORD_MAC)
+    end;
+
 decipher(?DES, HashSz, CipherState, Fragment, Version) ->
     block_decipher(fun(Key, IV, T) ->
 			   crypto:des_cbc_decrypt(Key, IV, T)
 		   end, CipherState, HashSz, Fragment, Version);
-%% decipher(?DES40, HashSz, CipherState, Fragment, Version) ->
-%%     block_decipher(fun(Key, IV, T) ->
-%% 			   crypto:des_cbc_decrypt(Key, IV, T)
-%% 		   end, CipherState, HashSz, Fragment, Version);
 decipher(?'3DES', HashSz, CipherState, Fragment, Version) ->
     block_decipher(fun(<<K1:8/binary, K2:8/binary, K3:8/binary>>, IV, T) ->
 			   crypto:des3_cbc_decrypt(K1, K2, K3, IV, T)
@@ -164,22 +154,27 @@ decipher(?AES, HashSz, CipherState, Fragment, Version) ->
 
 block_decipher(Fun, #cipher_state{key=Key, iv=IV} = CipherState0, 
 	       HashSz, Fragment, Version) ->
-    ?DBG_HEX(Key),
-    ?DBG_HEX(IV),
-    ?DBG_HEX(Fragment),
-    T = Fun(Key, IV, Fragment),
-    ?DBG_HEX(T),
-    GBC = generic_block_cipher_from_bin(T, HashSz),
-    case is_correct_padding(GBC, Version) of  
-	true ->
-	    Content = GBC#generic_block_cipher.content,
-	    Mac = GBC#generic_block_cipher.mac,
-	    CipherState1 = CipherState0#cipher_state{iv=next_iv(Fragment, IV)},
-	    {Content, Mac, CipherState1};
-	false ->
+    try Fun(Key, IV, Fragment) of
+	Text ->
+	    GBC = generic_block_cipher_from_bin(Text, HashSz),
+	    case is_correct_padding(GBC, Version) of
+		true ->
+		    Content = GBC#generic_block_cipher.content,
+		    Mac = GBC#generic_block_cipher.mac,
+		    CipherState1 = CipherState0#cipher_state{iv=next_iv(Fragment, IV)},
+		    {Content, Mac, CipherState1};
+		false ->
+		    ?ALERT_REC(?FATAL, ?BAD_RECORD_MAC)
+	    end
+    catch
+	_:_ ->
+	    %% This is a DECRYPTION_FAILED but
+	    %% "differentiating between bad_record_mac and decryption_failed
+	    %% alerts may permit certain attacks against CBC mode as used in
+	    %% TLS [CBCATT].  It is preferable to uniformly use the
+	    %% bad_record_mac alert to hide the specific type of the error."
 	    ?ALERT_REC(?FATAL, ?BAD_RECORD_MAC)
     end.
-	    
 %%--------------------------------------------------------------------
 -spec suites(tls_version()) -> [cipher_suite()].
 %%
@@ -416,8 +411,6 @@ bulk_cipher_algorithm(null) ->
 %%     ?IDEA;
 bulk_cipher_algorithm(rc4_128) ->
     ?RC4;
-%% bulk_cipher_algorithm(des40_cbc) ->
-%%     ?DES40;
 bulk_cipher_algorithm(des_cbc) ->
     ?DES;
 bulk_cipher_algorithm('3des_ede_cbc') ->
@@ -431,7 +424,6 @@ type(Cipher) when Cipher == null;
     ?STREAM;
 
 type(Cipher) when Cipher == idea_cbc;
-		  Cipher == des40_cbc;
 		  Cipher == des_cbc;
 		  Cipher == '3des_ede_cbc';
 		  Cipher == aes_128_cbc;
@@ -443,8 +435,6 @@ key_material(null) ->
 key_material(Cipher) when Cipher == idea_cbc;
  			  Cipher == rc4_128 ->
     16;
-%%key_material(des40_cbc) ->	
-%%   5;
 key_material(des_cbc) ->
     8;
 key_material('3des_ede_cbc') ->
@@ -459,8 +449,7 @@ expanded_key_material(null) ->
 expanded_key_material(Cipher) when Cipher == idea_cbc;
  				   Cipher == rc4_128 ->
     16;
-expanded_key_material(Cipher) when Cipher == des_cbc;
- 				   Cipher == des40_cbc ->
+expanded_key_material(Cipher) when Cipher == des_cbc ->
     8;
 expanded_key_material('3des_ede_cbc') ->
     24;
@@ -471,8 +460,6 @@ expanded_key_material(Cipher) when Cipher == aes_128_cbc;
 
 effective_key_bits(null) ->
     0;
-%%effective_key_bits(des40_cbc) -> 
-%%    40;
 effective_key_bits(des_cbc) ->
     56;
 effective_key_bits(Cipher) when Cipher == idea_cbc;
@@ -491,7 +478,6 @@ iv_size(Cipher) ->
     block_size(Cipher).
 
 block_size(Cipher) when Cipher == idea_cbc;
-			Cipher == des40_cbc;
 			Cipher == des_cbc;
 			Cipher == '3des_ede_cbc' -> 
     8;
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index 3a9cada81e..489895cf29 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2007-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2007-2011. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -29,7 +29,6 @@
 
 -behaviour(gen_fsm).
 
--include("ssl_debug.hrl").
 -include("ssl_handshake.hrl").
 -include("ssl_alert.hrl").
 -include("ssl_record.hrl").
@@ -71,7 +70,6 @@
 	  %% {{md5_hash, sha_hash}, {prev_md5, prev_sha}} (binary())
           tls_handshake_hashes, % see above 
           tls_cipher_texts,     % list() received but not deciphered yet
-          own_cert,             % binary()  
           session,              % #session{} from ssl_handshake.hrl
 	  session_cache,        % 
 	  session_cache_cb,     %
@@ -91,7 +89,8 @@
 	  log_alert,           % boolean() 
 	  renegotiation,        % {boolean(), From | internal | peer}
 	  recv_during_renegotiation,  %boolean() 
-	  send_queue           % queue()
+	  send_queue,           % queue()
+	  terminated = false   %
 	 }).
 
 -define(DEFAULT_DIFFIE_HELLMAN_PARAMS, 
@@ -305,8 +304,9 @@ init([Role, Host, Port, Socket, {SSLOpts0, _} = Options,
 
     try ssl_init(SSLOpts0, Role) of
 	{ok, Ref, CacheRef, OwnCert, Key, DHParams} ->	   
+	    Session = State0#state.session,
 	    State = State0#state{tls_handshake_hashes = Hashes0,
-				 own_cert = OwnCert,
+				 session = Session#session{own_certificate = OwnCert},
 				 cert_db_ref = Ref,
 				 session_cache = CacheRef,
 				 private_key = Key,
@@ -332,14 +332,13 @@ init([Role, Host, Port, Socket, {SSLOpts0, _} = Options,
 %%--------------------------------------------------------------------
 hello(start, #state{host = Host, port = Port, role = client,
 		    ssl_options = SslOpts, 
+		    session = #session{own_certificate = Cert} = Session0,
 		    transport_cb = Transport, socket = Socket,
 		    connection_states = ConnectionStates,
-		    renegotiation = {Renegotiation, _}}
-      = State0) ->
-
+		    renegotiation = {Renegotiation, _}} = State0) ->
     Hello = ssl_handshake:client_hello(Host, Port, 
 				       ConnectionStates, 
-				       SslOpts, Renegotiation),
+				       SslOpts, Renegotiation, Cert),
 
     Version = Hello#client_hello.client_version,
     Hashes0 = ssl_handshake:init_hashes(),
@@ -348,13 +347,13 @@ hello(start, #state{host = Host, port = Port, role = client,
     Transport:send(Socket, BinMsg),
     State1 = State0#state{connection_states = CS2,
 			 negotiated_version = Version, %% Requested version
-			 session = 
-                         #session{session_id = Hello#client_hello.session_id,
-                                  is_resumable = false},
+			  session =
+			      Session0#session{session_id = Hello#client_hello.session_id,
+					       is_resumable = false},
 			  tls_handshake_hashes = Hashes1},
     {Record, State} = next_record(State1),
     next_state(hello, Record, State);
-    
+
 hello(start, #state{role = server} = State0) ->
     {Record, State} = next_record(State0),
     next_state(hello, Record, State);
@@ -371,7 +370,6 @@ hello(#server_hello{cipher_suite = CipherSuite,
 	     negotiated_version = ReqVersion,
 	     renegotiation = {Renegotiation, _},
 	     ssl_options = SslOptions} = State0) ->
-
     case ssl_handshake:hello(Hello, SslOptions, ConnectionStates0, Renegotiation) of
 	{Version, NewId, ConnectionStates} ->
 	    {KeyAlgorithm, _, _} =
@@ -397,13 +395,11 @@ hello(#server_hello{cipher_suite = CipherSuite,
 
 hello(Hello = #client_hello{client_version = ClientVersion}, 
       State = #state{connection_states = ConnectionStates0,
-		     port = Port, session = Session0,
+		     port = Port, session = #session{own_certificate = Cert} = Session0,
 		     renegotiation = {Renegotiation, _},
 		     session_cache = Cache,		  
 		     session_cache_cb = CacheCb,
-		     ssl_options = SslOpts,
-		     own_cert = Cert}) ->
-    
+		     ssl_options = SslOpts}) ->
     case ssl_handshake:hello(Hello, SslOpts, {Port, Session0, Cache, CacheCb,
 				     ConnectionStates0, Cert}, Renegotiation) of
         {Version, {Type, Session}, ConnectionStates} ->       
@@ -537,7 +533,7 @@ certify(#server_hello_done{},
 	       connection_states = ConnectionStates0,
 	       negotiated_version = Version,
 	       premaster_secret = undefined,
-	       role = client} = State0) ->    
+	       role = client} = State0) ->
     case ssl_handshake:master_secret(Version, Session, 
 				     ConnectionStates0, client) of
 	{MasterSecret, ConnectionStates1} -> 
@@ -614,7 +610,6 @@ certify_client_key_exchange(#client_diffie_hellman_public{dh_public = ClientPubl
 				   diffie_hellman_params = #'DHParameter'{prime = P,
 									  base = G},
 				   diffie_hellman_keys = {_, ServerDhPrivateKey}} = State0) ->
-
     case dh_master_secret(crypto:mpint(P), crypto:mpint(G), ClientPublicDhKey, ServerDhPrivateKey, State0) of
 	#state{} = State1 ->
 	    {Record, State} = next_record(State1),
@@ -657,8 +652,7 @@ cipher(#finished{verify_data = Data} = Finished,
 	      role = Role,
 	      session = #session{master_secret = MasterSecret} 
 	      = Session0,
-	      tls_handshake_hashes = Hashes0} = State) ->    
-    
+	      tls_handshake_hashes = Hashes0} = State) ->
     case ssl_handshake:verify_connection(Version, Finished, 
 					 opposite_role(Role), 
                                          MasterSecret, Hashes0) of
@@ -679,15 +673,15 @@ cipher(Msg, State) ->
 %%--------------------------------------------------------------------
 connection(#hello_request{}, #state{host = Host, port = Port,
 				    socket = Socket,
+				    session = #session{own_certificate = Cert},
 				    ssl_options = SslOpts,
 				    negotiated_version = Version,
 				    transport_cb = Transport,
 				    connection_states = ConnectionStates0,
 				    renegotiation = {Renegotiation, _},
 				    tls_handshake_hashes = Hashes0} = State0) ->
-   
     Hello = ssl_handshake:client_hello(Host, Port, ConnectionStates0,
-				       SslOpts, Renegotiation),
+				       SslOpts, Renegotiation, Cert),
   
     {BinMsg, ConnectionStates1, Hashes1} =
         encode_handshake(Hello, Version, ConnectionStates0, Hashes0),
@@ -778,8 +772,12 @@ handle_sync_event(start, _, connection, State) ->
 handle_sync_event(start, From, StateName, State) ->
     {next_state, StateName, State#state{from = From}};
 
-handle_sync_event(close, _, _StateName, State) ->
-    {stop, normal, ok, State};
+handle_sync_event(close, _, StateName, State) ->
+    %% Run terminate before returning
+    %% so that the reuseaddr inet-option will work
+    %% as intended.
+    (catch terminate(user_close, StateName, State)),
+    {stop, normal, ok, State#state{terminated = true}};
 
 handle_sync_event({shutdown, How0}, _, StateName,
 		  #state{transport_cb = Transport,
@@ -967,24 +965,28 @@ handle_info(Msg, StateName, State) ->
 %% necessary cleaning up. When it returns, the gen_fsm terminates with
 %% Reason. The return value is ignored.
 %%--------------------------------------------------------------------
-terminate(_Reason, connection, #state{negotiated_version = Version,
+terminate(_, _, #state{terminated = true}) ->
+    %% Happens when user closes the connection using ssl:close/1
+    %% we want to guarantee that Transport:close has been called
+    %% when ssl:close/1 returns.
+    ok;
+terminate(Reason, connection, #state{negotiated_version = Version,
 				      connection_states = ConnectionStates,
 				      transport_cb = Transport,
 				      socket = Socket, send_queue = SendQueue,
 				      renegotiation = Renegotiate}) ->
     notify_senders(SendQueue),
     notify_renegotiater(Renegotiate),
-    {BinAlert, _} = encode_alert(?ALERT_REC(?WARNING,?CLOSE_NOTIFY),
-				 Version, ConnectionStates),
+    BinAlert = terminate_alert(Reason, Version, ConnectionStates),
     Transport:send(Socket, BinAlert),
-    workaround_transport_delivery_problems(Socket, Transport),
+    workaround_transport_delivery_problems(Socket, Transport, Reason),
     Transport:close(Socket);
-terminate(_Reason, _StateName, #state{transport_cb = Transport, 
+terminate(Reason, _StateName, #state{transport_cb = Transport,
 				      socket = Socket, send_queue = SendQueue,
 				      renegotiation = Renegotiate}) ->
     notify_senders(SendQueue),
     notify_renegotiater(Renegotiate),
-    workaround_transport_delivery_problems(Socket, Transport),
+    workaround_transport_delivery_problems(Socket, Transport, Reason),
     Transport:close(Socket).
 
 %%--------------------------------------------------------------------
@@ -1084,6 +1086,7 @@ init_private_key({rsa, PrivateKey}, _, _,_) ->
 init_private_key({dsa, PrivateKey},_,_,_) ->
     public_key:der_decode('DSAPrivateKey', PrivateKey).
 
+-spec(handle_file_error/6 :: (_,_,_,_,_,_) -> no_return()).
 handle_file_error(Line, Error, {badmatch, Reason}, File, Throw, Stack) ->
     file_error(Line, Error, Reason, File, Throw, Stack);
 handle_file_error(Line, Error, Reason, File, Throw, Stack) ->
@@ -1149,7 +1152,7 @@ certify_client(#state{client_certificate_requested = true, role = client,
                       transport_cb = Transport,
                       negotiated_version = Version,
                       cert_db_ref = CertDbRef,
-                      own_cert = OwnCert,
+		      session = #session{own_certificate = OwnCert},
                       socket = Socket,
                       tls_handshake_hashes = Hashes0} = State) ->
     Certificate = ssl_handshake:certificate(OwnCert, CertDbRef, client),
@@ -1165,10 +1168,10 @@ verify_client_cert(#state{client_certificate_requested = true, role = client,
 			  connection_states = ConnectionStates0,
 			  transport_cb = Transport,
 			  negotiated_version = Version,
-			  own_cert = OwnCert,
 			  socket = Socket,
 			  private_key = PrivateKey,
-			  session = #session{master_secret = MasterSecret},
+			  session = #session{master_secret = MasterSecret,
+					     own_certificate = OwnCert},
 			  tls_handshake_hashes = Hashes0} = State) ->
 
     case ssl_handshake:client_certificate_verify(OwnCert, MasterSecret, 
@@ -1334,7 +1337,7 @@ certify_server(#state{transport_cb = Transport,
 		      connection_states = ConnectionStates,
 		      tls_handshake_hashes = Hashes,
 		      cert_db_ref = CertDbRef,
-		      own_cert = OwnCert} = State) ->
+		      session = #session{own_certificate = OwnCert}} = State) ->
     case ssl_handshake:certificate(OwnCert, CertDbRef, server) of
 	CertMsg = #certificate{} ->
 	    {BinCertMsg, NewConnectionStates, NewHashes} =
@@ -1361,7 +1364,6 @@ key_exchange(#state{role = server, key_algorithm = Algo,
   when Algo == dhe_dss;
        Algo == dhe_rsa;
        Algo == dh_anon ->
-
     Keys = crypto:dh_generate_key([crypto:mpint(P), crypto:mpint(G)]),
     ConnectionState = 
 	ssl_record:pending_connection_state(ConnectionStates0, read),
@@ -1519,7 +1521,7 @@ handle_server_key(
 	true ->
 	    dh_master_secret(P, G, ServerPublicDhKey, undefined, State);
 	false ->
-	    ?ALERT_REC(?FATAL,?HANDSHAKE_FAILURE)
+	    ?ALERT_REC(?FATAL, ?DECRYPT_ERROR)
     end.
 
 verify_dh_params(Signed, Hashes, {?rsaEncryption, PubKey, _PubKeyParams}) ->
@@ -1574,15 +1576,12 @@ cipher_role(server, Data, Session,  #state{connection_states = ConnectionStates0
 							     tls_handshake_hashes =
 							     Hashes})).
 encode_alert(#alert{} = Alert, Version, ConnectionStates) ->
-    ?DBG_TERM(Alert),
     ssl_record:encode_alert_record(Alert, Version, ConnectionStates).
 
 encode_change_cipher(#change_cipher_spec{}, Version, ConnectionStates) ->
-    ?DBG_TERM(#change_cipher_spec{}),
     ssl_record:encode_change_cipher_spec(Version, ConnectionStates).
 
 encode_handshake(HandshakeRec, Version, ConnectionStates0, Hashes0) ->
-    ?DBG_TERM(HandshakeRec),
     Frag = ssl_handshake:encode_handshake(HandshakeRec, Version),
     Hashes1 = ssl_handshake:update_hashes(Hashes0, Frag),
     {E, ConnectionStates1} =
@@ -1840,7 +1839,6 @@ next_state(StateName, #ssl_tls{type = ?APPLICATION_DATA, fragment = Data}, State
 next_state(StateName, #ssl_tls{type = ?CHANGE_CIPHER_SPEC, fragment = <<1>>} = 
  	   _ChangeCipher, 
  	   #state{connection_states = ConnectionStates0} = State0) ->
-    ?DBG_TERM(_ChangeCipher),
     ConnectionStates1 =
  	ssl_record:activate_pending_connection_state(ConnectionStates0, read),
     {Record, State} = next_record(State0#state{connection_states = ConnectionStates1}),
@@ -1917,14 +1915,22 @@ next_state_connection(StateName, #state{send_queue = Queue0,
 	    next_state_is_connection(State)
     end.
 
+%% In next_state_is_connection/1: clear tls_handshake_hashes,
+%% premaster_secret and public_key_info (only needed during handshake)
+%% to reduce memory foot print of a connection.
 next_state_is_connection(State = 
 		      #state{recv_during_renegotiation = true, socket_options = 
 			     #socket_options{active = false}})  -> 
-    passive_receive(State#state{recv_during_renegotiation = false}, connection);
+    passive_receive(State#state{recv_during_renegotiation = false,
+				premaster_secret = undefined,
+				public_key_info = undefined,
+				tls_handshake_hashes = {<<>>, <<>>}}, connection);
 
 next_state_is_connection(State0) ->
     {Record, State} = next_record_if_active(State0),
-    next_state(connection, Record, State).
+    next_state(connection, Record, State#state{premaster_secret = undefined,
+					       public_key_info = undefined,
+					       tls_handshake_hashes = {<<>>, <<>>}}).
 
 register_session(_, _, _, #session{is_resumable = true} = Session) ->
     Session; %% Already registered
@@ -2191,10 +2197,23 @@ notify_renegotiater({true, From}) when not is_atom(From)  ->
 notify_renegotiater(_) ->
     ok.
 
-workaround_transport_delivery_problems(Socket, Transport) ->
+terminate_alert(Reason, Version, ConnectionStates) when Reason == normal; Reason == shutdown;
+							Reason == user_close ->
+    {BinAlert, _} = encode_alert(?ALERT_REC(?WARNING, ?CLOSE_NOTIFY),
+				 Version, ConnectionStates),
+    BinAlert;
+terminate_alert(_, Version, ConnectionStates) ->
+    {BinAlert, _} = encode_alert(?ALERT_REC(?FATAL, ?INTERNAL_ERROR),
+				 Version, ConnectionStates),
+    BinAlert.
+
+workaround_transport_delivery_problems(_,_, user_close) ->
+    ok;
+workaround_transport_delivery_problems(Socket, Transport, _) ->
     %% Standard trick to try to make sure all
     %% data sent to to tcp port is really sent
-    %% before tcp port is closed.
+    %% before tcp port is closed so that the peer will
+    %% get a correct error message.
     inet:setopts(Socket, [{active, false}]),
     Transport:shutdown(Socket, write),
     Transport:recv(Socket, 0).
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index f8e5d585e7..1f4c44d115 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2007-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2007-2011. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -28,10 +28,9 @@
 -include("ssl_cipher.hrl").
 -include("ssl_alert.hrl").
 -include("ssl_internal.hrl").
--include("ssl_debug.hrl").
 -include_lib("public_key/include/public_key.hrl").
 
--export([master_secret/4, client_hello/5, server_hello/4, hello/4,
+-export([master_secret/4, client_hello/6, server_hello/4, hello/4,
 	 hello_request/0, certify/6, certificate/3,
 	 client_certificate_verify/5, certificate_verify/5,
 	 certificate_request/2, key_exchange/2, server_key_exchange_hash/2,
@@ -50,13 +49,13 @@
 %%====================================================================
 %%--------------------------------------------------------------------
 -spec client_hello(host(), port_num(), #connection_states{},
-		   #ssl_options{}, boolean()) -> #client_hello{}.
+		   #ssl_options{}, boolean(), der_cert()) -> #client_hello{}.
 %%
 %% Description: Creates a client hello message.
 %%--------------------------------------------------------------------
 client_hello(Host, Port, ConnectionStates, #ssl_options{versions = Versions,
 							ciphers = UserSuites} 
-	     = SslOpts, Renegotiation) ->
+	     = SslOpts, Renegotiation, OwnCert) ->
     
     Fun = fun(Version) ->
 		  ssl_record:protocol_version(Version)
@@ -66,7 +65,7 @@ client_hello(Host, Port, ConnectionStates, #ssl_options{versions = Versions,
     SecParams = Pending#connection_state.security_parameters,
     Ciphers = available_suites(UserSuites, Version),
 
-    Id = ssl_manager:client_session_id(Host, Port, SslOpts),
+    Id = ssl_manager:client_session_id(Host, Port, SslOpts, OwnCert),
 
     #client_hello{session_id = Id, 
 		  client_version = Version,
@@ -195,14 +194,12 @@ certify(#certificate{asn1_certificates = ASN1Certs}, CertDbRef,
 		{fun(OtpCert, ExtensionOrError, {SslState, UserState}) ->
 			 case ssl_certificate:validate_extension(OtpCert,
 								 ExtensionOrError,
-								SslState) of
-			    {valid, _} ->
-				apply_user_fun(Fun, OtpCert,
-					       ExtensionOrError, UserState,
-					       SslState);
-			    {fail, Reason} ->
-				apply_user_fun(Fun, OtpCert, Reason, UserState,
-					       SslState);
+								 SslState) of
+			     {valid, NewSslState} ->
+				 {valid, {NewSslState, UserState}};
+			     {fail, Reason} ->
+				 apply_user_fun(Fun, OtpCert, Reason, UserState,
+						SslState);
 			     {unknown, _} ->
 				 apply_user_fun(Fun, OtpCert,
 						ExtensionOrError, UserState, SslState)
@@ -428,13 +425,11 @@ finished(Version, Role, MasterSecret, {Hashes, _}) -> % use the current hashes
 verify_connection(Version, #finished{verify_data = Data}, 
 		  Role, MasterSecret, {_, {MD5, SHA}}) -> 
     %% use the previous hashes
-    ?DBG_HEX(crypto:md5_final(MD5)),
-    ?DBG_HEX(crypto:sha_final(SHA)),
     case calc_finished(Version, Role, MasterSecret, {MD5, SHA}) of
 	Data ->
 	    verified;
-	_E ->
- 	    ?ALERT_REC(?FATAL, ?HANDSHAKE_FAILURE)
+	_ ->
+	    ?ALERT_REC(?FATAL, ?DECRYPT_ERROR)
     end.
 %%--------------------------------------------------------------------
 -spec server_hello_done() ->  #server_hello_done{}.
@@ -507,11 +502,8 @@ update_hashes(Hashes, % special-case SSL2 client hello
 		   CipherSuites:CSLength/binary,
 		   ChallengeData:CDLength/binary>>);
 update_hashes({{MD50, SHA0}, _Prev}, Data) ->
-    ?DBG_HEX(Data),
     {MD51, SHA1} = {crypto:md5_update(MD50, Data),
 		    crypto:sha_update(SHA0, Data)},
-    ?DBG_HEX(crypto:md5_final(MD51)),
-    ?DBG_HEX(crypto:sha_final(SHA1)),
     {{MD51, SHA1}, {MD50, SHA0}}.
 
 %%--------------------------------------------------------------------
@@ -525,7 +517,7 @@ decrypt_premaster_secret(Secret, RSAPrivateKey) ->
 				   [{rsa_pad, rsa_pkcs1_padding}])
     catch
 	_:_ ->
-	    throw(?ALERT_REC(?FATAL, ?DECRYPTION_FAILED))
+	    throw(?ALERT_REC(?FATAL, ?DECRYPT_ERROR))
     end.
 
 %%--------------------------------------------------------------------
@@ -577,7 +569,7 @@ select_session(Hello, Port, Session, Version,
 	       #ssl_options{ciphers = UserSuites} = SslOpts, Cache, CacheCb, Cert) ->
     SuggestedSessionId = Hello#client_hello.session_id,
     SessionId = ssl_manager:server_session_id(Port, SuggestedSessionId, 
-					      SslOpts),
+					      SslOpts, Cert),
     
     Suites = available_suites(Cert, UserSuites, Version), 
     case ssl_session:is_new(SuggestedSessionId, SessionId) of
@@ -782,8 +774,7 @@ master_secret(Version, MasterSecret, #security_parameters{
      ServerWriteKey, ClientIV, ServerIV} =
 	setup_keys(Version, MasterSecret, ServerRandom, 
 		   ClientRandom, HashSize, KML, EKML, IVS),
-    ?DBG_HEX(ClientWriteKey),
-    ?DBG_HEX(ClientIV),
+
     ConnStates1 = ssl_record:set_master_secret(MasterSecret, ConnectionStates),
     ConnStates2 =
 	ssl_record:set_mac_secret(ClientWriteMacSecret, ServerWriteMacSecret,
@@ -807,8 +798,6 @@ dec_hs(?CLIENT_HELLO, <<?BYTE(Major), ?BYTE(Minor),
 		       ?UINT16(CDLength), 
 		       CipherSuites:CSLength/binary, 
 		       ChallengeData:CDLength/binary>>) ->
-    ?DBG_HEX(CipherSuites),
-    ?DBG_HEX(CipherSuites),
     #client_hello{client_version = {Major, Minor},
 		  random = ssl_ssl2:client_random(ChallengeData, CDLength),
 		  session_id = 0,
diff --git a/lib/ssl/src/ssl_handshake.hrl b/lib/ssl/src/ssl_handshake.hrl
index 74fba3786c..8ae4d2332e 100644
--- a/lib/ssl/src/ssl_handshake.hrl
+++ b/lib/ssl/src/ssl_handshake.hrl
@@ -26,9 +26,17 @@
 -ifndef(ssl_handshake).
 -define(ssl_handshake, true).
 
+-include_lib("public_key/include/public_key.hrl").
+
+-type algo_oid()          :: ?'rsaEncryption' | ?'id-dsa'.
+-type public_key()        :: #'RSAPublicKey'{} | integer().
+-type public_key_params() :: #'Dss-Parms'{} | term().
+-type public_key_info()   :: {algo_oid(), public_key(), public_key_params()}.
+
 -record(session, {
 	  session_id,
 	  peer_certificate,
+	  own_certificate,
 	  compression_method,
 	  cipher_suite,
 	  master_secret,
diff --git a/lib/ssl/src/ssl_internal.hrl b/lib/ssl/src/ssl_internal.hrl
index d2dee4d861..715941e3ad 100644
--- a/lib/ssl/src/ssl_internal.hrl
+++ b/lib/ssl/src/ssl_internal.hrl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2007-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2007-2011. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -19,12 +19,29 @@
 
 %%
 
-
 -ifndef(ssl_internal).
 -define(ssl_internal, true).
 
 -include_lib("public_key/include/public_key.hrl"). 
 
+-type reason()            :: term().
+-type reply()             :: term().
+-type msg()               :: term().
+-type from()              :: term().
+-type host()		  :: string() | tuple().
+-type port_num()	  :: integer().
+-type session_id()        :: 0 | binary().
+-type tls_version()       :: {integer(), integer()}.
+-type tls_atom_version()  :: sslv3 | tlsv1.
+-type cache_ref()         :: term().
+-type certdb_ref()        :: term().
+-type key_algo()          :: null | rsa | dhe_rsa | dhe_dss | dh_anon.
+-type der_cert()          :: binary().
+-type private_key()       :: #'RSAPrivateKey'{} | #'DSAPrivateKey'{}.
+-type issuer()            :: tuple().
+-type serialnumber()      :: integer().
+-type cert_key()          :: {reference(), integer(), issuer()}.
+
 %% basic binary constructors
 -define(BOOLEAN(X),  X:8/unsigned-big-integer).
 -define(BYTE(X),     X:8/unsigned-big-integer).
@@ -93,28 +110,6 @@
 	  active = true
 	 }).
 
--type reason()            :: term().
--type reply()             :: term().
--type msg()               :: term().
--type from()              :: term().
--type host()		  :: string() | tuple().
--type port_num()	  :: integer().
--type session_id()        :: 0 | binary().
--type tls_version()       :: {integer(), integer()}.
--type tls_atom_version()  :: sslv3 | tlsv1.
--type cache_ref()         :: term(). 
--type certdb_ref()        :: term(). 
--type key_algo()          :: null | rsa | dhe_rsa | dhe_dss | dh_anon.
--type enum_algo()          :: integer().
--type public_key()        :: #'RSAPublicKey'{} | integer().
--type public_key_params() :: #'Dss-Parms'{} | term().
--type public_key_info()   :: {enum_algo(), public_key(), public_key_params()}.
--type der_cert()          :: binary().
--type private_key()       :: #'RSAPrivateKey'{} | #'DSAPrivateKey'{}.
--type issuer()            :: tuple().
--type serialnumber()      :: integer().
--type cert_key()          :: {reference(), integer(), issuer()}.
-
 -endif. % -ifdef(ssl_internal).
 
 
diff --git a/lib/ssl/src/ssl_manager.erl b/lib/ssl/src/ssl_manager.erl
index 3b02d96562..f845b1ecc0 100644
--- a/lib/ssl/src/ssl_manager.erl
+++ b/lib/ssl/src/ssl_manager.erl
@@ -29,8 +29,8 @@
 %% Internal application API
 -export([start_link/1, 
 	 connection_init/2, cache_pem_file/1,
-	 lookup_trusted_cert/3, issuer_candidate/1, client_session_id/3, 
-	 server_session_id/3,
+	 lookup_trusted_cert/3, issuer_candidate/1, client_session_id/4,
+	 server_session_id/4,
 	 register_session/2, register_session/3, invalidate_session/2,
 	 invalidate_session/3]).
 
@@ -43,6 +43,7 @@
 
 -include("ssl_handshake.hrl").
 -include("ssl_internal.hrl").
+-include_lib("kernel/include/file.hrl").
 
 -record(state, {
 	  session_cache,
@@ -76,16 +77,17 @@ start_link(Opts) ->
 connection_init(Trustedcerts, Role) ->
     call({connection_init, Trustedcerts, Role}).
 %%--------------------------------------------------------------------
--spec cache_pem_file(string()) -> {ok, term()}.	
+-spec cache_pem_file(string()) -> {ok, term()} | {error, reason()}.
 %%		    
-%% Description: Cach a pem file and 
+%% Description: Cach a pem file and return its content.
 %%--------------------------------------------------------------------
-cache_pem_file(File) ->   
-    case ssl_certificate_db:lookup_cached_certs(File) of
-	[{_,Content}] ->
-	    {ok, Content};
-	[] ->
-	    call({cache_pem, File})
+cache_pem_file(File) ->
+    try file:read_file_info(File) of
+	{ok, #file_info{mtime = LastWrite}} ->
+	    cache_pem_file(File, LastWrite)
+    catch
+	_:Reason ->
+	    {error, Reason}
     end.
 %%--------------------------------------------------------------------
 -spec lookup_trusted_cert(reference(), serialnumber(), issuer()) -> 
@@ -106,20 +108,21 @@ lookup_trusted_cert(Ref, SerialNumber, Issuer) ->
 issuer_candidate(PrevCandidateKey) ->
     ssl_certificate_db:issuer_candidate(PrevCandidateKey).
 %%--------------------------------------------------------------------
--spec client_session_id(host(), port_num(), #ssl_options{}) -> session_id().
+-spec client_session_id(host(), port_num(), #ssl_options{},
+			der_cert() | undefined) -> session_id().
 %%
 %% Description: Select a session id for the client.
 %%--------------------------------------------------------------------
-client_session_id(Host, Port, SslOpts) ->
-    call({client_session_id, Host, Port, SslOpts}).
+client_session_id(Host, Port, SslOpts, OwnCert) ->
+    call({client_session_id, Host, Port, SslOpts, OwnCert}).
 
 %%--------------------------------------------------------------------
--spec server_session_id(host(), port_num(), #ssl_options{}) -> session_id().
+-spec server_session_id(host(), port_num(), #ssl_options{}, der_cert()) -> session_id().
 %%
 %% Description: Select a session id for the server.
 %%--------------------------------------------------------------------
-server_session_id(Port, SuggestedSessionId, SslOpts) ->
-    call({server_session_id, Port, SuggestedSessionId, SslOpts}).
+server_session_id(Port, SuggestedSessionId, SslOpts, OwnCert) ->
+    call({server_session_id, Port, SuggestedSessionId, SslOpts, OwnCert}).
 
 %%--------------------------------------------------------------------
 -spec register_session(port_num(), #session{}) -> ok.
@@ -201,28 +204,35 @@ handle_call({{connection_init, Trustedcerts, _Role}, Pid}, _From,
 	end,
     {reply, Result, State};
 
-handle_call({{client_session_id, Host, Port, SslOpts}, _}, _, 
+handle_call({{client_session_id, Host, Port, SslOpts, OwnCert}, _}, _,
 	    #state{session_cache = Cache,
 		  session_cache_cb = CacheCb} = State) ->
-    Id = ssl_session:id({Host, Port, SslOpts}, Cache, CacheCb),
+    Id = ssl_session:id({Host, Port, SslOpts}, Cache, CacheCb, OwnCert),
     {reply, Id, State};
 
-handle_call({{server_session_id, Port, SuggestedSessionId, SslOpts}, _},
+handle_call({{server_session_id, Port, SuggestedSessionId, SslOpts, OwnCert}, _},
 	    _, #state{session_cache_cb = CacheCb,
 		      session_cache = Cache,
 		      session_lifetime = LifeTime} = State) ->
     Id = ssl_session:id(Port, SuggestedSessionId, SslOpts,
-			Cache, CacheCb, LifeTime),
+			Cache, CacheCb, LifeTime, OwnCert),
     {reply, Id, State};
 
-handle_call({{cache_pem, File},Pid}, _, State = #state{certificate_db = Db}) ->
-    try ssl_certificate_db:cache_pem_file(Pid,File,Db) of
+handle_call({{cache_pem, File, LastWrite}, Pid}, _, 
+	    #state{certificate_db = Db} = State) ->
+    try ssl_certificate_db:cache_pem_file(Pid, File, LastWrite, Db) of
 	Result ->
 	    {reply, Result, State}
     catch 
 	_:Reason ->
 	    {reply, {error, Reason}, State}
-    end.
+    end;
+handle_call({{recache_pem, File, LastWrite}, Pid}, From,
+	    #state{certificate_db = Db} = State) ->
+    ssl_certificate_db:uncache_pem_file(File, Db),
+    cast({recache_pem, File, LastWrite, Pid, From}),
+    {noreply, State}.
+
 %%--------------------------------------------------------------------
 -spec  handle_cast(msg(), #state{}) -> {noreply, #state{}}.
 %% Possible return values not used now.  
@@ -259,7 +269,21 @@ handle_cast({invalidate_session, Port, #session{session_id = ID}},
 	    #state{session_cache = Cache,
 		   session_cache_cb = CacheCb} = State) ->
     CacheCb:delete(Cache, {Port, ID}),
-    {noreply, State}.
+    {noreply, State};
+
+handle_cast({recache_pem, File, LastWrite, Pid, From},
+	    #state{certificate_db = [_, FileToRefDb, _]} = State0) ->
+    case ssl_certificate_db:lookup(File, FileToRefDb) of
+	undefined ->
+	    {reply, Msg, State} = handle_call({{cache_pem, File, LastWrite}, Pid}, From, State0),
+	    gen_server:reply(From, Msg),
+	    {noreply, State};
+	_ -> %% Send message to self letting cleanup messages be handled
+	     %% first so that no reference to the old version of file
+             %% exists when we cache the new one.
+	    cast({recache_pem, File, LastWrite, Pid, From}),
+	    {noreply, State0}
+    end.
 
 %%--------------------------------------------------------------------
 -spec handle_info(msg(), #state{}) -> {noreply, #state{}}.
@@ -286,12 +310,14 @@ handle_info({'EXIT', _, _}, State) ->
 handle_info({'DOWN', _Ref, _Type, _Pid, ecacertfile}, State) ->
     {noreply, State};
 
+handle_info({'DOWN', _Ref, _Type, Pid, shutdown}, State) ->
+    handle_info({remove_trusted_certs, Pid}, State);
 handle_info({'DOWN', _Ref, _Type, Pid, _Reason}, State) ->
     erlang:send_after(?CERTIFICATE_CACHE_CLEANUP, self(), 
 		      {remove_trusted_certs, Pid}),
     {noreply, State};
 handle_info({remove_trusted_certs, Pid}, 
-	    State = #state{certificate_db = Db}) ->
+	    #state{certificate_db = Db} = State) ->
     ssl_certificate_db:remove_trusted_certs(Pid, Db),
     {noreply, State};
 
@@ -362,3 +388,16 @@ session_validation({{{Host, Port}, _}, Session}, LifeTime) ->
 session_validation({{Port, _}, Session}, LifeTime) ->
     validate_session(Port, Session, LifeTime),
     LifeTime.
+
+cache_pem_file(File, LastWrite) ->
+    case ssl_certificate_db:lookup_cached_certs(File) of
+	[{_, {Mtime, Content}}] ->
+	    case LastWrite of
+		Mtime ->
+		    {ok, Content};
+		_ ->
+		    call({recache_pem, File, LastWrite})
+	    end;
+	[] ->
+	    call({cache_pem, File, LastWrite})
+    end.
diff --git a/lib/ssl/src/ssl_record.erl b/lib/ssl/src/ssl_record.erl
index 803baeb09c..f1c0073965 100644
--- a/lib/ssl/src/ssl_record.erl
+++ b/lib/ssl/src/ssl_record.erl
@@ -30,7 +30,6 @@
 -include("ssl_alert.hrl").
 -include("ssl_handshake.hrl").
 -include("ssl_cipher.hrl").
--include("ssl_debug.hrl").
 
 %% Connection state handling
 -export([init_connection_states/1, 
@@ -649,9 +648,7 @@ cipher(Type, Version, Fragment, CS0) ->
 						      BCA}
 				}} = 
 	hash_and_bump_seqno(CS0, Type, Version, Length, Fragment),
-    ?DBG_HEX(Fragment),
     {Ciphered, CipherS1} = ssl_cipher:cipher(BCA, CipherS0, MacHash, Fragment),
-    ?DBG_HEX(Ciphered),
     CS2 = CS1#connection_state{cipher_state=CipherS1},
     {Ciphered, CS2}.
 
diff --git a/lib/ssl/src/ssl_session.erl b/lib/ssl/src/ssl_session.erl
index 25e7445180..dc4b7a711c 100644
--- a/lib/ssl/src/ssl_session.erl
+++ b/lib/ssl/src/ssl_session.erl
@@ -28,7 +28,7 @@
 -include("ssl_internal.hrl").
 
 %% Internal application API
--export([is_new/2, id/3, id/6, valid_session/2]).
+-export([is_new/2, id/4, id/7, valid_session/2]).
 
 -define(GEN_UNIQUE_ID_MAX_TRIES, 10).
 
@@ -48,13 +48,14 @@ is_new(_ClientSuggestion, _ServerDecision) ->
     true.
 
 %%--------------------------------------------------------------------
--spec id({host(), port_num(), #ssl_options{}}, cache_ref(), atom()) -> binary().
+-spec id({host(), port_num(), #ssl_options{}}, cache_ref(), atom(),
+	 undefined | binary()) -> binary().
 %%
 %% Description: Should be called by the client side to get an id 
 %%              for the client hello message.
 %%--------------------------------------------------------------------
-id(ClientInfo, Cache, CacheCb) ->
-    case select_session(ClientInfo, Cache, CacheCb) of
+id(ClientInfo, Cache, CacheCb, OwnCert) ->
+    case select_session(ClientInfo, Cache, CacheCb, OwnCert) of
 	no_session ->
 	    <<>>;
 	SessionId ->
@@ -63,19 +64,19 @@ id(ClientInfo, Cache, CacheCb) ->
 
 %%--------------------------------------------------------------------
 -spec id(port_num(), binary(), #ssl_options{}, cache_ref(), 
-	 atom(), seconds()) -> binary().
+	 atom(), seconds(), binary()) -> binary().
 %%
 %% Description: Should be called by the server side to get an id 
 %%              for the server hello message.
 %%--------------------------------------------------------------------
-id(Port, <<>>, _, Cache, CacheCb, _) ->
+id(Port, <<>>, _, Cache, CacheCb, _, _) ->
     new_id(Port, ?GEN_UNIQUE_ID_MAX_TRIES, Cache, CacheCb);
 
 id(Port, SuggestedSessionId, #ssl_options{reuse_sessions = ReuseEnabled,
 					  reuse_session = ReuseFun}, 
-   Cache, CacheCb, SecondLifeTime) ->
+   Cache, CacheCb, SecondLifeTime, OwnCert) ->
     case is_resumable(SuggestedSessionId, Port, ReuseEnabled, 
-		      ReuseFun, Cache, CacheCb, SecondLifeTime) of
+		      ReuseFun, Cache, CacheCb, SecondLifeTime, OwnCert) of
 	true ->
 	    SuggestedSessionId;
 	false ->
@@ -93,19 +94,20 @@ valid_session(#session{time_stamp = TimeStamp}, LifeTime) ->
 %%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
-select_session({HostIP, Port, SslOpts}, Cache, CacheCb) ->    
+select_session({HostIP, Port, SslOpts}, Cache, CacheCb, OwnCert) ->
     Sessions = CacheCb:select_session(Cache, {HostIP, Port}),
-    select_session(Sessions, SslOpts).
+    select_session(Sessions, SslOpts, OwnCert).
 
-select_session([], _) ->
+select_session([], _, _) ->
     no_session;
 
 select_session(Sessions, #ssl_options{ciphers = Ciphers,
-				      reuse_sessions = ReuseSession}) ->
+				      reuse_sessions = ReuseSession}, OwnCert) ->
     IsResumable = 
  	fun(Session) -> 
  		ReuseSession andalso (Session#session.is_resumable) andalso  
  		    lists:member(Session#session.cipher_suite, Ciphers)
+		    andalso (OwnCert == Session#session.own_certificate)
  	end,
     case [Id || [Id, Session] <- Sessions, IsResumable(Session)] of
  	[] ->
@@ -140,14 +142,16 @@ new_id(Port, Tries, Cache, CacheCb) ->
     end.
 
 is_resumable(SuggestedSessionId, Port, ReuseEnabled, ReuseFun, Cache, 
-	     CacheCb, SecondLifeTime) ->
+	     CacheCb, SecondLifeTime, OwnCert) ->
     case CacheCb:lookup(Cache, {Port, SuggestedSessionId}) of
 	#session{cipher_suite = CipherSuite,
+		 own_certificate = SessionOwnCert,
 		 compression_method = Compression,
 		 is_resumable = Is_resumable,
 		 peer_certificate = PeerCert} = Session ->
 	    ReuseEnabled 
 		andalso Is_resumable  
+		andalso (OwnCert == SessionOwnCert)
 		andalso valid_session(Session, SecondLifeTime) 
 		andalso ReuseFun(SuggestedSessionId, PeerCert, 
 				 Compression, CipherSuite);
diff --git a/lib/ssl/src/ssl_ssl3.erl b/lib/ssl/src/ssl_ssl3.erl
index f3cb6ad66e..f2926b2d2f 100644
--- a/lib/ssl/src/ssl_ssl3.erl
+++ b/lib/ssl/src/ssl_ssl3.erl
@@ -25,7 +25,6 @@
 -module(ssl_ssl3).
 
 -include("ssl_cipher.hrl").
--include("ssl_debug.hrl").
 -include("ssl_internal.hrl").
 -include("ssl_record.hrl"). 			% MD5 and SHA
 
@@ -41,9 +40,6 @@
 -spec master_secret(binary(), binary(), binary()) -> binary().
 
 master_secret(PremasterSecret, ClientRandom, ServerRandom) ->
-    ?DBG_HEX(PremasterSecret),
-    ?DBG_HEX(ClientRandom),
-    ?DBG_HEX(ServerRandom),
     %%  draft-ietf-tls-ssl-version3-00 - 6.2.2 
     %% key_block =
     %%   MD5(master_secret + SHA(`A' + master_secret +
@@ -55,9 +51,8 @@ master_secret(PremasterSecret, ClientRandom, ServerRandom) ->
     %%   MD5(master_secret + SHA(`CCC' + master_secret +
     %%                           ServerHello.random +
     %%                           ClientHello.random)) + [...];
-    B = generate_keyblock(PremasterSecret, ClientRandom, ServerRandom, 48),
-    ?DBG_HEX(B),
-    B.
+    Block = generate_keyblock(PremasterSecret, ClientRandom, ServerRandom, 48),
+    Block.
 
 -spec finished(client | server, binary(), {binary(), binary()}) -> binary().
 
@@ -107,17 +102,9 @@ mac_hash(Method, Mac_write_secret, Seq_num, Type, Length, Fragment) ->
     %%      hash(MAC_write_secret + pad_1 + seq_num +
     %%           SSLCompressed.type + SSLCompressed.length +
     %%           SSLCompressed.fragment));
-    case Method of
-        ?NULL -> ok;
-        _ ->
-	    ?DBG_HEX(Mac_write_secret),
-	    ?DBG_HEX(hash(Method, Fragment)),
-            ok
-    end,
     Mac = mac_hash(Method, Mac_write_secret, 
 		   [<<?UINT64(Seq_num), ?BYTE(Type), 
 		     ?UINT16(Length)>>, Fragment]),
-    ?DBG_HEX(Mac),
     Mac.
 
 -spec setup_keys(binary(), binary(), binary(),  
@@ -139,12 +126,6 @@ setup_keys(MasterSecret, ServerRandom, ClientRandom, HS, KML, _EKML, IVS) ->
     <<ClientWriteMacSecret:HS/binary, ServerWriteMacSecret:HS/binary,
      ClientWriteKey:KML/binary, ServerWriteKey:KML/binary,
      ClientIV:IVS/binary, ServerIV:IVS/binary>> = KeyBlock,
-    ?DBG_HEX(ClientWriteMacSecret),
-    ?DBG_HEX(ServerWriteMacSecret),
-    ?DBG_HEX(ClientWriteKey),
-    ?DBG_HEX(ServerWriteKey),
-    ?DBG_HEX(ClientIV),
-    ?DBG_HEX(ServerIV),
     {ClientWriteMacSecret, ServerWriteMacSecret, ClientWriteKey,
      ServerWriteKey, ClientIV, ServerIV}.
 
diff --git a/lib/ssl/src/ssl_tls1.erl b/lib/ssl/src/ssl_tls1.erl
index dd66418dd8..5f9850c386 100644
--- a/lib/ssl/src/ssl_tls1.erl
+++ b/lib/ssl/src/ssl_tls1.erl
@@ -27,7 +27,6 @@
 -include("ssl_cipher.hrl").
 -include("ssl_internal.hrl").
 -include("ssl_record.hrl"). 			
--include("ssl_debug.hrl").
 
 -export([master_secret/3, finished/3, certificate_verify/2, mac_hash/7, 
 	 setup_keys/6, suites/0]).
@@ -129,18 +128,10 @@ mac_hash(Method, Mac_write_secret, Seq_num, Type, {Major, Minor},
     %% HMAC_hash(MAC_write_secret, seq_num + TLSCompressed.type +
     %%              TLSCompressed.version + TLSCompressed.length +
     %%              TLSCompressed.fragment));
-    case Method of
-        ?NULL -> ok;
-        _ ->
-	    ?DBG_HEX(Mac_write_secret),
-	    ?DBG_HEX(hash(Method, Fragment)),
-            ok
-    end,
     Mac = hmac_hash(Method, Mac_write_secret, 
 		    [<<?UINT64(Seq_num), ?BYTE(Type), 
 		      ?BYTE(Major), ?BYTE(Minor), ?UINT16(Length)>>, 
 		     Fragment]),
-    ?DBG_HEX(Mac),
     Mac.
 
 -spec suites() -> [cipher_suite()].
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index ea84b3c9d1..6a1b83d344 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2007-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2007-2011. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -27,10 +27,12 @@
 -include("test_server.hrl").
 -include("test_server_line.hrl").
 -include_lib("public_key/include/public_key.hrl").
+
 -include("ssl_alert.hrl").
 
 -define('24H_in_sec', 86400).  
 -define(TIMEOUT, 60000).
+-define(LONG_TIMEOUT, 600000).
 -define(EXPIRE, 10).
 -define(SLEEP, 500).
 
@@ -45,21 +47,24 @@
 %% variable, but should NOT alter/remove any existing entries.
 %%--------------------------------------------------------------------
 init_per_suite(Config0) ->
-    Dog = ssl_test_lib:timetrap(?TIMEOUT *2),
-    crypto:start(),
-    application:start(public_key),
-    ssl:start(),
-    
-    %% make rsa certs using oppenssl
-    Result = 
-	(catch make_certs:all(?config(data_dir, Config0), 
-			      ?config(priv_dir, Config0))),
-    test_server:format("Make certs  ~p~n", [Result]),
-
-    Config1 = ssl_test_lib:make_dsa_cert(Config0),
-    Config = ssl_test_lib:cert_options(Config1),
-    [{watchdog, Dog} | Config].
-
+    Dog = ssl_test_lib:timetrap(?LONG_TIMEOUT *2),
+    case application:start(crypto) of
+	ok ->
+	    application:start(public_key),
+	    ssl:start(),
+
+	    %% make rsa certs using oppenssl
+	    Result =
+		(catch make_certs:all(?config(data_dir, Config0),
+				      ?config(priv_dir, Config0))),
+	    test_server:format("Make certs  ~p~n", [Result]),
+
+	    Config1 = ssl_test_lib:make_dsa_cert(Config0),
+	    Config = ssl_test_lib:cert_options(Config1),
+	    [{watchdog, Dog} | Config];
+	_ ->
+	    {skip, "Crypto did not start"}
+    end.
 %%--------------------------------------------------------------------
 %% Function: end_per_suite(Config) -> _
 %% Config - [tuple()]
@@ -68,7 +73,7 @@ init_per_suite(Config0) ->
 %%--------------------------------------------------------------------
 end_per_suite(_Config) ->
     ssl:stop(),
-    crypto:stop().
+    application:stop(crypto).
 
 %%--------------------------------------------------------------------
 %% Function: init_per_testcase(TestCase, Config) -> Config
@@ -124,6 +129,9 @@ init_per_testcase(empty_protocol_versions, Config)  ->
     ssl:start(),
     Config;
 
+init_per_testcase(different_ca_peer_sign, Config0) ->
+    ssl_test_lib:make_mix_cert(Config0);
+
 init_per_testcase(_TestCase, Config0) ->
     Config = lists:keydelete(watchdog, 1, Config0),
     Dog = test_server:timetrap(?TIMEOUT),
@@ -199,12 +207,16 @@ all(suite) ->
      server_does_not_want_to_reuse_session, client_renegotiate,
      server_renegotiate, client_renegotiate_reused_session,
      server_renegotiate_reused_session, client_no_wrap_sequence_number,
-     server_no_wrap_sequence_number, extended_key_usage,
+     server_no_wrap_sequence_number,
+     extended_key_usage_verify_peer, extended_key_usage_verify_none,
      no_authority_key_identifier,
      invalid_signature_client, invalid_signature_server, cert_expired,
      client_with_cert_cipher_suites_handshake, unknown_server_ca_fail,
      der_input, unknown_server_ca_accept_verify_none, unknown_server_ca_accept_verify_peer,
-     unknown_server_ca_accept_backwardscompatibilty
+     unknown_server_ca_accept_backwardscompatibilty,
+     %different_ca_peer_sign,
+     no_reuses_session_server_restart_new_cert,
+     no_reuses_session_server_restart_new_cert_file, reuseaddr
     ].
 
 %% Test cases starts here.
@@ -320,7 +332,6 @@ basic_test(Config) ->
     
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client).
-
 %%--------------------------------------------------------------------
 
 controlling_process(doc) -> 
@@ -520,9 +531,7 @@ client_closes_socket(Config) when is_list(Config) ->
     
     _Client = spawn_link(Connect),
 
-    ssl_test_lib:check_result(Server, {error,closed}),
-    
-    ssl_test_lib:close(Server).
+    ssl_test_lib:check_result(Server, {error,closed}).
 
 %%--------------------------------------------------------------------
 
@@ -737,7 +746,6 @@ socket_options(Config) when is_list(Config) ->
     ssl_test_lib:check_result(Server, ok, Client, ok),
 
     ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client),
     
     {ok, Listen} = ssl:listen(0, ServerOpts),
     {ok,[{mode,list}]} = ssl:getopts(Listen, [mode]),
@@ -840,6 +848,7 @@ send_recv(Config) when is_list(Config) ->
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client).
 
+%%--------------------------------------------------------------------
 send_close(doc) -> 
     [""];
 
@@ -866,8 +875,7 @@ send_close(Config) when is_list(Config) ->
     ok = ssl:send(SslS, "Hello world"),      
     {ok,<<"Hello world">>} = ssl:recv(SslS, 11),    
     gen_tcp:close(TcpS),    
-    {error, _} = ssl:send(SslS, "Hello world"),    
-    ssl_test_lib:close(Server).
+    {error, _} = ssl:send(SslS, "Hello world").
 
 %%--------------------------------------------------------------------
 close_transport_accept(doc) ->
@@ -1042,8 +1050,7 @@ tcp_connect(Config) when is_list(Config) ->
 		{Server, {error, Error}} ->
 		    test_server:format("Error ~p", [Error])
 	    end
-    end,
-    ssl_test_lib:close(Server).
+    end.
 
 
 dummy(_Socket) ->
@@ -1148,13 +1155,13 @@ ecertfile(Config) when is_list(Config) ->
     
 
 %%--------------------------------------------------------------------
-ecacertfile(doc) -> 
+ecacertfile(doc) ->
     ["Test what happens with an invalid cacert file"];
 
-ecacertfile(suite) -> 
+ecacertfile(suite) ->
     [];
 
-ecacertfile(Config) when is_list(Config) -> 
+ecacertfile(Config) when is_list(Config) ->
     ClientOpts    = [{reuseaddr, true}|?config(client_opts, Config)],
     ServerBadOpts = [{reuseaddr, true}|?config(server_bad_ca, Config)],
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
@@ -1531,7 +1538,7 @@ erlang_cipher_suite(Suite) ->
     Suite.
 
 cipher(CipherSuite, Version, Config, ClientOpts, ServerOpts) ->   
-    process_flag(trap_exit, true),
+    %% process_flag(trap_exit, true),
     test_server:format("Testing CipherSuite ~p~n", [CipherSuite]),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     
@@ -1555,16 +1562,8 @@ cipher(CipherSuite, Version, Config, ClientOpts, ServerOpts) ->
     Result = ssl_test_lib:wait_for_result(Server, ok, Client, ok),   
  
     ssl_test_lib:close(Server),
-    receive 
-	{'EXIT', Server, normal} ->
-	    ok
-     end,
     ssl_test_lib:close(Client),
-    receive 
-	{'EXIT', Client, normal} ->
-	    ok
-    end,
-    process_flag(trap_exit, false),
+
     case Result of
 	ok ->
 	    [];
@@ -1606,7 +1605,6 @@ reuse_session(suite) ->
     [];
 
 reuse_session(Config) when is_list(Config) -> 
-    process_flag(trap_exit, true),
     ClientOpts = ?config(client_opts, Config),
     ServerOpts = ?config(server_opts, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
@@ -1614,13 +1612,13 @@ reuse_session(Config) when is_list(Config) ->
     Server = 
 	ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
 				   {from, self()},
-		      {mfa, {?MODULE, session_info_result, []}},
-		      {options, ServerOpts}]),
+				   {mfa, {?MODULE, session_info_result, []}},
+				   {options, ServerOpts}]),
     Port = ssl_test_lib:inet_port(Server),
     Client0 =
 	ssl_test_lib:start_client([{node, ClientNode}, 
 		      {port, Port}, {host, Hostname},
-			    {mfa, {ssl_test_lib, no_result, []}},
+				   {mfa, {ssl_test_lib, no_result, []}},
 		      {from, self()},  {options, ClientOpts}]),   
     SessionInfo = 
 	receive
@@ -1628,16 +1626,16 @@ reuse_session(Config) when is_list(Config) ->
 		Info
 	end,
        
-    Server ! listen,
+    Server ! {listen, {mfa, {ssl_test_lib, no_result, []}}},
     
     %% Make sure session is registered
     test_server:sleep(?SLEEP),
 
     Client1 =
-	ssl_test_lib:start_client([{node, ClientNode}, 
-		      {port, Port}, {host, Hostname},
-		      {mfa, {?MODULE, session_info_result, []}},
-		      {from, self()},  {options, ClientOpts}]),    
+	ssl_test_lib:start_client([{node, ClientNode},
+				   {port, Port}, {host, Hostname},
+				   {mfa, {?MODULE, session_info_result, []}},
+				   {from, self()},  {options, ClientOpts}]),
     receive
 	{Client1, SessionInfo} ->
 	    ok;
@@ -1647,10 +1645,10 @@ reuse_session(Config) when is_list(Config) ->
 	    test_server:fail(session_not_reused)
     end,
     
-    Server ! listen,
+    Server !  {listen, {mfa, {ssl_test_lib, no_result, []}}},
     
     Client2 =
-	ssl_test_lib:start_client([{node, ClientNode}, 
+	ssl_test_lib:start_client([{node, ClientNode},
 		      {port, Port}, {host, Hostname},
 			    {mfa, {?MODULE, session_info_result, []}},
 		      {from, self()},  {options, [{reuse_sessions, false}
@@ -1664,10 +1662,6 @@ reuse_session(Config) when is_list(Config) ->
     end,
     
     ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client0),
-    ssl_test_lib:close(Client1),
-    ssl_test_lib:close(Client2),
-
 
     Server1 = 
 	ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
@@ -1679,7 +1673,7 @@ reuse_session(Config) when is_list(Config) ->
     Client3 =
 	ssl_test_lib:start_client([{node, ClientNode}, 
 				   {port, Port1}, {host, Hostname},
-				   {mfa, {?MODULE, session_info_result, []}},
+				   {mfa, {ssl_test_lib, no_result, []}},
 				   {from, self()},  {options, ClientOpts}]), 
 
     SessionInfo1 = 
@@ -1688,7 +1682,7 @@ reuse_session(Config) when is_list(Config) ->
 		Info1
 	end,
        
-    Server1 ! listen,
+    Server1 ! {listen, {mfa, {ssl_test_lib, no_result, []}}},
     
     %% Make sure session is registered
     test_server:sleep(?SLEEP),
@@ -1704,14 +1698,16 @@ reuse_session(Config) when is_list(Config) ->
 	    test_server:fail(
 	      session_reused_when_session_reuse_disabled_by_server);
 	{Client4, _Other} ->
+	    test_server:format("OTHER: ~p ~n", [_Other]),
 	    ok
     end,
-    
+
     ssl_test_lib:close(Server1),
+    ssl_test_lib:close(Client0),
+    ssl_test_lib:close(Client1),
+    ssl_test_lib:close(Client2),
     ssl_test_lib:close(Client3),
-    ssl_test_lib:close(Client4),
-    process_flag(trap_exit, false).
-
+    ssl_test_lib:close(Client4).
 
 session_info_result(Socket) ->                                            
     ssl:session_info(Socket).
@@ -1724,7 +1720,6 @@ reuse_session_expired(suite) ->
     [];
 
 reuse_session_expired(Config) when is_list(Config) -> 
-    process_flag(trap_exit, true),
     ClientOpts = ?config(client_opts, Config),
     ServerOpts = ?config(server_opts, Config),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
@@ -1745,8 +1740,8 @@ reuse_session_expired(Config) when is_list(Config) ->
 	    {Server, Info} ->
 		Info
 	end,
-       
-    Server ! listen,
+
+    Server ! {listen, {mfa, {ssl_test_lib, no_result, []}}},
     
     %% Make sure session is registered
     test_server:sleep(?SLEEP),
@@ -1766,7 +1761,7 @@ reuse_session_expired(Config) when is_list(Config) ->
     end,
     
     Server ! listen,
-    
+
     %% Make sure session is unregistered due to expiration
     test_server:sleep((?EXPIRE+1) * 1000),
     
@@ -1781,12 +1776,12 @@ reuse_session_expired(Config) when is_list(Config) ->
 	{Client2, _} ->
 	    ok
     end,
-    
+    process_flag(trap_exit, false),
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client0),
     ssl_test_lib:close(Client1),
-    ssl_test_lib:close(Client2),
-    process_flag(trap_exit, false).
+    ssl_test_lib:close(Client2).
+
 %%--------------------------------------------------------------------
 server_does_not_want_to_reuse_session(doc) -> 
     ["Test reuse of sessions (short handshake)"];
@@ -1819,10 +1814,11 @@ server_does_not_want_to_reuse_session(Config) when is_list(Config) ->
 		Info
 	end,
        
-    Server ! listen,
+    Server ! {listen, {mfa, {ssl_test_lib, no_result, []}}},
     
     %% Make sure session is registered
     test_server:sleep(?SLEEP),
+    ssl_test_lib:close(Client0),
 
     Client1 =
 	ssl_test_lib:start_client([{node, ClientNode}, 
@@ -1835,11 +1831,9 @@ server_does_not_want_to_reuse_session(Config) when is_list(Config) ->
 	{Client1, _Other} ->
 	   ok
     end,
-    
+
     ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client0),
-    ssl_test_lib:close(Client1),
-    process_flag(trap_exit, false).
+    ssl_test_lib:close(Client1).
 
 %%--------------------------------------------------------------------
 
@@ -2006,6 +2000,7 @@ server_verify_none_active_once(Config) when is_list(Config) ->
     ssl_test_lib:check_result(Server, ok, Client, ok),
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client).
+
 %%--------------------------------------------------------------------
 
 server_verify_client_once_passive(doc) -> 
@@ -2033,7 +2028,7 @@ server_verify_client_once_passive(Config) when is_list(Config) ->
     
     ssl_test_lib:check_result(Server, ok, Client0, ok),
     ssl_test_lib:close(Client0),
-    Server ! listen,
+    Server ! {listen, {mfa, {ssl_test_lib, no_result, []}}},
     Client1 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
 					{host, Hostname},
 					{from, self()}, 
@@ -2071,7 +2066,7 @@ server_verify_client_once_active(Config) when is_list(Config) ->
     
     ssl_test_lib:check_result(Server, ok, Client0, ok),
     ssl_test_lib:close(Client0),
-    Server ! listen,
+    Server ! {listen, {mfa, {ssl_test_lib, no_result, []}}},
     Client1 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
 					{host, Hostname},
 					{from, self()}, 
@@ -2082,7 +2077,6 @@ server_verify_client_once_active(Config) when is_list(Config) ->
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client1).
     
-
 %%--------------------------------------------------------------------
 
 server_verify_client_once_active_once(doc) -> 
@@ -2110,18 +2104,17 @@ server_verify_client_once_active_once(Config) when is_list(Config) ->
     
     ssl_test_lib:check_result(Server, ok, Client0, ok),
     ssl_test_lib:close(Client0),
-    Server ! listen,
-    
+    Server ! {listen, {mfa, {ssl_test_lib, no_result, []}}},
     Client1 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {?MODULE, result_ok, []}},
-					{options, [{active, once} | ClientOpts]}]),
+					 {host, Hostname},
+					 {from, self()},
+					 {mfa, {?MODULE, result_ok, []}},
+					 {options, [{active, once} | ClientOpts]}]),
     
     ssl_test_lib:check_result(Client1, ok),
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client1).
-    
+
 %%--------------------------------------------------------------------
 
 server_verify_no_cacerts(doc) -> 
@@ -2129,9 +2122,8 @@ server_verify_no_cacerts(doc) ->
 
 server_verify_no_cacerts(suite) -> 
     [];
-
 server_verify_no_cacerts(Config) when is_list(Config) ->
-    ServerOpts =  ServerOpts =  ?config(server_opts, Config), 
+    ServerOpts =  ?config(server_opts, Config),
     {_, ServerNode, _} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0}, 
 					      {from, self()}, 
@@ -2292,8 +2284,6 @@ client_verify_none_active_once(Config) when is_list(Config) ->
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client).
 
-
-
 %%--------------------------------------------------------------------
 client_renegotiate(doc) -> 
     ["Test ssl:renegotiate/1 on client."];
@@ -2302,7 +2292,6 @@ client_renegotiate(suite) ->
     [];
 
 client_renegotiate(Config) when is_list(Config) ->
-    process_flag(trap_exit, true),
     ServerOpts = ?config(server_opts, Config),  
     ClientOpts = ?config(client_opts, Config),  
 
@@ -2325,11 +2314,9 @@ client_renegotiate(Config) when is_list(Config) ->
 					{options, [{reuse_sessions, false} | ClientOpts]}]),
     
     ssl_test_lib:check_result(Client, ok, Server, ok), 
-
     ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client),
-    process_flag(trap_exit, false),
-    ok.
+    ssl_test_lib:close(Client).
+
 %%--------------------------------------------------------------------
 server_renegotiate(doc) -> 
     ["Test ssl:renegotiate/1 on server."];
@@ -2338,7 +2325,6 @@ server_renegotiate(suite) ->
     [];
 
 server_renegotiate(Config) when is_list(Config) ->
-    process_flag(trap_exit, true),
     ServerOpts = ?config(server_opts, Config),  
     ClientOpts = ?config(client_opts, Config),  
 
@@ -2361,8 +2347,7 @@ server_renegotiate(Config) when is_list(Config) ->
     
     ssl_test_lib:check_result(Server, ok, Client, ok),
     ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client),
-    ok.
+    ssl_test_lib:close(Client).
 
 %%--------------------------------------------------------------------
 client_renegotiate_reused_session(doc) -> 
@@ -2372,7 +2357,6 @@ client_renegotiate_reused_session(suite) ->
     [];
 
 client_renegotiate_reused_session(Config) when is_list(Config) ->
-    process_flag(trap_exit, true),
     ServerOpts = ?config(server_opts, Config),  
     ClientOpts = ?config(client_opts, Config),  
 
@@ -2395,11 +2379,8 @@ client_renegotiate_reused_session(Config) when is_list(Config) ->
 					{options, [{reuse_sessions, true} | ClientOpts]}]),
     
     ssl_test_lib:check_result(Client, ok, Server, ok), 
-
     ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client),
-    process_flag(trap_exit, false),
-    ok.
+    ssl_test_lib:close(Client).
 %%--------------------------------------------------------------------
 server_renegotiate_reused_session(doc) -> 
     ["Test ssl:renegotiate/1 on server when the ssl session will be reused."];
@@ -2408,7 +2389,6 @@ server_renegotiate_reused_session(suite) ->
     [];
 
 server_renegotiate_reused_session(Config) when is_list(Config) ->
-    process_flag(trap_exit, true),
     ServerOpts = ?config(server_opts, Config),  
     ClientOpts = ?config(client_opts, Config),  
 
@@ -2431,9 +2411,7 @@ server_renegotiate_reused_session(Config) when is_list(Config) ->
     
     ssl_test_lib:check_result(Server, ok, Client, ok),
     ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client),
-    ok.
-
+    ssl_test_lib:close(Client).
 %%--------------------------------------------------------------------
 client_no_wrap_sequence_number(doc) -> 
     ["Test that erlang client will renegotiate session when",  
@@ -2445,7 +2423,6 @@ client_no_wrap_sequence_number(suite) ->
     [];
 
 client_no_wrap_sequence_number(Config) when is_list(Config) ->
-    process_flag(trap_exit, true),
     ServerOpts = ?config(server_opts, Config),  
     ClientOpts = ?config(client_opts, Config),  
 
@@ -2470,11 +2447,8 @@ client_no_wrap_sequence_number(Config) when is_list(Config) ->
 						   {renegotiate_at, N} | ClientOpts]}]),
     
     ssl_test_lib:check_result(Client, ok), 
-
     ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client),
-    process_flag(trap_exit, false),
-    ok.
+    ssl_test_lib:close(Client).
 %%--------------------------------------------------------------------
 server_no_wrap_sequence_number(doc) -> 
     ["Test that erlang server will renegotiate session when",  
@@ -2486,7 +2460,6 @@ server_no_wrap_sequence_number(suite) ->
     [];
 
 server_no_wrap_sequence_number(Config) when is_list(Config) ->
-    process_flag(trap_exit, true),
     ServerOpts = ?config(server_opts, Config),  
     ClientOpts = ?config(client_opts, Config),  
 
@@ -2510,17 +2483,15 @@ server_no_wrap_sequence_number(Config) when is_list(Config) ->
     
     ssl_test_lib:check_result(Server, ok),
     ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client),
-    ok.
-
+    ssl_test_lib:close(Client).
 %%--------------------------------------------------------------------
-extended_key_usage(doc) -> 
-    ["Test cert that has a critical extended_key_usage extension"];
+extended_key_usage_verify_peer(doc) ->
+    ["Test cert that has a critical extended_key_usage extension in verify_peer mode"];
 
-extended_key_usage(suite) -> 
+extended_key_usage_verify_peer(suite) ->
     [];
 
-extended_key_usage(Config) when is_list(Config) -> 
+extended_key_usage_verify_peer(Config) when is_list(Config) ->
     ClientOpts = ?config(client_verification_opts, Config),
     ServerOpts = ?config(server_verification_opts, Config),
     PrivDir = ?config(priv_dir, Config),
@@ -2536,13 +2507,13 @@ extended_key_usage(Config) when is_list(Config) ->
     ServerExtKeyUsageExt = {'Extension', ?'id-ce-extKeyUsage', true, [?'id-kp-serverAuth']},
     ServerOTPTbsCert = ServerOTPCert#'OTPCertificate'.tbsCertificate,
     ServerExtensions =  ServerOTPTbsCert#'OTPTBSCertificate'.extensions,
-    NewServerOTPTbsCert = ServerOTPTbsCert#'OTPTBSCertificate'{extensions = 
-							       [ServerExtKeyUsageExt | 
+    NewServerOTPTbsCert = ServerOTPTbsCert#'OTPTBSCertificate'{extensions =
+							       [ServerExtKeyUsageExt |
 								ServerExtensions]},
-    NewServerDerCert = public_key:pkix_sign(NewServerOTPTbsCert, Key), 
+    NewServerDerCert = public_key:pkix_sign(NewServerOTPTbsCert, Key),
     ssl_test_lib:der_to_pem(NewServerCertFile, [{'Certificate', NewServerDerCert, not_encrypted}]),
     NewServerOpts = [{certfile, NewServerCertFile} | proplists:delete(certfile, ServerOpts)],
-    
+
     ClientCertFile = proplists:get_value(certfile, ClientOpts),
     NewClientCertFile = filename:join(PrivDir, "client/new_cert.pem"),
     [{'Certificate', ClientDerCert, _}] = ssl_test_lib:pem_to_der(ClientCertFile),
@@ -2550,28 +2521,90 @@ extended_key_usage(Config) when is_list(Config) ->
     ClientExtKeyUsageExt = {'Extension', ?'id-ce-extKeyUsage', true, [?'id-kp-clientAuth']},
     ClientOTPTbsCert = ClientOTPCert#'OTPCertificate'.tbsCertificate,
     ClientExtensions =  ClientOTPTbsCert#'OTPTBSCertificate'.extensions,
-    NewClientOTPTbsCert = ClientOTPTbsCert#'OTPTBSCertificate'{extensions = 
+    NewClientOTPTbsCert = ClientOTPTbsCert#'OTPTBSCertificate'{extensions =
  							       [ClientExtKeyUsageExt |
  								ClientExtensions]},
-    NewClientDerCert = public_key:pkix_sign(NewClientOTPTbsCert, Key), 
+    NewClientDerCert = public_key:pkix_sign(NewClientOTPTbsCert, Key),
     ssl_test_lib:der_to_pem(NewClientCertFile, [{'Certificate', NewClientDerCert, not_encrypted}]),
     NewClientOpts = [{certfile, NewClientCertFile} | proplists:delete(certfile, ClientOpts)],
 
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    
-    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
+
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+					{from, self()},
 			   {mfa, {?MODULE, send_recv_result_active, []}},
 			   {options, [{verify, verify_peer} | NewServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
-    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					{host, Hostname},
-			   {from, self()}, 
+			   {from, self()},
 			   {mfa, {?MODULE, send_recv_result_active, []}},
 					{options, [{verify, verify_peer} | NewClientOpts]}]),
-    
+
     ssl_test_lib:check_result(Server, ok, Client, ok),
-    
+
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close(Client).
+
+%%--------------------------------------------------------------------
+extended_key_usage_verify_none(doc) ->
+    ["Test cert that has a critical extended_key_usage extension in verify_none mode"];
+
+extended_key_usage_verify_none(suite) ->
+    [];
+
+extended_key_usage_verify_none(Config) when is_list(Config) ->
+    ClientOpts = ?config(client_verification_opts, Config),
+    ServerOpts = ?config(server_verification_opts, Config),
+    PrivDir = ?config(priv_dir, Config),
+
+    KeyFile = filename:join(PrivDir, "otpCA/private/key.pem"),
+    [KeyEntry] = ssl_test_lib:pem_to_der(KeyFile),
+    Key = public_key:pem_entry_decode(KeyEntry),
+
+    ServerCertFile = proplists:get_value(certfile, ServerOpts),
+    NewServerCertFile = filename:join(PrivDir, "server/new_cert.pem"),
+    [{'Certificate', ServerDerCert, _}] = ssl_test_lib:pem_to_der(ServerCertFile),
+    ServerOTPCert = public_key:pkix_decode_cert(ServerDerCert, otp),
+    ServerExtKeyUsageExt = {'Extension', ?'id-ce-extKeyUsage', true, [?'id-kp-serverAuth']},
+    ServerOTPTbsCert = ServerOTPCert#'OTPCertificate'.tbsCertificate,
+    ServerExtensions =  ServerOTPTbsCert#'OTPTBSCertificate'.extensions,
+    NewServerOTPTbsCert = ServerOTPTbsCert#'OTPTBSCertificate'{extensions =
+							       [ServerExtKeyUsageExt |
+								ServerExtensions]},
+    NewServerDerCert = public_key:pkix_sign(NewServerOTPTbsCert, Key),
+    ssl_test_lib:der_to_pem(NewServerCertFile, [{'Certificate', NewServerDerCert, not_encrypted}]),
+    NewServerOpts = [{certfile, NewServerCertFile} | proplists:delete(certfile, ServerOpts)],
+
+    ClientCertFile = proplists:get_value(certfile, ClientOpts),
+    NewClientCertFile = filename:join(PrivDir, "client/new_cert.pem"),
+    [{'Certificate', ClientDerCert, _}] = ssl_test_lib:pem_to_der(ClientCertFile),
+    ClientOTPCert = public_key:pkix_decode_cert(ClientDerCert, otp),
+    ClientExtKeyUsageExt = {'Extension', ?'id-ce-extKeyUsage', true, [?'id-kp-clientAuth']},
+    ClientOTPTbsCert = ClientOTPCert#'OTPCertificate'.tbsCertificate,
+    ClientExtensions =  ClientOTPTbsCert#'OTPTBSCertificate'.extensions,
+    NewClientOTPTbsCert = ClientOTPTbsCert#'OTPTBSCertificate'{extensions =
+								   [ClientExtKeyUsageExt |
+								    ClientExtensions]},
+    NewClientDerCert = public_key:pkix_sign(NewClientOTPTbsCert, Key),
+    ssl_test_lib:der_to_pem(NewClientCertFile, [{'Certificate', NewClientDerCert, not_encrypted}]),
+    NewClientOpts = [{certfile, NewClientCertFile} | proplists:delete(certfile, ClientOpts)],
+
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+					{from, self()},
+			   {mfa, {?MODULE, send_recv_result_active, []}},
+			   {options, [{verify, verify_none} | NewServerOpts]}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+					{host, Hostname},
+			   {from, self()},
+			   {mfa, {?MODULE, send_recv_result_active, []}},
+					{options, [{verify, verify_none} | NewClientOpts]}]),
+
+    ssl_test_lib:check_result(Server, ok, Client, ok),
+
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client).
 
@@ -2884,9 +2917,7 @@ unknown_server_ca_fail(Config) when is_list(Config) ->
 						| ClientOpts]}]),
 
     ssl_test_lib:check_result(Server, {error,"unknown ca"},
-			      Client, {error, "unknown ca"}),
-    ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client).
+			      Client, {error, "unknown ca"}).
 
 %%--------------------------------------------------------------------
 unknown_server_ca_accept_verify_none(doc) ->
@@ -3051,12 +3082,205 @@ der_input_opts(Opts) ->
     {Cert, {rsa, Key}, CaCerts, DHParams}.
 
 %%--------------------------------------------------------------------
+%% different_ca_peer_sign(doc) ->
+%%     ["Check that a CA can have a different signature algorithm than the peer cert."];
+
+%% different_ca_peer_sign(suite) ->
+%%     [];
+
+%% different_ca_peer_sign(Config) when is_list(Config) ->
+%%     ClientOpts =  ?config(client_mix_opts, Config),
+%%     ServerOpts =  ?config(server_mix_verify_opts, Config),
+
+%%     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+%%     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+%% 					{from, self()},
+%% 			   {mfa, {?MODULE, send_recv_result_active_once, []}},
+%% 			   {options, [{active, once},
+%% 				      {verify, verify_peer} | ServerOpts]}]),
+%%     Port  = ssl_test_lib:inet_port(Server),
+
+%%     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+%% 					{host, Hostname},
+%% 					{from, self()},
+%% 					{mfa, {?MODULE,
+%% 					       send_recv_result_active_once,
+%% 					       []}},
+%% 					{options, [{active, once},
+%% 						   {verify, verify_peer}
+%% 						   | ClientOpts]}]),
+
+%%     ssl_test_lib:check_result(Server, ok, Client, ok),
+%%     ssl_test_lib:close(Server),
+%%     ssl_test_lib:close(Client).
+
+
+%%--------------------------------------------------------------------
+no_reuses_session_server_restart_new_cert(doc) ->
+    ["Check that a session is not reused if the server is restarted with a new cert."];
+
+no_reuses_session_server_restart_new_cert(suite) ->
+    [];
+
+no_reuses_session_server_restart_new_cert(Config) when is_list(Config) ->
+
+    ClientOpts = ?config(client_opts, Config),
+    ServerOpts = ?config(server_opts, Config),
+    DsaServerOpts = ?config(server_dsa_opts, Config),
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+
+    Server =
+	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+				   {from, self()},
+		      {mfa, {?MODULE, session_info_result, []}},
+				   {options, ServerOpts}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client0 =
+	ssl_test_lib:start_client([{node, ClientNode},
+		      {port, Port}, {host, Hostname},
+			    {mfa, {ssl_test_lib, no_result, []}},
+		      {from, self()},  {options, ClientOpts}]),
+    SessionInfo =
+	receive
+	    {Server, Info} ->
+		Info
+	end,
+
+    %% Make sure session is registered
+    test_server:sleep(?SLEEP),
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close(Client0),
+
+    Server1 =
+	ssl_test_lib:start_server([{node, ServerNode}, {port, Port},
+				   {from, self()},
+		      {mfa, {ssl_test_lib, no_result, []}},
+				   {options, DsaServerOpts}]),
+
+    Client1 =
+	ssl_test_lib:start_client([{node, ClientNode},
+		      {port, Port}, {host, Hostname},
+		      {mfa, {?MODULE, session_info_result, []}},
+		      {from, self()},  {options, ClientOpts}]),
+    receive
+	{Client1, SessionInfo} ->
+	    test_server:fail(session_reused_when_server_has_new_cert);
+	{Client1, _Other} ->
+	   ok
+    end,
+    ssl_test_lib:close(Server1),
+    ssl_test_lib:close(Client1).
+
+%%--------------------------------------------------------------------
+no_reuses_session_server_restart_new_cert_file(doc) ->
+    ["Check that a session is not reused if a server is restarted with a new "
+     "cert contained in a file with the same name as the old cert."];
+
+no_reuses_session_server_restart_new_cert_file(suite) ->
+    [];
+
+no_reuses_session_server_restart_new_cert_file(Config) when is_list(Config) ->
+    ClientOpts = ?config(client_opts, Config),
+    ServerOpts = ?config(server_verification_opts, Config),
+    DsaServerOpts = ?config(server_dsa_opts, Config),
+    PrivDir =  ?config(priv_dir, Config),
+
+    NewServerOpts = new_config(PrivDir, ServerOpts),
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+
+    Server =
+	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+				   {from, self()},
+		      {mfa, {?MODULE, session_info_result, []}},
+				   {options, NewServerOpts}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client0 =
+	ssl_test_lib:start_client([{node, ClientNode},
+		      {port, Port}, {host, Hostname},
+			    {mfa, {ssl_test_lib, no_result, []}},
+		      {from, self()},  {options, ClientOpts}]),
+    SessionInfo =
+	receive
+	    {Server, Info} ->
+		Info
+	end,
+
+    %% Make sure session is registered and we get
+    %% new file time stamp when calling new_config!
+    test_server:sleep(?SLEEP* 2),
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close(Client0),
+
+    NewServerOpts = new_config(PrivDir, DsaServerOpts),
+
+    Server1 =
+	ssl_test_lib:start_server([{node, ServerNode}, {port, Port},
+				   {from, self()},
+		      {mfa, {ssl_test_lib, no_result, []}},
+				   {options, NewServerOpts}]),
+    Client1 =
+	ssl_test_lib:start_client([{node, ClientNode},
+		      {port, Port}, {host, Hostname},
+		      {mfa, {?MODULE, session_info_result, []}},
+				   {from, self()},  {options, ClientOpts}]),
+    receive
+	{Client1, SessionInfo} ->
+	    test_server:fail(session_reused_when_server_has_new_cert);
+	{Client1, _Other} ->
+	   ok
+    end,
+    ssl_test_lib:close(Server1),
+    ssl_test_lib:close(Client1).
+
+%%--------------------------------------------------------------------
+reuseaddr(doc) ->
+    [""];
+
+reuseaddr(suite) ->
+    [];
+
+reuseaddr(Config) when is_list(Config) ->
+    ClientOpts = ?config(client_opts, Config),
+    ServerOpts = ?config(server_opts, Config),
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    Server =
+	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+				   {from, self()},
+				   {mfa, {ssl_test_lib, no_result, []}},
+				   {options,  [{active, false} | ServerOpts]}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client =
+	ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+				   {host, Hostname},
+				   {from, self()},
+				   {mfa, {ssl_test_lib, no_result, []}},
+				   {options, [{active, false} | ClientOpts]}]),
+    test_server:sleep(?SLEEP),
+    ssl_test_lib:close(Server),
+
+    Server1 =
+	ssl_test_lib:start_server([{node, ServerNode}, {port, Port},
+				   {from, self()},
+				   {mfa, {?MODULE, send_recv_result, []}},
+				   {options,  [{active, false} | ServerOpts]}]),
+    Client1 =
+	ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+				   {host, Hostname},
+				   {from, self()},
+				   {mfa, {?MODULE, send_recv_result, []}},
+				   {options, [{active, false} | ClientOpts]}]),
+
+    ssl_test_lib:check_result(Server1, ok, Client1, ok),
+    ssl_test_lib:close(Server1),
+    ssl_test_lib:close(Client1).
+
+%%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
 erlang_ssl_receive(Socket, Data) ->
     receive
 	{ssl, Socket, Data} ->
-	    io:format("Received ~p~n",[Data]),
+	    test_server:format("Received ~p~n",[Data]),
 	    ok;
 	Other ->
 	    test_server:fail({unexpected_message, Other})
@@ -3086,7 +3310,6 @@ send_recv_result_active_once(Socket) ->
 result_ok(_Socket) ->
     ok.
 
-
 renegotiate(Socket, Data) ->
     test_server:format("Renegotiating ~n", []),
     Result = ssl:renegotiate(Socket),
@@ -3103,3 +3326,24 @@ renegotiate_reuse_session(Socket, Data) ->
     %% Make sure session is registerd
     test_server:sleep(?SLEEP),
     renegotiate(Socket, Data).
+
+
+new_config(PrivDir, ServerOpts0) ->
+    CaCertFile = proplists:get_value(cacertfile, ServerOpts0),
+    CertFile = proplists:get_value(certfile, ServerOpts0),
+    KeyFile = proplists:get_value(keyfile, ServerOpts0),
+    NewCaCertFile = filename:join(PrivDir, "new_ca.pem"),
+    NewCertFile = filename:join(PrivDir, "new_cert.pem"),
+    NewKeyFile = filename:join(PrivDir, "new_key.pem"),
+    file:copy(CaCertFile, NewCaCertFile),
+    file:copy(CertFile, NewCertFile),
+    file:copy(KeyFile, NewKeyFile),
+    ServerOpts1 = proplists:delete(cacertfile, ServerOpts0),
+    ServerOpts2 = proplists:delete(certfile, ServerOpts1),
+    ServerOpts = proplists:delete(keyfile, ServerOpts2),
+
+    {ok, PEM} = file:read_file(NewCaCertFile),
+    test_server:format("CA file content: ~p~n", [public_key:pem_decode(PEM)]),
+
+    [{cacertfile, NewCaCertFile}, {certfile, NewCertFile},
+     {keyfile, NewKeyFile} | ServerOpts].
diff --git a/lib/ssl/test/ssl_packet_SUITE.erl b/lib/ssl/test/ssl_packet_SUITE.erl
index 88d2d99ef8..b1e585e39e 100644
--- a/lib/ssl/test/ssl_packet_SUITE.erl
+++ b/lib/ssl/test/ssl_packet_SUITE.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2011. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -53,15 +53,18 @@
 %% variable, but should NOT alter/remove any existing entries.
 %%--------------------------------------------------------------------
 init_per_suite(Config) ->
-    crypto:start(),
-    application:start(public_key),
-    ssl:start(),
-    Result = 
-	(catch make_certs:all(?config(data_dir, Config), 
-			      ?config(priv_dir, Config))),
-    test_server:format("Make certs  ~p~n", [Result]),
-    ssl_test_lib:cert_options(Config).
-
+    case application:start(crypto) of
+	ok ->
+	    application:start(public_key),
+	    ssl:start(),
+	    Result =
+		(catch make_certs:all(?config(data_dir, Config),
+				      ?config(priv_dir, Config))),
+	    test_server:format("Make certs  ~p~n", [Result]),
+	    ssl_test_lib:cert_options(Config);
+	_  ->
+	    {skip, "Crypto did not start"}
+    end.
 %%--------------------------------------------------------------------
 %% Function: end_per_suite(Config) -> _
 %% Config - [tuple()]
@@ -70,7 +73,7 @@ init_per_suite(Config) ->
 %%--------------------------------------------------------------------
 end_per_suite(_Config) ->
     ssl:stop(),
-    crypto:stop().
+    application:stop(crypto).
 
 %%--------------------------------------------------------------------
 %% Function: init_per_testcase(TestCase, Config) -> Config
diff --git a/lib/ssl/test/ssl_payload_SUITE.erl b/lib/ssl/test/ssl_payload_SUITE.erl
index d80df0bfbd..b19d1f286f 100644
--- a/lib/ssl/test/ssl_payload_SUITE.erl
+++ b/lib/ssl/test/ssl_payload_SUITE.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2011. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -37,12 +37,15 @@
 %% variable, but should NOT alter/remove any existing entries.
 %%--------------------------------------------------------------------
 init_per_suite(Config) ->
-    crypto:start(),
-    application:start(public_key),
-    ssl:start(),
-    make_certs:all(?config(data_dir, Config), ?config(priv_dir, Config)),
-    ssl_test_lib:cert_options(Config).
-
+    case application:start(crypto) of
+	ok ->
+	    application:start(public_key),
+	    ssl:start(),
+	    make_certs:all(?config(data_dir, Config), ?config(priv_dir, Config)),
+	    ssl_test_lib:cert_options(Config);
+	_  ->
+	    {skip, "Crypto did not start"}
+    end.
 %%--------------------------------------------------------------------
 %% Function: end_per_suite(Config) -> _
 %% Config - [tuple()]
@@ -51,7 +54,7 @@ init_per_suite(Config) ->
 %%--------------------------------------------------------------------
 end_per_suite(_Config) ->
     ssl:stop(),
-    crypto:stop().
+    application:stop(crypto).
 
 %%--------------------------------------------------------------------
 %% Function: init_per_testcase(TestCase, Config) -> Config
diff --git a/lib/ssl/test/ssl_session_cache_SUITE.erl b/lib/ssl/test/ssl_session_cache_SUITE.erl
index 7a441e4599..5aac9bb4e3 100644
--- a/lib/ssl/test/ssl_session_cache_SUITE.erl
+++ b/lib/ssl/test/ssl_session_cache_SUITE.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2010-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2010-2011. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -28,6 +28,7 @@
 
 -define(SLEEP, 500).
 -define(TIMEOUT, 60000).
+-define(LONG_TIMEOUT, 600000).
 -behaviour(ssl_session_cache_api).
 
 %% For the session cache tests
@@ -45,20 +46,24 @@
 %% variable, but should NOT alter/remove any existing entries.
 %%--------------------------------------------------------------------
 init_per_suite(Config0) ->
-    Dog = ssl_test_lib:timetrap(?TIMEOUT *2),
-    crypto:start(),
-    application:start(public_key),
-    ssl:start(),
-
-    %% make rsa certs using oppenssl
-    Result =
-	(catch make_certs:all(?config(data_dir, Config0),
-			      ?config(priv_dir, Config0))),
-    test_server:format("Make certs  ~p~n", [Result]),
-
-    Config1 = ssl_test_lib:make_dsa_cert(Config0),
-    Config = ssl_test_lib:cert_options(Config1),
-    [{watchdog, Dog} | Config].
+    Dog = ssl_test_lib:timetrap(?LONG_TIMEOUT *2),
+    case application:start(crypto) of
+	ok ->
+	    application:start(public_key),
+	    ssl:start(),
+
+	    %% make rsa certs using oppenssl
+	    Result =
+		(catch make_certs:all(?config(data_dir, Config0),
+				      ?config(priv_dir, Config0))),
+	    test_server:format("Make certs  ~p~n", [Result]),
+
+	    Config1 = ssl_test_lib:make_dsa_cert(Config0),
+	    Config = ssl_test_lib:cert_options(Config1),
+	    [{watchdog, Dog} | Config];
+	_ ->
+	    {skip, "Crypto did not start"}
+    end.
 
 %%--------------------------------------------------------------------
 %% Function: end_per_suite(Config) -> _
@@ -68,7 +73,7 @@ init_per_suite(Config0) ->
 %%--------------------------------------------------------------------
 end_per_suite(_Config) ->
     ssl:stop(),
-    crypto:stop().
+    application:stop(crypto).
 
 %%--------------------------------------------------------------------
 %% Function: init_per_testcase(TestCase, Config) -> Config
@@ -119,7 +124,7 @@ end_per_testcase(session_cache_process_list, Config) ->
 end_per_testcase(session_cache_process_mnesia, Config) ->
     application:unset_env(ssl, session_cb),
     application:unset_env(ssl, session_cb_init_args),
-    mnesia:stop(),
+    mnesia:kill(),
     ssl:stop(),
     ssl:start(),
     end_per_testcase(default_action, Config);
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index e1e8214ed6..f6ccbe85e3 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -81,14 +81,20 @@ run_server(ListenSocket, Opts) ->
 	no_result_msg ->
 	    ok;
 	Msg ->
-	    test_server:format("Msg: ~p ~n", [Msg]),    
+	    test_server:format("Server Msg: ~p ~n", [Msg]),
 	    Pid ! {self(), Msg}
     end,
-    receive 
+    receive
 	listen ->
 	    run_server(ListenSocket, Opts);
+	{listen, MFA} ->
+	    run_server(ListenSocket, [MFA | proplists:delete(mfa, Opts)]);
 	close ->
-	    ok = rpc:call(Node, ssl, close, [AcceptSocket])
+	    test_server:format("Server closing  ~p ~n", [self()]),
+	    Result = rpc:call(Node, ssl, close, [AcceptSocket], 500),
+	    test_server:format("Result ~p ~n", [Result]);
+	{ssl_closed, _} ->
+	    ok
     end.
 
 %%% To enable to test with s_client -reconnect
@@ -151,19 +157,30 @@ run_client(Opts) ->
 		no_result_msg ->
 		    ok;
 		Msg ->
+		    test_server:format("Client Msg: ~p ~n", [Msg]),
 		    Pid ! {self(), Msg}
 	    end,
-	    receive 
+	    receive
 		close ->
-		    ok = rpc:call(Node, ssl, close, [Socket])
+		    test_server:format("Client closing~n", []),
+		    rpc:call(Node, ssl, close, [Socket]);
+		{ssl_closed, Socket} ->
+		    ok
 	    end;
 	{error, Reason} ->
-	    test_server:format("Client: connection failed: ~p ~n", [Reason]), 
+	    test_server:format("Client: connection failed: ~p ~n", [Reason]),
 	       Pid ! {self(), {error, Reason}}
     end.
 
 close(Pid) ->
-    Pid ! close.
+    test_server:format("Close ~p ~n", [Pid]),
+    Monitor = erlang:monitor(process, Pid),
+    Pid ! close,
+    receive
+	{'DOWN', Monitor, process, Pid, Reason} ->
+	    erlang:demonitor(Monitor),
+	    test_server:format("Pid: ~p down due to:~p ~n", [Pid, Reason])
+    end.
 
 check_result(Server, ServerMsg, Client, ClientMsg) -> 
     receive 
@@ -208,47 +225,27 @@ check_result(Pid, Msg) ->
 	    test_server:fail(Reason)
     end.
 
-check_result_ignore_renegotiation_reject(Pid, Msg) -> 
-    receive 
-	{Pid,  fail_session_fatal_alert_during_renegotiation} ->
-	    test_server:comment("Server rejected old renegotiation"),
-	    ok;
-	{ssl_error, _, esslconnect} ->
-	    test_server:comment("Server rejected old renegotiation"),
-	    ok;
-	{Pid, Msg} -> 
-	    ok;
-	{Port, {data,Debug}} when is_port(Port) ->
-	    io:format("openssl ~s~n",[Debug]),
-	    check_result(Pid,Msg);
-	Unexpected ->
-	    Reason = {{expected, {Pid, Msg}}, 
-		      {got, Unexpected}},
-	    test_server:fail(Reason)
-    end.
-
-
 wait_for_result(Server, ServerMsg, Client, ClientMsg) -> 
     receive 
 	{Server, ServerMsg} -> 
 	    receive 
 		{Client, ClientMsg} ->
-		    ok;
-		Unexpected ->
-		    Unexpected
+		    ok
+		%% Unexpected ->
+		%%     Unexpected
 	    end;
 	{Client, ClientMsg} -> 
 	    receive 
 		{Server, ServerMsg} ->
-		    ok;
-		Unexpected ->
-		    Unexpected
+		    ok
+		%% Unexpected ->
+		%%     Unexpected
 	    end;
 	{Port, {data,Debug}} when is_port(Port) ->
 	    io:format("openssl ~s~n",[Debug]),
-	    wait_for_result(Server, ServerMsg, Client, ClientMsg);
-	Unexpected ->
-	    Unexpected
+	    wait_for_result(Server, ServerMsg, Client, ClientMsg)
+	%% Unexpected ->
+	%%     Unexpected
     end.
 
 
@@ -258,9 +255,9 @@ wait_for_result(Pid, Msg) ->
 	    ok;
 	{Port, {data,Debug}} when is_port(Port) ->
 	    io:format("openssl ~s~n",[Debug]),
-	    wait_for_result(Pid,Msg);
-	Unexpected ->
-	    Unexpected
+	    wait_for_result(Pid,Msg)
+	%% Unexpected ->
+	%%     Unexpected
     end.
 
 cert_options(Config) ->
@@ -327,8 +324,8 @@ cert_options(Config) ->
 
 make_dsa_cert(Config) ->
     
-    {ServerCaCertFile, ServerCertFile, ServerKeyFile} = make_dsa_cert_files("server", Config),
-    {ClientCaCertFile, ClientCertFile, ClientKeyFile} = make_dsa_cert_files("client", Config),
+    {ServerCaCertFile, ServerCertFile, ServerKeyFile} = make_cert_files("server", Config, dsa, dsa, ""),
+    {ClientCaCertFile, ClientCertFile, ClientKeyFile} = make_cert_files("client", Config, dsa, dsa, ""),
     [{server_dsa_opts, [{ssl_imp, new},{reuseaddr, true}, 
 				 {cacertfile, ServerCaCertFile},
 				 {certfile, ServerCertFile}, {keyfile, ServerKeyFile}]},
@@ -342,22 +339,41 @@ make_dsa_cert(Config) ->
      | Config].
 
 
-    
-make_dsa_cert_files(RoleStr, Config) ->    
-    CaInfo = {CaCert, _} = erl_make_certs:make_cert([{key, dsa}]),
-    {Cert, CertKey} = erl_make_certs:make_cert([{key, dsa}, {issuer, CaInfo}]),
+make_mix_cert(Config) ->
+    {ServerCaCertFile, ServerCertFile, ServerKeyFile} = make_cert_files("server", Config, dsa,
+									rsa, "mix"),
+    {ClientCaCertFile, ClientCertFile, ClientKeyFile} = make_cert_files("client", Config, dsa,
+									rsa, "mix"),
+    [{server_mix_opts, [{ssl_imp, new},{reuseaddr, true},
+				 {cacertfile, ServerCaCertFile},
+				 {certfile, ServerCertFile}, {keyfile, ServerKeyFile}]},
+     {server_mix_verify_opts, [{ssl_imp, new},{reuseaddr, true},
+			       {cacertfile, ClientCaCertFile},
+			       {certfile, ServerCertFile}, {keyfile, ServerKeyFile},
+			       {verify, verify_peer}]},
+     {client_mix_opts, [{ssl_imp, new},{reuseaddr, true},
+			{cacertfile, ClientCaCertFile},
+			{certfile, ClientCertFile}, {keyfile, ClientKeyFile}]}
+     | Config].
+
+make_cert_files(RoleStr, Config, Alg1, Alg2, Prefix) ->
+    Alg1Str = atom_to_list(Alg1),
+    Alg2Str = atom_to_list(Alg2),
+    CaInfo = {CaCert, _} = erl_make_certs:make_cert([{key, Alg1}]),
+    {Cert, CertKey} = erl_make_certs:make_cert([{key, Alg2}, {issuer, CaInfo}]),
     CaCertFile = filename:join([?config(priv_dir, Config), 
-				RoleStr, "dsa_cacerts.pem"]),
+				RoleStr, Prefix ++ Alg1Str ++ "_cacerts.pem"]),
     CertFile = filename:join([?config(priv_dir, Config), 
-			      RoleStr, "dsa_cert.pem"]),
+			      RoleStr, Prefix ++ Alg2Str ++ "_cert.pem"]),
     KeyFile = filename:join([?config(priv_dir, Config), 
-				   RoleStr, "dsa_key.pem"]),
+				   RoleStr, Prefix ++ Alg2Str ++ "_key.pem"]),
     
     der_to_pem(CaCertFile, [{'Certificate', CaCert, not_encrypted}]),
     der_to_pem(CertFile, [{'Certificate', Cert, not_encrypted}]),
     der_to_pem(KeyFile, [CertKey]),
     {CaCertFile, CertFile, KeyFile}.
 
+
 start_upgrade_server(Args) ->
     Result = spawn_link(?MODULE, run_upgrade_server, [Args]),
     receive
@@ -395,10 +411,12 @@ run_upgrade_server(Opts) ->
 				end,
 	{Module, Function, Args} = proplists:get_value(mfa, Opts),
 	Msg = rpc:call(Node, Module, Function, [SslAcceptSocket | Args]),
+	test_server:format("Upgrade Server Msg: ~p ~n", [Msg]),
 	Pid ! {self(), Msg},
 	receive
 	    close ->
-		ok = rpc:call(Node, ssl, close, [SslAcceptSocket])
+		test_server:format("Upgrade Server closing~n", []),
+		rpc:call(Node, ssl, close, [SslAcceptSocket])
 	end
     catch error:{badmatch, Error} ->
 	    Pid ! {self(), Error}
@@ -428,10 +446,12 @@ run_upgrade_client(Opts) ->
     test_server:format("apply(~p, ~p, ~p)~n", 
 		       [Module, Function, [SslSocket | Args]]),
     Msg = rpc:call(Node, Module, Function, [SslSocket | Args]),
+    test_server:format("Upgrade Client Msg: ~p ~n", [Msg]),
     Pid ! {self(), Msg},
     receive 
 	close ->
-	    ok = rpc:call(Node, ssl, close, [SslSocket])
+	    test_server:format("Upgrade Client closing~n", []),
+	    rpc:call(Node, ssl, close, [SslSocket])
     end.
 
 start_upgrade_server_error(Args) ->
diff --git a/lib/ssl/test/ssl_to_openssl_SUITE.erl b/lib/ssl/test/ssl_to_openssl_SUITE.erl
index 55a0100b1e..0cbaafd99c 100644
--- a/lib/ssl/test/ssl_to_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_to_openssl_SUITE.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2011. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -27,6 +27,7 @@
 -include("test_server.hrl").
 
 -define(TIMEOUT, 120000).
+-define(LONG_TIMEOUT, 600000).
 -define(SLEEP, 1000).
 -define(OPENSSL_RENEGOTIATE, "r\n").
 -define(OPENSSL_QUIT, "Q\n").
@@ -44,21 +45,25 @@
 %% variable, but should NOT alter/remove any existing entries.
 %%--------------------------------------------------------------------
 init_per_suite(Config0) ->
-    Dog = ssl_test_lib:timetrap(?TIMEOUT *2),
+    Dog = ssl_test_lib:timetrap(?LONG_TIMEOUT *2),
     case os:find_executable("openssl") of
 	false ->
 	    {skip, "Openssl not found"};
 	_ ->
-	    crypto:start(),
-	    application:start(public_key),
-	    ssl:start(),
-	    Result = 
-		(catch make_certs:all(?config(data_dir, Config0), 
-				      ?config(priv_dir, Config0))),
-	    test_server:format("Make certs  ~p~n", [Result]),
-	    Config1 = ssl_test_lib:make_dsa_cert(Config0),
-	    Config = ssl_test_lib:cert_options(Config1),
-	    [{watchdog, Dog} | Config]
+	    case application:start(crypto) of
+		ok ->
+		    application:start(public_key),
+		    ssl:start(),
+		    Result =
+			(catch make_certs:all(?config(data_dir, Config0),
+					      ?config(priv_dir, Config0))),
+		    test_server:format("Make certs  ~p~n", [Result]),
+		    Config1 = ssl_test_lib:make_dsa_cert(Config0),
+		    Config = ssl_test_lib:cert_options(Config1),
+		    [{watchdog, Dog} | Config];
+		_  ->
+		    {skip, "Crypto did not start"}
+	    end
     end.
 
 %%--------------------------------------------------------------------
@@ -69,7 +74,7 @@ init_per_suite(Config0) ->
 %%--------------------------------------------------------------------
 end_per_suite(_Config) ->
     ssl:stop(),
-    crypto:stop().
+    application:stop(crypto).
 
 %%--------------------------------------------------------------------
 %% Function: init_per_testcase(TestCase, Config) -> Config
@@ -1163,10 +1168,6 @@ cipher(CipherSuite, Version, Config, ClientOpts, ServerOpts) ->
     close_port(OpenSslPort),
     %% Clean close down!
     ssl_test_lib:close(Client),
-    receive 
-	{'EXIT', Client, normal} ->
-	    ok
-    end,
     
     Return = case Result of
 		 ok ->
diff --git a/lib/ssl/vsn.mk b/lib/ssl/vsn.mk
index 30a0a3b3f7..a4be7bb889 100644
--- a/lib/ssl/vsn.mk
+++ b/lib/ssl/vsn.mk
@@ -1,2 +1,2 @@
 
-SSL_VSN = 4.1
+SSL_VSN = 4.1.3