diff --git a/src/test/setup/radius-config/freeradius/certs_3/01.pem b/src/test/setup/radius-config/freeradius/certs_3/01.pem
new file mode 100644
index 0000000..ea92e54
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/01.pem
@@ -0,0 +1,70 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=CA, L=Somewhere, O=Ciena Inc./emailAddress=admin@ciena.com, CN=Example Certificate Authority
+        Validity
+            Not Before: Jun  6 21:12:27 2016 GMT
+            Not After : Jun  1 21:12:27 2017 GMT
+        Subject: C=US, ST=CA, O=Ciena Inc., CN=Example Server Certificate/emailAddress=admin@ciena.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:9e:ca:94:59:9c:35:4c:84:93:99:02:ec:7c:a4:
+                    60:4c:b4:60:97:89:01:9a:0e:45:4d:c5:69:71:de:
+                    b9:e8:b8:78:ee:be:49:bc:30:4f:7e:2c:00:48:8c:
+                    ed:36:b7:48:0e:7e:67:6e:ac:7f:ba:21:78:91:fe:
+                    64:a7:30:6e:9c:41:d3:1f:89:f6:1f:33:7c:1f:c4:
+                    34:c0:89:ba:cf:71:f9:8b:4b:d2:ef:e9:7b:df:0b:
+                    5b:04:8e:40:fb:cf:a4:08:b5:e4:ab:40:16:a5:47:
+                    bc:90:c8:04:fc:d8:f2:05:0a:27:a7:c4:6c:c2:9a:
+                    a2:3c:f8:c6:fe:ff:d7:67:3c:aa:99:15:c2:52:b3:
+                    8f:ff:77:58:3c:06:66:03:24:fd:ab:e1:a3:cb:a9:
+                    6d:f9:e5:37:21:02:23:49:5f:61:c5:2b:fd:75:ac:
+                    d5:2c:27:9d:7c:24:46:2b:4c:6d:01:bd:a8:51:2a:
+                    9d:d7:03:53:30:c6:52:07:4e:62:5c:aa:d0:57:28:
+                    30:17:e6:c0:2a:8b:86:49:97:85:ba:fc:cb:d0:b0:
+                    67:9b:a0:ee:3a:14:32:7a:fd:6a:9b:bb:f9:75:9c:
+                    a5:c3:ab:a2:64:f0:2b:5c:24:cc:df:d1:6a:42:8c:
+                    ca:7c:5e:06:96:59:79:d8:18:26:5e:b2:e3:b3:6b:
+                    8f:df
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://www.example.com/example_ca.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+         1d:65:7f:32:5b:2d:60:5d:17:ee:c5:e1:92:f2:cf:38:7b:f7:
+         cb:92:a2:5c:06:b2:bd:34:96:68:15:91:8c:85:92:f4:cc:af:
+         7a:b7:9c:10:2b:26:da:b6:5e:e4:66:01:8c:ad:9c:8f:bc:02:
+         9a:88:12:e2:2f:47:70:68:a5:b3:f1:df:6b:7f:82:d2:76:52:
+         fe:c0:2c:2c:cd:2d:26:2c:8a:52:f7:92:35:ce:50:5f:5b:26:
+         f0:bd:ef:ac:bc:fd:87:f7:87:37:d7:2b:56:9a:5a:14:b4:97:
+         b4:df:b4:95:c8:7b:76:49:a1:4b:5b:f7:10:4d:f1:b5:16:99:
+         f1:19
+-----BEGIN CERTIFICATE-----
+MIIDSTCCArKgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
+IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
+RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwNjA2MjExMjI3WhcN
+MTcwNjAxMjExMjI3WjB0MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
+BAoTCkNpZW5hIEluYy4xIzAhBgNVBAMTGkV4YW1wbGUgU2VydmVyIENlcnRpZmlj
+YXRlMR4wHAYJKoZIhvcNAQkBFg9hZG1pbkBjaWVuYS5jb20wggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQCeypRZnDVMhJOZAux8pGBMtGCXiQGaDkVNxWlx
+3rnouHjuvkm8ME9+LABIjO02t0gOfmdurH+6IXiR/mSnMG6cQdMfifYfM3wfxDTA
+ibrPcfmLS9Lv6XvfC1sEjkD7z6QIteSrQBalR7yQyAT82PIFCienxGzCmqI8+Mb+
+/9dnPKqZFcJSs4//d1g8BmYDJP2r4aPLqW355TchAiNJX2HFK/11rNUsJ518JEYr
+TG0BvahRKp3XA1MwxlIHTmJcqtBXKDAX5sAqi4ZJl4W6/MvQsGeboO46FDJ6/Wqb
+u/l1nKXDq6Jk8CtcJMzf0WpCjMp8XgaWWXnYGCZesuOza4/fAgMBAAGjTzBNMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly93d3cu
+ZXhhbXBsZS5jb20vZXhhbXBsZV9jYS5jcmwwDQYJKoZIhvcNAQEFBQADgYEAHWV/
+MlstYF0X7sXhkvLPOHv3y5KiXAayvTSWaBWRjIWS9MyverecECsm2rZe5GYBjK2c
+j7wCmogS4i9HcGils/Hfa3+C0nZS/sAsLM0tJiyKUveSNc5QX1sm8L3vrLz9h/eH
+N9crVppaFLSXtN+0lch7dkmhS1v3EE3xtRaZ8Rk=
+-----END CERTIFICATE-----
diff --git a/src/test/setup/radius-config/freeradius/certs_3/02.pem b/src/test/setup/radius-config/freeradius/certs_3/02.pem
new file mode 100644
index 0000000..fd66778
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/02.pem
@@ -0,0 +1,58 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=CA, L=Somewhere, O=Ciena Inc./emailAddress=admin@ciena.com, CN=Example Certificate Authority
+        Validity
+            Not Before: Jun  6 21:12:27 2016 GMT
+            Not After : Jun  1 21:12:27 2017 GMT
+        Subject: C=US, ST=CA, O=Ciena Inc., CN=user@ciena.com/emailAddress=user@ciena.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:c2:f5:e2:4b:36:fd:2d:9e:9c:ee:e3:73:89:47:
+                    ca:be:81:ce:ef:0b:bf:ba:21:42:e5:85:29:5d:b9:
+                    95:1a:e1:99:8b:36:d5:ae:7c:b4:c6:74:7c:e4:37:
+                    de:fb:d4:78:76:26:a7:b1:f0:e1:22:1c:ce:52:5d:
+                    57:8c:dd:d8:0d:e4:92:f4:e7:85:e5:85:8d:34:4f:
+                    17:0e:19:73:d9:dd:eb:57:36:8d:ea:12:21:76:8b:
+                    41:91:48:e0:ad:47:b0:8d:38:39:38:54:77:d5:01:
+                    32:1b:7b:fc:c5:1d:c2:2e:08:84:f7:14:04:2e:36:
+                    5b:48:0d:3b:a4:3e:fd:ce:e5
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://www.example.com/example_ca.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+         c0:8e:4a:d8:ea:d0:c2:86:62:9b:be:bf:30:e8:3b:bf:b7:cb:
+         c7:8d:30:a8:08:8a:1c:1d:33:74:ab:35:8e:79:bd:58:b0:01:
+         97:f3:df:93:ad:62:2e:3b:57:45:c9:87:7e:67:42:82:3c:32:
+         81:e6:3f:f2:82:69:7d:35:af:80:92:54:98:01:52:48:8e:f9:
+         73:5c:a6:6b:39:a3:e6:85:9a:83:b9:f8:be:ad:75:ad:8b:fb:
+         ad:56:a6:38:54:c5:b6:f8:72:82:9d:7a:77:ee:a5:9e:b8:52:
+         c6:c9:1d:79:d7:d6:35:77:a1:7f:e5:7c:ea:9a:f6:f0:51:1b:
+         84:ba
+-----BEGIN CERTIFICATE-----
+MIICuDCCAiGgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
+IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
+RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwNjA2MjExMjI3WhcN
+MTcwNjAxMjExMjI3WjBnMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
+BAoTCkNpZW5hIEluYy4xFzAVBgNVBAMUDnVzZXJAY2llbmEuY29tMR0wGwYJKoZI
+hvcNAQkBFg51c2VyQGNpZW5hLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
+gYEAwvXiSzb9LZ6c7uNziUfKvoHO7wu/uiFC5YUpXbmVGuGZizbVrny0xnR85Dfe
++9R4diansfDhIhzOUl1XjN3YDeSS9OeF5YWNNE8XDhlz2d3rVzaN6hIhdotBkUjg
+rUewjTg5OFR31QEyG3v8xR3CLgiE9xQELjZbSA07pD79zuUCAwEAAaNPME0wEwYD
+VR0lBAwwCgYIKwYBBQUHAwIwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5l
+eGFtcGxlLmNvbS9leGFtcGxlX2NhLmNybDANBgkqhkiG9w0BAQUFAAOBgQDAjkrY
+6tDChmKbvr8w6Du/t8vHjTCoCIocHTN0qzWOeb1YsAGX89+TrWIuO1dFyYd+Z0KC
+PDKB5j/ygml9Na+AklSYAVJIjvlzXKZrOaPmhZqDufi+rXWti/utVqY4VMW2+HKC
+nXp37qWeuFLGyR1519Y1d6F/5XzqmvbwURuEug==
+-----END CERTIFICATE-----
diff --git a/src/test/setup/radius-config/freeradius/certs_3/Makefile b/src/test/setup/radius-config/freeradius/certs_3/Makefile
new file mode 100644
index 0000000..c8f0892
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/Makefile
@@ -0,0 +1,140 @@
+######################################################################
+#
+#	Make file to be installed in /etc/raddb/certs to enable
+#	the easy creation of certificates.
+#
+#	See the README file in this directory for more information.
+#
+#	$Id: 0613df99502989a6d5751eb8b2088000c58cae98 $
+#
+######################################################################
+
+DH_KEY_SIZE	= 1024
+
+#
+#  Set the passwords
+#
+PASSWORD_SERVER	= `grep output_password server.cnf | sed 's/.*=//;s/^ *//'`
+PASSWORD_CA	= `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'`
+PASSWORD_CLIENT	= `grep output_password client.cnf | sed 's/.*=//;s/^ *//'`
+
+USER_NAME	= `grep emailAddress client.cnf | grep '@' | sed 's/.*=//;s/^ *//'`
+CA_DEFAULT_DAYS = `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'`
+
+######################################################################
+#
+#  Make the necessary files, but not client certificates.
+#
+######################################################################
+.PHONY: all
+all: index.txt serial dh random server ca client
+
+.PHONY: client
+client: client.pem
+
+.PHONY: ca
+ca: ca.der
+
+.PHONY: server
+server: server.pem server.vrfy
+
+######################################################################
+#
+#  Diffie-Hellman parameters
+#
+######################################################################
+dh:
+	openssl dhparam -out dh $(DH_KEY_SIZE)
+
+######################################################################
+#
+#  Create a new self-signed CA certificate
+#
+######################################################################
+ca.key ca.pem: ca.cnf
+	@[ -f index.txt ] || $(MAKE) index.txt
+	@[ -f serial ] || $(MAKE) serial
+	openssl req -new -x509 -keyout ca.key -out ca.pem \
+		-days $(CA_DEFAULT_DAYS) -config ./ca.cnf
+
+ca.der: ca.pem
+	openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der
+
+######################################################################
+#
+#  Create a new server certificate, signed by the above CA.
+#
+######################################################################
+server.csr server.key: server.cnf
+	openssl req -new  -out server.csr -keyout server.key -config ./server.cnf
+
+server.crt: server.csr ca.key ca.pem
+	openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr  -key $(PASSWORD_CA) -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf
+
+server.p12: server.crt
+	openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12  -passin pass:$(PASSWORD_SERVER) -passout pass:$(PASSWORD_SERVER)
+
+server.pem: server.p12
+	openssl pkcs12 -in server.p12 -out server.pem -passin pass:$(PASSWORD_SERVER) -passout pass:$(PASSWORD_SERVER)
+
+.PHONY: server.vrfy
+server.vrfy: ca.pem
+	@openssl verify -CAfile ca.pem server.pem
+
+######################################################################
+#
+#  Create a new client certificate, signed by the the above server
+#  certificate.
+#
+######################################################################
+client.csr client.key: client.cnf
+	openssl req -new  -out client.csr -keyout client.key -config ./client.cnf
+
+client.crt: client.csr ca.pem ca.key
+	openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key $(PASSWORD_CA) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
+
+client.p12: client.crt
+	openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12  -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
+
+client.pem: client.p12
+	openssl pkcs12 -in client.p12 -out client.pem -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
+	cp client.pem $(USER_NAME).pem
+
+.PHONY: client.vrfy
+client.vrfy: ca.pem client.pem
+	c_rehash .
+	openssl verify -CApath . client.pem
+
+######################################################################
+#
+#  Miscellaneous rules.
+#
+######################################################################
+index.txt:
+	@touch index.txt
+
+serial:
+	@echo '01' > serial
+
+random:
+	@if [ -c /dev/urandom ] ; then \
+		ln -sf /dev/urandom random; \
+	else \
+		date > ./random; \
+	fi
+
+print:
+	openssl x509 -text -in server.crt
+
+printca:
+	openssl x509 -text -in ca.pem
+
+clean:
+	@rm -f *~ *old client.csr client.key client.crt client.p12 client.pem
+
+#
+#	Make a target that people won't run too often.
+#
+destroycerts:
+	rm -f *~ dh *.csr *.crt *.p12 *.der *.pem *.key index.txt* \
+			serial* random *\.0 *\.1
diff --git a/src/test/setup/radius-config/freeradius/certs_3/Makefile.orig b/src/test/setup/radius-config/freeradius/certs_3/Makefile.orig
new file mode 100644
index 0000000..c8f0892
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/Makefile.orig
@@ -0,0 +1,140 @@
+######################################################################
+#
+#	Make file to be installed in /etc/raddb/certs to enable
+#	the easy creation of certificates.
+#
+#	See the README file in this directory for more information.
+#
+#	$Id: 0613df99502989a6d5751eb8b2088000c58cae98 $
+#
+######################################################################
+
+DH_KEY_SIZE	= 1024
+
+#
+#  Set the passwords
+#
+PASSWORD_SERVER	= `grep output_password server.cnf | sed 's/.*=//;s/^ *//'`
+PASSWORD_CA	= `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'`
+PASSWORD_CLIENT	= `grep output_password client.cnf | sed 's/.*=//;s/^ *//'`
+
+USER_NAME	= `grep emailAddress client.cnf | grep '@' | sed 's/.*=//;s/^ *//'`
+CA_DEFAULT_DAYS = `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'`
+
+######################################################################
+#
+#  Make the necessary files, but not client certificates.
+#
+######################################################################
+.PHONY: all
+all: index.txt serial dh random server ca client
+
+.PHONY: client
+client: client.pem
+
+.PHONY: ca
+ca: ca.der
+
+.PHONY: server
+server: server.pem server.vrfy
+
+######################################################################
+#
+#  Diffie-Hellman parameters
+#
+######################################################################
+dh:
+	openssl dhparam -out dh $(DH_KEY_SIZE)
+
+######################################################################
+#
+#  Create a new self-signed CA certificate
+#
+######################################################################
+ca.key ca.pem: ca.cnf
+	@[ -f index.txt ] || $(MAKE) index.txt
+	@[ -f serial ] || $(MAKE) serial
+	openssl req -new -x509 -keyout ca.key -out ca.pem \
+		-days $(CA_DEFAULT_DAYS) -config ./ca.cnf
+
+ca.der: ca.pem
+	openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der
+
+######################################################################
+#
+#  Create a new server certificate, signed by the above CA.
+#
+######################################################################
+server.csr server.key: server.cnf
+	openssl req -new  -out server.csr -keyout server.key -config ./server.cnf
+
+server.crt: server.csr ca.key ca.pem
+	openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr  -key $(PASSWORD_CA) -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf
+
+server.p12: server.crt
+	openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12  -passin pass:$(PASSWORD_SERVER) -passout pass:$(PASSWORD_SERVER)
+
+server.pem: server.p12
+	openssl pkcs12 -in server.p12 -out server.pem -passin pass:$(PASSWORD_SERVER) -passout pass:$(PASSWORD_SERVER)
+
+.PHONY: server.vrfy
+server.vrfy: ca.pem
+	@openssl verify -CAfile ca.pem server.pem
+
+######################################################################
+#
+#  Create a new client certificate, signed by the the above server
+#  certificate.
+#
+######################################################################
+client.csr client.key: client.cnf
+	openssl req -new  -out client.csr -keyout client.key -config ./client.cnf
+
+client.crt: client.csr ca.pem ca.key
+	openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key $(PASSWORD_CA) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
+
+client.p12: client.crt
+	openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12  -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
+
+client.pem: client.p12
+	openssl pkcs12 -in client.p12 -out client.pem -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
+	cp client.pem $(USER_NAME).pem
+
+.PHONY: client.vrfy
+client.vrfy: ca.pem client.pem
+	c_rehash .
+	openssl verify -CApath . client.pem
+
+######################################################################
+#
+#  Miscellaneous rules.
+#
+######################################################################
+index.txt:
+	@touch index.txt
+
+serial:
+	@echo '01' > serial
+
+random:
+	@if [ -c /dev/urandom ] ; then \
+		ln -sf /dev/urandom random; \
+	else \
+		date > ./random; \
+	fi
+
+print:
+	openssl x509 -text -in server.crt
+
+printca:
+	openssl x509 -text -in ca.pem
+
+clean:
+	@rm -f *~ *old client.csr client.key client.crt client.p12 client.pem
+
+#
+#	Make a target that people won't run too often.
+#
+destroycerts:
+	rm -f *~ dh *.csr *.crt *.p12 *.der *.pem *.key index.txt* \
+			serial* random *\.0 *\.1
diff --git a/src/test/setup/radius-config/freeradius/certs_3/README b/src/test/setup/radius-config/freeradius/certs_3/README
new file mode 100644
index 0000000..f7e0591
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/README
@@ -0,0 +1,226 @@
+  This directory contains scripts to create the server certificates.
+To make a set of default (i.e. test) certificates, simply type:
+
+$ ./bootstrap
+
+  The "openssl" command will be run against the sample configuration
+files included here, and will make a self-signed certificate authority
+(i.e. root CA), and a server certificate.  This "root CA" should be
+installed on any client machine needing to do EAP-TLS, PEAP, or
+EAP-TTLS.
+
+  The Microsoft "XP Extensions" will be automatically included in the
+server certificate.  Without those extensions Windows clients will
+refuse to authenticate to FreeRADIUS.
+
+  The root CA and the "XP Extensions" file also contain a crlDistributionPoints
+attribute. The latest release of Windows Phone needs this to be present
+for the handset to validate the RADIUS server certificate. The RADIUS
+server must have the URI defined but the CA need not have...however it
+is best practice for a CA to have a revocation URI. Note that whilst
+the Windows Mobile client cannot actually use the CRL when doing 802.1X
+it is recommended that the URI be an actual working URL and contain a
+revocation format file as there may be other OS behaviour at play and
+future OSes that may do something with that URI.
+
+  In general, you should use self-signed certificates for 802.1x (EAP)
+authentication.  When you list root CAs from other organisations in
+the "ca_file", you permit them to masquerade as you, to authenticate
+your users, and to issue client certificates for EAP-TLS.
+
+  If FreeRADIUS was configured to use OpenSSL, then simply starting
+the server in root in debugging mode should also create test
+certificates, i.e.:
+
+$ radiusd -X
+
+  That will cause the EAP-TLS module to run the "bootstrap" script in
+this directory.  The script will be executed only once, the first time
+the server has been installed on a particular machine.  This bootstrap
+script SHOULD be run on installation of any pre-built binary package
+for your OS.  In any case, the script will ensure that it is not run
+twice, and that it does not over-write any existing certificates.
+
+  If you already have CA and server certificates, rename (or delete)
+this directory, and create a new "certs" directory containing your
+certificates.  Note that the "make install" command will NOT
+over-write your existing "raddb/certs" directory, which means that the
+"bootstrap" command will not be run.
+
+
+		NEW INSTALLATIONS OF FREERADIUS
+
+
+  We suggest that new installations use the test certificates for
+initial tests, and then create real certificates to use for normal
+user authentication.  See the instructions below for how to create the
+various certificates.  The old test certificates can be deleted by
+running the following command:
+
+$ rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt*
+
+  Then, follow the instructions below for creating real certificates.
+
+  Once the final certificates have been created, you can delete the
+"bootstrap" command from this directory, and delete the
+"make_cert_command" configuration from the "tls" sub-section of
+eap.conf.
+
+  If you do not want to enable EAP-TLS, PEAP, or EAP-TTLS, then delete
+the relevant sub-sections from the "eap.conf" file.
+
+
+		MAKING A ROOT CERTIFICATE
+
+
+$ vi ca.cnf
+
+  Edit the "input_password" and "output_password" fields to be the
+  password for the CA certificate.
+
+  Edit the [certificate_authority] section to have the correct values
+  for your country, state, etc.
+
+$ make ca.pem
+
+  This step creates the CA certificate.
+
+$ make ca.der
+
+  This step creates the DER format of the self-signed certificate,
+  which is can be imported into Windows.
+
+
+		MAKING A SERVER CERTIFICATE
+
+
+$ vi server.cnf
+
+  Edit the "input_password" and "output_password" fields to be the
+  password for the server certificate.
+
+  Edit the [server] section to have the correct values for your
+  country, state, etc.  Be sure that the commonName field here is
+  different from the commonName for the CA certificate.
+
+$ make server.pem
+
+  This step creates the server certificate.
+
+  If you have an existing certificate authority, and wish to create a
+  certificate signing request for the server certificate, edit
+  server.cnf as above, and type the following command.
+
+$ make server.csr
+
+  You will have to ensure that the certificate contains the XP
+  extensions needed by Microsoft clients.
+
+
+		MAKING A CLIENT CERTIFICATE
+
+
+  Client certificates are used by EAP-TLS, and optionally by EAP-TTLS
+and PEAP.  The following steps outline how to create a client
+certificate that is signed by the server certificate created above.
+You will have to have the password for the server certificate in the
+"input_password" and "output_password" fields of the server.cnf file.
+
+
+$ vi client.cnf
+
+  Edit the "input_password" and "output_password" fields to be the
+  password for the client certificate.  You will have to give these
+  passwords to the end user who will be using the certificates.
+
+  Edit the [client] section to have the correct values for your
+  country, state, etc.  Be sure that the commonName field here is
+  the User-Name that will be used for logins!
+
+$ make client.pem
+
+  The users certificate will be in "emailAddress.pem",
+  i.e. "user@example.com.pem".
+
+  To create another client certificate, just repeat the steps for
+  making a client certificate, being sure to enter a different login
+  name for "commonName", and a different password.
+
+
+		PERFORMANCE
+
+
+  EAP performance for EAP-TLS, TTLS, and PEAP is dominated by SSL
+  calculations.  That is, a normal system can handle PAP
+  authentication at a rate of 10k packets/s.  However, SSL involves
+  RSA calculations, which are very expensive.  To benchmark your system,
+  do:
+
+$ openssl speed rsa
+
+  or
+
+$ openssl speed rsa2048
+
+  to test 2048 bit keys.
+
+  A 1GHz system will likely do 30 calculations/s.  A 2GHz system may
+  do 50 calculations/s, or more.  That number is also the number of
+  authentications/s that can be done for EAP-TLS (or TTLS, or PEAP).
+
+
+		COMPATIBILITY
+
+The certificates created using this method are known to be compatible
+with ALL operating systems.  Some common issues are:
+
+  - Windows requires certain OIDs in the certificates.  If it doesn't
+    see them, it will stop doing EAP.  The most visible effect is
+    that the client starts EAP, gets a few Access-Challenge packets,
+    and then a little while later re-starts EAP.  If this happens, see
+    the FAQ, and the comments in raddb/eap.conf for how to fix it.
+
+  - Windows requires the root certificates to be on the client PC.
+    If it doesn't have them, you will see the same issue as above.
+
+  - Windows XP post SP2 has a bug where it has problems with
+    certificate chains.  i.e. if the server certificate is an
+    intermediate one, and not a root one, then authentication will
+    silently fail, as above.
+
+  - Some versions of Windows CE cannot handle 4K RSA certificates.
+    They will (again) silently fail, as above.
+
+  - In none of these cases will Windows give the end user any
+    reasonable error message describing what went wrong.  This leads
+    people to blame the RADIUS server.  That blame is misplaced.
+
+  - Certificate chains of more than 64K bytes are known to not work.
+    This is a problem in FreeRADIUS.  However, most clients cannot
+    handle 64K certificate chains.  Most Access Points will shut down
+    the EAP session after about 50 round trips, while 64K certificate
+    chains will take about 60 round trips.  So don't use large
+    certificate chains.  They will only work after everyone upgrade
+    everything in the network.
+
+  - All other operating systems are known to work with EAP and
+    FreeRADIUS.  This includes Linux, *BSD, Mac OS X, Solaris,
+    Symbian, along with all known embedded systems, phones, WiFi
+    devices, etc.
+
+  - Someone needs to ask Microsoft to please stop making life hard for
+    their customers.
+
+
+		SECURITY CONSIDERATIONS
+
+The default certificate configuration files uses MD5 for message
+digests, to maintain compatibility with network equipment that
+supports only this algorithm.
+
+MD5 has known weaknesses and is discouraged in favour of SHA1 (see
+http://www.kb.cert.org/vuls/id/836068 for details). If your network
+equipment supports the SHA1 signature algorithm, we recommend that you
+change the "ca.cnf", "server.cnf", and "client.cnf" files to specify
+the use of SHA1 for the certificates. To do this, change the
+'default_md' entry in those files from 'md5' to 'sha1'.
diff --git a/src/test/setup/radius-config/freeradius/certs_3/bootstrap b/src/test/setup/radius-config/freeradius/certs_3/bootstrap
new file mode 100755
index 0000000..82f93ec
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/bootstrap
@@ -0,0 +1,82 @@
+#!/bin/sh
+#
+#  This is a wrapper script to create default certificates when the
+#  server first starts in debugging mode.  Once the certificates have been
+#  created, this file should be deleted.
+#
+#  Ideally, this program should be run as part of the installation of any
+#  binary package.  The installation should also ensure that the permissions
+#  and owners are correct for the files generated by this script.
+#
+#  $Id: c9d939beac8d5bdc21ea1ff9233442f9ab933297 $
+#
+umask 027
+cd `dirname $0`
+
+make -h > /dev/null 2>&1
+
+#
+#  If we have a working "make", then use it.  Otherwise, run the commands
+#  manually.
+#
+if [ "$?" = "0" ]; then
+  make all
+  exit $?
+fi
+
+#
+#  The following commands were created by running "make -n", and edited
+#  to remove the trailing backslash, and to add "exit 1" after the commands.
+#
+#  Don't edit the following text.  Instead, edit the Makefile, and
+#  re-generate these commands.
+#
+if [ ! -f dh ]; then
+  openssl dhparam -out dh 1024 || exit 1
+  if [ -e /dev/urandom ] ; then
+	ln -sf /dev/urandom random
+  else
+	date > ./random;
+  fi
+fi
+
+if [ ! -f server.key ]; then
+  openssl req -new  -out server.csr -keyout server.key -config ./server.cnf || exit 1
+fi
+
+if [ ! -f ca.key ]; then
+  openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1
+fi
+
+if [ ! -f index.txt ]; then
+  touch index.txt
+fi
+
+if [ ! -f serial ]; then
+  echo '01' > serial
+fi
+
+if [ ! -f server.crt ]; then
+  openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1
+fi
+
+if [ ! -f server.p12 ]; then
+  openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12  -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
+fi
+
+if [ ! -f server.pem ]; then
+  openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
+  openssl verify -CAfile ca.pem server.pem || exit 1
+fi
+
+if [ ! -f ca.der ]; then
+  openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1
+fi
+
+if [ ! -f client.key ]; then
+  openssl req -new  -out client.csr -keyout client.key -config ./client.cnf
+fi
+
+if [ ! -f client.crt ]; then
+  openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
+fi
diff --git a/src/test/setup/radius-config/freeradius/certs_3/ca.cnf b/src/test/setup/radius-config/freeradius/certs_3/ca.cnf
new file mode 100644
index 0000000..1235124
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/ca.cnf
@@ -0,0 +1,62 @@
+[ ca ]
+default_ca		= CA_default
+
+[ CA_default ]
+dir			= ./
+certs			= $dir
+crl_dir			= $dir/crl
+database		= $dir/index.txt
+new_certs_dir		= $dir
+certificate		= $dir/ca.pem
+serial			= $dir/serial
+crl			= $dir/crl.pem
+private_key		= $dir/ca.key
+RANDFILE		= $dir/.rand
+name_opt		= ca_default
+cert_opt		= ca_default
+default_days		= 360
+default_crl_days	= 300
+default_md		= sha1
+preserve		= no
+policy			= policy_match
+crlDistributionPoints	= URI:http://www.example.com/example_ca.crl
+
+[ policy_match ]
+countryName		= match
+stateOrProvinceName	= match
+organizationName	= match
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+[ policy_anything ]
+countryName		= optional
+stateOrProvinceName	= optional
+localityName		= optional
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+[ req ]
+prompt			= no
+distinguished_name	= certificate_authority
+default_bits		= 1024
+input_password		= whatever
+output_password		= whatever
+x509_extensions		= v3_ca
+
+[certificate_authority]
+countryName		= US
+stateOrProvinceName	= CA
+localityName		= Somewhere
+organizationName	= Ciena Inc.
+emailAddress		= admin@ciena.com
+commonName		= "Example Certificate Authority"
+
+[v3_ca]
+subjectKeyIdentifier	= hash
+authorityKeyIdentifier	= keyid:always,issuer:always
+basicConstraints	= CA:true
+crlDistributionPoints	= URI:http://www.example.com/example_ca.crl
+
diff --git a/src/test/setup/radius-config/freeradius/certs_3/ca.der b/src/test/setup/radius-config/freeradius/certs_3/ca.der
new file mode 100644
index 0000000..1c35967
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/ca.der
Binary files differ
diff --git a/src/test/setup/radius-config/freeradius/certs_3/ca.key b/src/test/setup/radius-config/freeradius/certs_3/ca.key
new file mode 100644
index 0000000..54943c2
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/ca.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQDJUqpU2cd6KM+kFfLM/o4hxPkQqn4YQyM/CU2CuJA6ip0Zou/t
+54ck6voSoJ3y26rh74leAwM0uK7OA1VnmwgtdIYQ3Fy4FYVzxzdQykcXhQwB41zY
+23IpHQxlgiyzJbTYD4R4ykA7r8KusQTmkr+CtPvZr94TWZgp2JESDhIV2QIDAQAB
+AoGAZeg4XFcYyFdcM/0AOJAqNiHUyYDj7zgc4U2+NItkRp3fxBhcRxrJqABhsYgo
+K8TSDSgJatMvjkJmCdZaJuWtDx3sfNkUhQRsj+LK0A+HZ8+vxWnRYrgbeaZcD7QU
+LCPCKd2hpstrCW40218DjipjQ5rf4ZOyT4wJfPWE/YXPx5kCQQD+zyizdUGloFOS
+nlyk5udFhE/sp3Bgctg6U7UElhBulL1VqJL1p8PEfgX89aTzN7jhgC/wBOhcooRp
+fGmHT0HjAkEAykOEnYLdU6eK62e2n9TXjqmIb0FzNfnasfAA6jZXtS2scBbZ/Ae5
+VUvG+FDnCvQx/NGUVKF5KFIKYOHLxV2mEwJAJmfnBJWJ3YL61cCUyi4bcbjtqwfZ
+wk/NE42GXTiZJXG5z+1mqSwuL7GnCWelAxvE/AgsMYsr0rqUJqof5csmbQJBAJmk
+lj1sJiIguAc//lsFPEUThR82MYVD6ZuW+6ruYsuvCTkQMsAfQeqIKHmCQy9v9fTd
+Yvayvi0hvN6BRuAC1l8CQQCAvdyISjg0kPpJ/LhDcEcWLwk94jQc2Ek/8isDdylL
+5Ubk96pmEhaiAgdBp94tyaqw43IEqYqv80lE9KTLe3T5
+-----END RSA PRIVATE KEY-----
diff --git a/src/test/setup/radius-config/freeradius/certs_3/ca.pem b/src/test/setup/radius-config/freeradius/certs_3/ca.pem
new file mode 100644
index 0000000..3f9f95f
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/ca.pem
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDxDCCAy2gAwIBAgIJALONXjUjVRn0MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYD
+VQQGEwJVUzELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCVNvbWV3aGVyZTETMBEGA1UE
+ChMKQ2llbmEgSW5jLjEeMBwGCSqGSIb3DQEJARYPYWRtaW5AY2llbmEuY29tMSYw
+JAYDVQQDEx1FeGFtcGxlIENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xNjA2MDYy
+MTEyMjdaFw0xNzA2MDEyMTEyMjdaMIGLMQswCQYDVQQGEwJVUzELMAkGA1UECBMC
+Q0ExEjAQBgNVBAcTCVNvbWV3aGVyZTETMBEGA1UEChMKQ2llbmEgSW5jLjEeMBwG
+CSqGSIb3DQEJARYPYWRtaW5AY2llbmEuY29tMSYwJAYDVQQDEx1FeGFtcGxlIENl
+cnRpZmljYXRlIEF1dGhvcml0eTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+yVKqVNnHeijPpBXyzP6OIcT5EKp+GEMjPwlNgriQOoqdGaLv7eeHJOr6EqCd8tuq
+4e+JXgMDNLiuzgNVZ5sILXSGENxcuBWFc8c3UMpHF4UMAeNc2NtyKR0MZYIssyW0
+2A+EeMpAO6/CrrEE5pK/grT72a/eE1mYKdiREg4SFdkCAwEAAaOCASwwggEoMB0G
+A1UdDgQWBBSIE0e45Nu8yfaKVWMWh33UOIH6UzCBwAYDVR0jBIG4MIG1gBSIE0e4
+5Nu8yfaKVWMWh33UOIH6U6GBkaSBjjCBizELMAkGA1UEBhMCVVMxCzAJBgNVBAgT
+AkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5hIEluYy4xHjAc
+BgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMdRXhhbXBsZSBD
+ZXJ0aWZpY2F0ZSBBdXRob3JpdHmCCQCzjV41I1UZ9DAMBgNVHRMEBTADAQH/MDYG
+A1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly93d3cuZXhhbXBsZS5jb20vZXhhbXBsZV9j
+YS5jcmwwDQYJKoZIhvcNAQELBQADgYEAS5i9vLrlq824mUHlQx+wSTX+z4G/hB3p
+s4oruGnmNtKh98qUVncySYPDmIMRNLAAGiZm2VXTeGzgWl5nvROeQDIY2SfNoaLT
+VOjaTDWSeAIXwbyxAad6cvu0XHa3piI4Pg1vzA7PofGBsV/IpO4EoUv1CerRLCuU
+ex88tU+lHhw=
+-----END CERTIFICATE-----
diff --git a/src/test/setup/radius-config/freeradius/certs_3/client.cnf b/src/test/setup/radius-config/freeradius/certs_3/client.cnf
new file mode 100644
index 0000000..b3cbdd2
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/client.cnf
@@ -0,0 +1,53 @@
+[ ca ]
+default_ca		= CA_default
+
+[ CA_default ]
+dir			= ./
+certs			= $dir
+crl_dir			= $dir/crl
+database		= $dir/index.txt
+new_certs_dir		= $dir
+certificate		= $dir/ca.pem
+serial			= $dir/serial
+crl			= $dir/crl.pem
+private_key		= $dir/ca.key
+RANDFILE		= $dir/.rand
+name_opt		= ca_default
+cert_opt		= ca_default
+default_days		= 360
+default_crl_days	= 300
+default_md		= sha1
+preserve		= no
+policy			= policy_match
+
+[ policy_match ]
+countryName		= match
+stateOrProvinceName	= match
+organizationName	= match
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+[ policy_anything ]
+countryName		= optional
+stateOrProvinceName	= optional
+localityName		= optional
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+[ req ]
+prompt			= no
+distinguished_name	= client
+default_bits		= 1024
+input_password		= whatever
+output_password		= whatever
+
+[client]
+countryName		= US
+stateOrProvinceName	= CA
+localityName		= Somewhere
+organizationName	= Ciena Inc.
+emailAddress		= user@ciena.com
+commonName		= user@ciena.com
diff --git a/src/test/setup/radius-config/freeradius/certs_3/client.crt b/src/test/setup/radius-config/freeradius/certs_3/client.crt
new file mode 100644
index 0000000..fd66778
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/client.crt
@@ -0,0 +1,58 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=CA, L=Somewhere, O=Ciena Inc./emailAddress=admin@ciena.com, CN=Example Certificate Authority
+        Validity
+            Not Before: Jun  6 21:12:27 2016 GMT
+            Not After : Jun  1 21:12:27 2017 GMT
+        Subject: C=US, ST=CA, O=Ciena Inc., CN=user@ciena.com/emailAddress=user@ciena.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:c2:f5:e2:4b:36:fd:2d:9e:9c:ee:e3:73:89:47:
+                    ca:be:81:ce:ef:0b:bf:ba:21:42:e5:85:29:5d:b9:
+                    95:1a:e1:99:8b:36:d5:ae:7c:b4:c6:74:7c:e4:37:
+                    de:fb:d4:78:76:26:a7:b1:f0:e1:22:1c:ce:52:5d:
+                    57:8c:dd:d8:0d:e4:92:f4:e7:85:e5:85:8d:34:4f:
+                    17:0e:19:73:d9:dd:eb:57:36:8d:ea:12:21:76:8b:
+                    41:91:48:e0:ad:47:b0:8d:38:39:38:54:77:d5:01:
+                    32:1b:7b:fc:c5:1d:c2:2e:08:84:f7:14:04:2e:36:
+                    5b:48:0d:3b:a4:3e:fd:ce:e5
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://www.example.com/example_ca.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+         c0:8e:4a:d8:ea:d0:c2:86:62:9b:be:bf:30:e8:3b:bf:b7:cb:
+         c7:8d:30:a8:08:8a:1c:1d:33:74:ab:35:8e:79:bd:58:b0:01:
+         97:f3:df:93:ad:62:2e:3b:57:45:c9:87:7e:67:42:82:3c:32:
+         81:e6:3f:f2:82:69:7d:35:af:80:92:54:98:01:52:48:8e:f9:
+         73:5c:a6:6b:39:a3:e6:85:9a:83:b9:f8:be:ad:75:ad:8b:fb:
+         ad:56:a6:38:54:c5:b6:f8:72:82:9d:7a:77:ee:a5:9e:b8:52:
+         c6:c9:1d:79:d7:d6:35:77:a1:7f:e5:7c:ea:9a:f6:f0:51:1b:
+         84:ba
+-----BEGIN CERTIFICATE-----
+MIICuDCCAiGgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
+IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
+RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwNjA2MjExMjI3WhcN
+MTcwNjAxMjExMjI3WjBnMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
+BAoTCkNpZW5hIEluYy4xFzAVBgNVBAMUDnVzZXJAY2llbmEuY29tMR0wGwYJKoZI
+hvcNAQkBFg51c2VyQGNpZW5hLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
+gYEAwvXiSzb9LZ6c7uNziUfKvoHO7wu/uiFC5YUpXbmVGuGZizbVrny0xnR85Dfe
++9R4diansfDhIhzOUl1XjN3YDeSS9OeF5YWNNE8XDhlz2d3rVzaN6hIhdotBkUjg
+rUewjTg5OFR31QEyG3v8xR3CLgiE9xQELjZbSA07pD79zuUCAwEAAaNPME0wEwYD
+VR0lBAwwCgYIKwYBBQUHAwIwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5l
+eGFtcGxlLmNvbS9leGFtcGxlX2NhLmNybDANBgkqhkiG9w0BAQUFAAOBgQDAjkrY
+6tDChmKbvr8w6Du/t8vHjTCoCIocHTN0qzWOeb1YsAGX89+TrWIuO1dFyYd+Z0KC
+PDKB5j/ygml9Na+AklSYAVJIjvlzXKZrOaPmhZqDufi+rXWti/utVqY4VMW2+HKC
+nXp37qWeuFLGyR1519Y1d6F/5XzqmvbwURuEug==
+-----END CERTIFICATE-----
diff --git a/src/test/setup/radius-config/freeradius/certs_3/client.csr b/src/test/setup/radius-config/freeradius/certs_3/client.csr
new file mode 100644
index 0000000..1b48939
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/client.csr
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIBuzCCASQCAQAwezELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRIwEAYDVQQH
+EwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5hIEluYy4xHTAbBgkqhkiG9w0BCQEW
+DnVzZXJAY2llbmEuY29tMRcwFQYDVQQDFA51c2VyQGNpZW5hLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAwvXiSzb9LZ6c7uNziUfKvoHO7wu/uiFC5YUp
+XbmVGuGZizbVrny0xnR85Dfe+9R4diansfDhIhzOUl1XjN3YDeSS9OeF5YWNNE8X
+Dhlz2d3rVzaN6hIhdotBkUjgrUewjTg5OFR31QEyG3v8xR3CLgiE9xQELjZbSA07
+pD79zuUCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4GBAAK1SEtJD81KQraGLJq2nzpw
+e8ORfVMaYvsh1P29K5bDedaZ9nEAAxZPDgXwT2jrGAgOSEzAgQ3FXviPbZqoSNNx
+0TK7+1E2oaiKJCx8quOVfmAW2+1Tt+hXBkjxuY35+iF8MQTS0HNw8SpC5gJwUr4h
+E24o/u65+RDAiElfrdrQ
+-----END CERTIFICATE REQUEST-----
diff --git a/src/test/setup/radius-config/freeradius/certs_3/client.key b/src/test/setup/radius-config/freeradius/certs_3/client.key
new file mode 100644
index 0000000..fbacb78
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/client.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDC9eJLNv0tnpzu43OJR8q+gc7vC7+6IULlhSlduZUa4ZmLNtWu
+fLTGdHzkN9771Hh2Jqex8OEiHM5SXVeM3dgN5JL054XlhY00TxcOGXPZ3etXNo3q
+EiF2i0GRSOCtR7CNODk4VHfVATIbe/zFHcIuCIT3FAQuNltIDTukPv3O5QIDAQAB
+AoGBAJha7NgYhevzqvIov25Fs1QDP0Kh7Ne5DH0u/e+nirUyHfqkBILSI7d+6uay
+Hsiv9t9mP+CXvGgbGMVW+oc0CpUbZw4Y64jZhg/vakMuHVhpgUCyPyzjk+7Z7STg
+2B1DEAxILApU8azjrDBIRHM8q0CH6NFwJPpFjg2oi7li6hPhAkEA56e/UT7Mh+57
+qWb2q9CuI+unQcav1tqxRxUtrGHl0YSO5YTWCnaT7vVFUSbemwUhEHJs8h+Qw41L
+g4eBu/qXLQJBANdy7puiDBBvV8XxQms14VRAEUUpCwqmzieG3RNmgr7wYRKyXzws
+hbgp5HIkGFIM4FOIrFj5jUP6CuF2BfoYaZkCQGRIny75w6s413nfY/u/TBOqyW5V
+J/wYElSWW35bpxTLkNzVY5+F88ankUlvTUDIuKaZEobCmXW+bilTeRs6gUUCQGeo
+2Lzw3rUZnTWTus0yg1Ox751C/hkF4LKL5NpsvAN6THpecAvXsA7HuS5hx4HSyCvo
+2mOEzj8ikxGfY4jNLiECQE09wQ39Gw3oGKCzdsTcWy8PXIWjOS44+7N/GjUB52+o
+CK7BGBOdZGZUSFc1rVA7eWKzxFDZ+EK264z6DL95mRw=
+-----END RSA PRIVATE KEY-----
diff --git a/src/test/setup/radius-config/freeradius/certs_3/client.p12 b/src/test/setup/radius-config/freeradius/certs_3/client.p12
new file mode 100644
index 0000000..7d9e2b5
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/client.p12
Binary files differ
diff --git a/src/test/setup/radius-config/freeradius/certs_3/client.pem b/src/test/setup/radius-config/freeradius/certs_3/client.pem
new file mode 100644
index 0000000..284a484
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/client.pem
@@ -0,0 +1,39 @@
+Bag Attributes
+    localKeyID: F6 7E 1B 99 53 80 BE 9D A3 BA 7A E8 F5 36 5C DB 4B F8 F1 AD 
+subject=/C=US/ST=CA/O=Ciena Inc./CN=user@ciena.com/emailAddress=user@ciena.com
+issuer=/C=US/ST=CA/L=Somewhere/O=Ciena Inc./emailAddress=admin@ciena.com/CN=Example Certificate Authority
+-----BEGIN CERTIFICATE-----
+MIICuDCCAiGgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
+IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
+RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwNjA2MjExMjI3WhcN
+MTcwNjAxMjExMjI3WjBnMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
+BAoTCkNpZW5hIEluYy4xFzAVBgNVBAMUDnVzZXJAY2llbmEuY29tMR0wGwYJKoZI
+hvcNAQkBFg51c2VyQGNpZW5hLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
+gYEAwvXiSzb9LZ6c7uNziUfKvoHO7wu/uiFC5YUpXbmVGuGZizbVrny0xnR85Dfe
++9R4diansfDhIhzOUl1XjN3YDeSS9OeF5YWNNE8XDhlz2d3rVzaN6hIhdotBkUjg
+rUewjTg5OFR31QEyG3v8xR3CLgiE9xQELjZbSA07pD79zuUCAwEAAaNPME0wEwYD
+VR0lBAwwCgYIKwYBBQUHAwIwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5l
+eGFtcGxlLmNvbS9leGFtcGxlX2NhLmNybDANBgkqhkiG9w0BAQUFAAOBgQDAjkrY
+6tDChmKbvr8w6Du/t8vHjTCoCIocHTN0qzWOeb1YsAGX89+TrWIuO1dFyYd+Z0KC
+PDKB5j/ygml9Na+AklSYAVJIjvlzXKZrOaPmhZqDufi+rXWti/utVqY4VMW2+HKC
+nXp37qWeuFLGyR1519Y1d6F/5XzqmvbwURuEug==
+-----END CERTIFICATE-----
+Bag Attributes
+    localKeyID: F6 7E 1B 99 53 80 BE 9D A3 BA 7A E8 F5 36 5C DB 4B F8 F1 AD 
+Key Attributes: <No Attributes>
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDC9eJLNv0tnpzu43OJR8q+gc7vC7+6IULlhSlduZUa4ZmLNtWu
+fLTGdHzkN9771Hh2Jqex8OEiHM5SXVeM3dgN5JL054XlhY00TxcOGXPZ3etXNo3q
+EiF2i0GRSOCtR7CNODk4VHfVATIbe/zFHcIuCIT3FAQuNltIDTukPv3O5QIDAQAB
+AoGBAJha7NgYhevzqvIov25Fs1QDP0Kh7Ne5DH0u/e+nirUyHfqkBILSI7d+6uay
+Hsiv9t9mP+CXvGgbGMVW+oc0CpUbZw4Y64jZhg/vakMuHVhpgUCyPyzjk+7Z7STg
+2B1DEAxILApU8azjrDBIRHM8q0CH6NFwJPpFjg2oi7li6hPhAkEA56e/UT7Mh+57
+qWb2q9CuI+unQcav1tqxRxUtrGHl0YSO5YTWCnaT7vVFUSbemwUhEHJs8h+Qw41L
+g4eBu/qXLQJBANdy7puiDBBvV8XxQms14VRAEUUpCwqmzieG3RNmgr7wYRKyXzws
+hbgp5HIkGFIM4FOIrFj5jUP6CuF2BfoYaZkCQGRIny75w6s413nfY/u/TBOqyW5V
+J/wYElSWW35bpxTLkNzVY5+F88ankUlvTUDIuKaZEobCmXW+bilTeRs6gUUCQGeo
+2Lzw3rUZnTWTus0yg1Ox751C/hkF4LKL5NpsvAN6THpecAvXsA7HuS5hx4HSyCvo
+2mOEzj8ikxGfY4jNLiECQE09wQ39Gw3oGKCzdsTcWy8PXIWjOS44+7N/GjUB52+o
+CK7BGBOdZGZUSFc1rVA7eWKzxFDZ+EK264z6DL95mRw=
+-----END RSA PRIVATE KEY-----
\ No newline at end of file
diff --git a/src/test/setup/radius-config/freeradius/certs_3/dh b/src/test/setup/radius-config/freeradius/certs_3/dh
new file mode 100644
index 0000000..d7a3d42
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/dh
@@ -0,0 +1,5 @@
+-----BEGIN DH PARAMETERS-----
+MIGHAoGBAMpAOQ7EDU3k70JRJm9vtzlw09rpbH0CUZDppg0EeCc6iqVsP3FSy8hO
+fMQ/1Wp2froiJ3V8FyhlwkZPye4np0B5r95qUgEKUrt8kkmjD4WlS3QeXfTePAtS
+f3UcHa3MHsZ8ep1uv9WXuzGHA7c/dBHdr1m01j+Kky6wYH/1nnCrAgEC
+-----END DH PARAMETERS-----
diff --git a/src/test/setup/radius-config/freeradius/certs_3/index.txt b/src/test/setup/radius-config/freeradius/certs_3/index.txt
new file mode 100644
index 0000000..4dfe249
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/index.txt
@@ -0,0 +1,2 @@
+V	170601211227Z		01	unknown	/C=US/ST=CA/O=Ciena Inc./CN=Example Server Certificate/emailAddress=admin@ciena.com
+V	170601211227Z		02	unknown	/C=US/ST=CA/O=Ciena Inc./CN=user@ciena.com/emailAddress=user@ciena.com
diff --git a/src/test/setup/radius-config/freeradius/certs_3/index.txt.attr b/src/test/setup/radius-config/freeradius/certs_3/index.txt.attr
new file mode 100644
index 0000000..8f7e63a
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/index.txt.attr
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/src/test/setup/radius-config/freeradius/certs_3/index.txt.attr.old b/src/test/setup/radius-config/freeradius/certs_3/index.txt.attr.old
new file mode 100644
index 0000000..8f7e63a
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/index.txt.attr.old
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/src/test/setup/radius-config/freeradius/certs_3/index.txt.old b/src/test/setup/radius-config/freeradius/certs_3/index.txt.old
new file mode 100644
index 0000000..f4394b3
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/index.txt.old
@@ -0,0 +1 @@
+V	170601211227Z		01	unknown	/C=US/ST=CA/O=Ciena Inc./CN=Example Server Certificate/emailAddress=admin@ciena.com
diff --git a/src/test/setup/radius-config/freeradius/certs_3/random b/src/test/setup/radius-config/freeradius/certs_3/random
new file mode 120000
index 0000000..a222f14
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/random
@@ -0,0 +1 @@
+/dev/urandom
\ No newline at end of file
diff --git a/src/test/setup/radius-config/freeradius/certs_3/serial b/src/test/setup/radius-config/freeradius/certs_3/serial
new file mode 100644
index 0000000..75016ea
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/serial
@@ -0,0 +1 @@
+03
diff --git a/src/test/setup/radius-config/freeradius/certs_3/serial.old b/src/test/setup/radius-config/freeradius/certs_3/serial.old
new file mode 100644
index 0000000..9e22bcb
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/serial.old
@@ -0,0 +1 @@
+02
diff --git a/src/test/setup/radius-config/freeradius/certs_3/server.cnf b/src/test/setup/radius-config/freeradius/certs_3/server.cnf
new file mode 100644
index 0000000..444372d
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/server.cnf
@@ -0,0 +1,54 @@
+[ ca ]
+default_ca		= CA_default
+
+[ CA_default ]
+dir			= ./
+certs			= $dir
+crl_dir			= $dir/crl
+database		= $dir/index.txt
+new_certs_dir		= $dir
+certificate		= $dir/server.pem
+serial			= $dir/serial
+crl			= $dir/crl.pem
+private_key		= $dir/server.key
+RANDFILE		= $dir/.rand
+name_opt		= ca_default
+cert_opt		= ca_default
+default_days		= 360
+default_crl_days	= 300
+default_md		= sha1
+preserve		= no
+policy			= policy_match
+
+[ policy_match ]
+countryName		= match
+stateOrProvinceName	= match
+organizationName	= match
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+[ policy_anything ]
+countryName		= optional
+stateOrProvinceName	= optional
+localityName		= optional
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+[ req ]
+prompt			= no
+distinguished_name	= server
+default_bits		= 2048
+input_password		= whatever
+output_password		= whatever
+
+[server]
+countryName		= US
+stateOrProvinceName	= CA
+localityName		= Somewhere
+organizationName	= Ciena Inc.
+emailAddress		= admin@ciena.com
+commonName		= "Example Server Certificate"
+
diff --git a/src/test/setup/radius-config/freeradius/certs_3/server.crt b/src/test/setup/radius-config/freeradius/certs_3/server.crt
new file mode 100644
index 0000000..ea92e54
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/server.crt
@@ -0,0 +1,70 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=CA, L=Somewhere, O=Ciena Inc./emailAddress=admin@ciena.com, CN=Example Certificate Authority
+        Validity
+            Not Before: Jun  6 21:12:27 2016 GMT
+            Not After : Jun  1 21:12:27 2017 GMT
+        Subject: C=US, ST=CA, O=Ciena Inc., CN=Example Server Certificate/emailAddress=admin@ciena.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:9e:ca:94:59:9c:35:4c:84:93:99:02:ec:7c:a4:
+                    60:4c:b4:60:97:89:01:9a:0e:45:4d:c5:69:71:de:
+                    b9:e8:b8:78:ee:be:49:bc:30:4f:7e:2c:00:48:8c:
+                    ed:36:b7:48:0e:7e:67:6e:ac:7f:ba:21:78:91:fe:
+                    64:a7:30:6e:9c:41:d3:1f:89:f6:1f:33:7c:1f:c4:
+                    34:c0:89:ba:cf:71:f9:8b:4b:d2:ef:e9:7b:df:0b:
+                    5b:04:8e:40:fb:cf:a4:08:b5:e4:ab:40:16:a5:47:
+                    bc:90:c8:04:fc:d8:f2:05:0a:27:a7:c4:6c:c2:9a:
+                    a2:3c:f8:c6:fe:ff:d7:67:3c:aa:99:15:c2:52:b3:
+                    8f:ff:77:58:3c:06:66:03:24:fd:ab:e1:a3:cb:a9:
+                    6d:f9:e5:37:21:02:23:49:5f:61:c5:2b:fd:75:ac:
+                    d5:2c:27:9d:7c:24:46:2b:4c:6d:01:bd:a8:51:2a:
+                    9d:d7:03:53:30:c6:52:07:4e:62:5c:aa:d0:57:28:
+                    30:17:e6:c0:2a:8b:86:49:97:85:ba:fc:cb:d0:b0:
+                    67:9b:a0:ee:3a:14:32:7a:fd:6a:9b:bb:f9:75:9c:
+                    a5:c3:ab:a2:64:f0:2b:5c:24:cc:df:d1:6a:42:8c:
+                    ca:7c:5e:06:96:59:79:d8:18:26:5e:b2:e3:b3:6b:
+                    8f:df
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://www.example.com/example_ca.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+         1d:65:7f:32:5b:2d:60:5d:17:ee:c5:e1:92:f2:cf:38:7b:f7:
+         cb:92:a2:5c:06:b2:bd:34:96:68:15:91:8c:85:92:f4:cc:af:
+         7a:b7:9c:10:2b:26:da:b6:5e:e4:66:01:8c:ad:9c:8f:bc:02:
+         9a:88:12:e2:2f:47:70:68:a5:b3:f1:df:6b:7f:82:d2:76:52:
+         fe:c0:2c:2c:cd:2d:26:2c:8a:52:f7:92:35:ce:50:5f:5b:26:
+         f0:bd:ef:ac:bc:fd:87:f7:87:37:d7:2b:56:9a:5a:14:b4:97:
+         b4:df:b4:95:c8:7b:76:49:a1:4b:5b:f7:10:4d:f1:b5:16:99:
+         f1:19
+-----BEGIN CERTIFICATE-----
+MIIDSTCCArKgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
+IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
+RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwNjA2MjExMjI3WhcN
+MTcwNjAxMjExMjI3WjB0MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
+BAoTCkNpZW5hIEluYy4xIzAhBgNVBAMTGkV4YW1wbGUgU2VydmVyIENlcnRpZmlj
+YXRlMR4wHAYJKoZIhvcNAQkBFg9hZG1pbkBjaWVuYS5jb20wggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQCeypRZnDVMhJOZAux8pGBMtGCXiQGaDkVNxWlx
+3rnouHjuvkm8ME9+LABIjO02t0gOfmdurH+6IXiR/mSnMG6cQdMfifYfM3wfxDTA
+ibrPcfmLS9Lv6XvfC1sEjkD7z6QIteSrQBalR7yQyAT82PIFCienxGzCmqI8+Mb+
+/9dnPKqZFcJSs4//d1g8BmYDJP2r4aPLqW355TchAiNJX2HFK/11rNUsJ518JEYr
+TG0BvahRKp3XA1MwxlIHTmJcqtBXKDAX5sAqi4ZJl4W6/MvQsGeboO46FDJ6/Wqb
+u/l1nKXDq6Jk8CtcJMzf0WpCjMp8XgaWWXnYGCZesuOza4/fAgMBAAGjTzBNMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly93d3cu
+ZXhhbXBsZS5jb20vZXhhbXBsZV9jYS5jcmwwDQYJKoZIhvcNAQEFBQADgYEAHWV/
+MlstYF0X7sXhkvLPOHv3y5KiXAayvTSWaBWRjIWS9MyverecECsm2rZe5GYBjK2c
+j7wCmogS4i9HcGils/Hfa3+C0nZS/sAsLM0tJiyKUveSNc5QX1sm8L3vrLz9h/eH
+N9crVppaFLSXtN+0lch7dkmhS1v3EE3xtRaZ8Rk=
+-----END CERTIFICATE-----
diff --git a/src/test/setup/radius-config/freeradius/certs_3/server.csr b/src/test/setup/radius-config/freeradius/certs_3/server.csr
new file mode 100644
index 0000000..3b0b246
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/server.csr
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICzjCCAbYCAQAwgYgxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTESMBAGA1UE
+BxMJU29tZXdoZXJlMRMwEQYDVQQKEwpDaWVuYSBJbmMuMR4wHAYJKoZIhvcNAQkB
+Fg9hZG1pbkBjaWVuYS5jb20xIzAhBgNVBAMTGkV4YW1wbGUgU2VydmVyIENlcnRp
+ZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnsqUWZw1TIST
+mQLsfKRgTLRgl4kBmg5FTcVpcd656Lh47r5JvDBPfiwASIztNrdIDn5nbqx/uiF4
+kf5kpzBunEHTH4n2HzN8H8Q0wIm6z3H5i0vS7+l73wtbBI5A+8+kCLXkq0AWpUe8
+kMgE/NjyBQonp8RswpqiPPjG/v/XZzyqmRXCUrOP/3dYPAZmAyT9q+Gjy6lt+eU3
+IQIjSV9hxSv9dazVLCedfCRGK0xtAb2oUSqd1wNTMMZSB05iXKrQVygwF+bAKouG
+SZeFuvzL0LBnm6DuOhQyev1qm7v5dZylw6uiZPArXCTM39FqQozKfF4Glll52Bgm
+XrLjs2uP3wIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBAGkM8qrENLFwbDbLRynH
+NlZtLcbRjSV7YfCIBRqakX/LRsKg/7tUesT9nlSHC0AQdPKpYi2qWaoHWYrcTiW6
+YNpL7N96tFQqo048XV0AZbimLeM/XIdvP7bAR2p5AGX7yGFLswcxgLvw1Gkkam16
+3u4yIWjVchl8MuxcdUo3wCLHgW181Z53BfpWQyhFOiwKtRvamZgfCgKYP87fMrlk
+zg0s0PIJEWdt3O0H+WMLvjt6pZNrfFt/J61cJmZ3ltbsJtkbMn+D/X6IzVXQPRIQ
+o1lE65CfzNrqwYfwU5e+VEixXiuMjS+W9+I/MCM79Xrg5bANAtqzVWs08AQ3/Krp
+sSY=
+-----END CERTIFICATE REQUEST-----
diff --git a/src/test/setup/radius-config/freeradius/certs_3/server.key b/src/test/setup/radius-config/freeradius/certs_3/server.key
new file mode 100644
index 0000000..42c203e
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/server.key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAnsqUWZw1TISTmQLsfKRgTLRgl4kBmg5FTcVpcd656Lh47r5J
+vDBPfiwASIztNrdIDn5nbqx/uiF4kf5kpzBunEHTH4n2HzN8H8Q0wIm6z3H5i0vS
+7+l73wtbBI5A+8+kCLXkq0AWpUe8kMgE/NjyBQonp8RswpqiPPjG/v/XZzyqmRXC
+UrOP/3dYPAZmAyT9q+Gjy6lt+eU3IQIjSV9hxSv9dazVLCedfCRGK0xtAb2oUSqd
+1wNTMMZSB05iXKrQVygwF+bAKouGSZeFuvzL0LBnm6DuOhQyev1qm7v5dZylw6ui
+ZPArXCTM39FqQozKfF4Glll52BgmXrLjs2uP3wIDAQABAoIBAHdEIPjNYxr92P5s
+O8PCkrIKKSKoPRPA9Dzdsb1dVLV/GRX4xtkaUBqsYeocL2+RagW422c9GRJsYWsG
+cANDVVD3/+MIdFwrB2e0rwqOaEm3iX8ejGi2LdvxY4OgdR6tbr88H2ygzmGF6BO2
+qEhhiiZO4koYNrhT/Nde49hTwS5AK742M5UjLDoytbhWr7/UiPA5dXZPVgLYp/C/
+y71S8n8DkZd0KA0EFAnirVVeQ8+bhBHd/7V0UVeQgOcwt2bvTX/lM9vB+mfRNgpK
+de8XLFVzoFwIB2Zmun25XHCnh2m9u+UjYnOsScpqGW9lrMJU0CF47FHHws2heS1j
+ZWWCk0ECgYEAz/FAnb9FiC0NVPPh3/jisoLUCtQr+YmL/7woWBh9XTX0u89L9egS
+uCsCYKRQU68Av/gZH0OGe7nUOnS9XS3ox21YuWi56A1Dt0fE3sY/fakHscB+DI4y
+RpWe3Sq7fNw2dD6+zVwkyxzijx72rTFsuE5fbi4Wu+GfVxqWcpF6k9UCgYEAw31X
+0S5ATHwrxWXzeFFh6PI0TYlrAEOrv2VPTnjTdO0hSRTlGQIyw2CTJsPLKhnzGcoE
+YWR+bc65YYyRHFvdg1z2AzkxTjlDKPDDDIHsN/8ioGOkgdHrfHPj+IYomCK2gTiK
+b9ACWa4eJie1WuCa1jFxOwesME8R4h6PF8I/kuMCgYEAlGs03KMeBPFrF5yvNsaV
+QCbDJCuGa6iyRUlOXnq0WChf0wFFzXHkkpEYNFRzhRde6KYzgC4ZOgxMH6EdW/md
+sWIptsS6FJgLIjFWok9MF+viswuarGl+FwVKC8ApbBhdwaDbXQaMuHCYgODv3nRt
+jitaT/EThuymZ2xxv7p4jDUCgYAcBK3+dCOREsbvPuJ7XyaqTXSDnGtymUBXaTzJ
+oXWlL4tyvwTq5a7C4+eTScKnoRp/mr2v+8hHErbtLUlrCBuihUNZSOwxKvHeP0ul
+UkW57N5YoI9mb+DRcIa/CvNsgqUntiPZTLXZhqQZkd1jTgfDJUj2Te426k5E215k
+6FlWQwKBgHzyo9wJlVVa7H6rMrbC4DciHzlHd1b5Ua+KMhUcQevkI28yr/S4P0kQ
+xzv3TqyiH1Zs9YT3+cXbx4fQbJMCIT1M0m2a5wqctS4fx+dvCldMtZBvTlvg5dK4
++xq1HPyYnldr4Q/XBIL12dCVH2EC5p3lXiUhOzyTVNvh1CM0SPIV
+-----END RSA PRIVATE KEY-----
diff --git a/src/test/setup/radius-config/freeradius/certs_3/server.p12 b/src/test/setup/radius-config/freeradius/certs_3/server.p12
new file mode 100644
index 0000000..da9f861
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/server.p12
Binary files differ
diff --git a/src/test/setup/radius-config/freeradius/certs_3/server.pem b/src/test/setup/radius-config/freeradius/certs_3/server.pem
new file mode 100644
index 0000000..cb5396b
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/server.pem
@@ -0,0 +1,54 @@
+Bag Attributes
+    localKeyID: 42 D6 81 81 00 AD 68 D4 EF 8C 30 42 2E 38 B1 D1 73 E5 42 58 
+subject=/C=US/ST=CA/O=Ciena Inc./CN=Example Server Certificate/emailAddress=admin@ciena.com
+issuer=/C=US/ST=CA/L=Somewhere/O=Ciena Inc./emailAddress=admin@ciena.com/CN=Example Certificate Authority
+-----BEGIN CERTIFICATE-----
+MIIDSTCCArKgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
+IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
+RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwNjA2MjExMjI3WhcN
+MTcwNjAxMjExMjI3WjB0MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
+BAoTCkNpZW5hIEluYy4xIzAhBgNVBAMTGkV4YW1wbGUgU2VydmVyIENlcnRpZmlj
+YXRlMR4wHAYJKoZIhvcNAQkBFg9hZG1pbkBjaWVuYS5jb20wggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQCeypRZnDVMhJOZAux8pGBMtGCXiQGaDkVNxWlx
+3rnouHjuvkm8ME9+LABIjO02t0gOfmdurH+6IXiR/mSnMG6cQdMfifYfM3wfxDTA
+ibrPcfmLS9Lv6XvfC1sEjkD7z6QIteSrQBalR7yQyAT82PIFCienxGzCmqI8+Mb+
+/9dnPKqZFcJSs4//d1g8BmYDJP2r4aPLqW355TchAiNJX2HFK/11rNUsJ518JEYr
+TG0BvahRKp3XA1MwxlIHTmJcqtBXKDAX5sAqi4ZJl4W6/MvQsGeboO46FDJ6/Wqb
+u/l1nKXDq6Jk8CtcJMzf0WpCjMp8XgaWWXnYGCZesuOza4/fAgMBAAGjTzBNMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly93d3cu
+ZXhhbXBsZS5jb20vZXhhbXBsZV9jYS5jcmwwDQYJKoZIhvcNAQEFBQADgYEAHWV/
+MlstYF0X7sXhkvLPOHv3y5KiXAayvTSWaBWRjIWS9MyverecECsm2rZe5GYBjK2c
+j7wCmogS4i9HcGils/Hfa3+C0nZS/sAsLM0tJiyKUveSNc5QX1sm8L3vrLz9h/eH
+N9crVppaFLSXtN+0lch7dkmhS1v3EE3xtRaZ8Rk=
+-----END CERTIFICATE-----
+Bag Attributes
+    localKeyID: 42 D6 81 81 00 AD 68 D4 EF 8C 30 42 2E 38 B1 D1 73 E5 42 58 
+Key Attributes: <No Attributes>
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAnsqUWZw1TISTmQLsfKRgTLRgl4kBmg5FTcVpcd656Lh47r5J
+vDBPfiwASIztNrdIDn5nbqx/uiF4kf5kpzBunEHTH4n2HzN8H8Q0wIm6z3H5i0vS
+7+l73wtbBI5A+8+kCLXkq0AWpUe8kMgE/NjyBQonp8RswpqiPPjG/v/XZzyqmRXC
+UrOP/3dYPAZmAyT9q+Gjy6lt+eU3IQIjSV9hxSv9dazVLCedfCRGK0xtAb2oUSqd
+1wNTMMZSB05iXKrQVygwF+bAKouGSZeFuvzL0LBnm6DuOhQyev1qm7v5dZylw6ui
+ZPArXCTM39FqQozKfF4Glll52BgmXrLjs2uP3wIDAQABAoIBAHdEIPjNYxr92P5s
+O8PCkrIKKSKoPRPA9Dzdsb1dVLV/GRX4xtkaUBqsYeocL2+RagW422c9GRJsYWsG
+cANDVVD3/+MIdFwrB2e0rwqOaEm3iX8ejGi2LdvxY4OgdR6tbr88H2ygzmGF6BO2
+qEhhiiZO4koYNrhT/Nde49hTwS5AK742M5UjLDoytbhWr7/UiPA5dXZPVgLYp/C/
+y71S8n8DkZd0KA0EFAnirVVeQ8+bhBHd/7V0UVeQgOcwt2bvTX/lM9vB+mfRNgpK
+de8XLFVzoFwIB2Zmun25XHCnh2m9u+UjYnOsScpqGW9lrMJU0CF47FHHws2heS1j
+ZWWCk0ECgYEAz/FAnb9FiC0NVPPh3/jisoLUCtQr+YmL/7woWBh9XTX0u89L9egS
+uCsCYKRQU68Av/gZH0OGe7nUOnS9XS3ox21YuWi56A1Dt0fE3sY/fakHscB+DI4y
+RpWe3Sq7fNw2dD6+zVwkyxzijx72rTFsuE5fbi4Wu+GfVxqWcpF6k9UCgYEAw31X
+0S5ATHwrxWXzeFFh6PI0TYlrAEOrv2VPTnjTdO0hSRTlGQIyw2CTJsPLKhnzGcoE
+YWR+bc65YYyRHFvdg1z2AzkxTjlDKPDDDIHsN/8ioGOkgdHrfHPj+IYomCK2gTiK
+b9ACWa4eJie1WuCa1jFxOwesME8R4h6PF8I/kuMCgYEAlGs03KMeBPFrF5yvNsaV
+QCbDJCuGa6iyRUlOXnq0WChf0wFFzXHkkpEYNFRzhRde6KYzgC4ZOgxMH6EdW/md
+sWIptsS6FJgLIjFWok9MF+viswuarGl+FwVKC8ApbBhdwaDbXQaMuHCYgODv3nRt
+jitaT/EThuymZ2xxv7p4jDUCgYAcBK3+dCOREsbvPuJ7XyaqTXSDnGtymUBXaTzJ
+oXWlL4tyvwTq5a7C4+eTScKnoRp/mr2v+8hHErbtLUlrCBuihUNZSOwxKvHeP0ul
+UkW57N5YoI9mb+DRcIa/CvNsgqUntiPZTLXZhqQZkd1jTgfDJUj2Te426k5E215k
+6FlWQwKBgHzyo9wJlVVa7H6rMrbC4DciHzlHd1b5Ua+KMhUcQevkI28yr/S4P0kQ
+xzv3TqyiH1Zs9YT3+cXbx4fQbJMCIT1M0m2a5wqctS4fx+dvCldMtZBvTlvg5dK4
++xq1HPyYnldr4Q/XBIL12dCVH2EC5p3lXiUhOzyTVNvh1CM0SPIV
+-----END RSA PRIVATE KEY-----
\ No newline at end of file
diff --git a/src/test/setup/radius-config/freeradius/certs_3/user@ciena.com.pem b/src/test/setup/radius-config/freeradius/certs_3/user@ciena.com.pem
new file mode 100644
index 0000000..87c934b
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/user@ciena.com.pem
@@ -0,0 +1,41 @@
+Bag Attributes
+    localKeyID: F6 7E 1B 99 53 80 BE 9D A3 BA 7A E8 F5 36 5C DB 4B F8 F1 AD 
+subject=/C=US/ST=CA/O=Ciena Inc./CN=user@ciena.com/emailAddress=user@ciena.com
+issuer=/C=US/ST=CA/L=Somewhere/O=Ciena Inc./emailAddress=admin@ciena.com/CN=Example Certificate Authority
+-----BEGIN CERTIFICATE-----
+MIICuDCCAiGgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
+IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
+RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwNjA2MjExMjI3WhcN
+MTcwNjAxMjExMjI3WjBnMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
+BAoTCkNpZW5hIEluYy4xFzAVBgNVBAMUDnVzZXJAY2llbmEuY29tMR0wGwYJKoZI
+hvcNAQkBFg51c2VyQGNpZW5hLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
+gYEAwvXiSzb9LZ6c7uNziUfKvoHO7wu/uiFC5YUpXbmVGuGZizbVrny0xnR85Dfe
++9R4diansfDhIhzOUl1XjN3YDeSS9OeF5YWNNE8XDhlz2d3rVzaN6hIhdotBkUjg
+rUewjTg5OFR31QEyG3v8xR3CLgiE9xQELjZbSA07pD79zuUCAwEAAaNPME0wEwYD
+VR0lBAwwCgYIKwYBBQUHAwIwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5l
+eGFtcGxlLmNvbS9leGFtcGxlX2NhLmNybDANBgkqhkiG9w0BAQUFAAOBgQDAjkrY
+6tDChmKbvr8w6Du/t8vHjTCoCIocHTN0qzWOeb1YsAGX89+TrWIuO1dFyYd+Z0KC
+PDKB5j/ygml9Na+AklSYAVJIjvlzXKZrOaPmhZqDufi+rXWti/utVqY4VMW2+HKC
+nXp37qWeuFLGyR1519Y1d6F/5XzqmvbwURuEug==
+-----END CERTIFICATE-----
+Bag Attributes
+    localKeyID: F6 7E 1B 99 53 80 BE 9D A3 BA 7A E8 F5 36 5C DB 4B F8 F1 AD 
+Key Attributes: <No Attributes>
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIi6kHFx9NOKQCAggA
+MBQGCCqGSIb3DQMHBAhfAxfmWmuO8ASCAoDmot3MgUJcnLSE5Xmj1AWjCEnNgo1p
+/QgG5Pc1HfWvBTMlE4gqYkJuJlGm5IymJcb8ICZP+v8NLq5QNqquZZFohVh27Ow6
+1kVftnK7Jb9WQwlzSMqNkseCG33w8546KVsZtR3MEBo3eLu3WvNOFOJXnHvx3Llq
+4J4jrADcj6Ux3774IAowFadt4h6L3vx4UrjDUScwN+v5Oxr8p7nvajvC6JjIzkdL
+wm30RYSPoj7F/tO4773A11gOxFsPji4CcmTVFVIG/PcoQMOu36IO3JTDjBLVD39Z
+xtGMFFC3tbSdzPf4QOmpx45bk3l9HLqHFJgfuS2kLXx7zvSvhe5kaAzcgI6/fmps
+EyHVaa5Q/M986/q5BAJUGqE8L3bnYm5KASzvL45+bj+juyA5olKVlVs3n6gbjcd5
+kXonq1cBVNWEL/+mj2hfmzY4JVdzE14dihV5cu298KWn/8AfoTUQCZOg+ZpIXXCe
+6v1wyS9AvFH+RQ9zbPNdrB8zrDubqb8jajr/uE+PgG5ocFfRCaqlutrFg7Yoa/+x
+wtyl24y1F11kKhukLJqaCQZ3EYcSa2SIbor/hUn4zp6CwoE4UM0pjsddRB5e3sdf
+QhmBSKOUKmDjB1FVF8sTzp+dNhDX+ukL8PB7NlnAzPs2afQ8mHwWvXKjwoKPi2/f
+tRYeA8WpytF2GJnY+hS1mjunsDApmVMthJ9omT5NkqA2MAYLTzPrHaEJgnscH3Vj
+tOg315IS6vAflbg4lyuIs8xgNYfVJTbGL905Od3hhRmOZyK8D62E9cJL5mNh/n9J
+lNsYYp2mltrSCezDQ9nseeuJ6laa080vFE514TTGNw8jtyamj84/9XGz
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/src/test/setup/radius-config/freeradius/certs_3/xpextensions b/src/test/setup/radius-config/freeradius/certs_3/xpextensions
new file mode 100644
index 0000000..8e4a9a2
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_3/xpextensions
@@ -0,0 +1,24 @@
+#
+#  File containing the OIDs required for Windows.
+#
+#  http://support.microsoft.com/kb/814394/en-us
+#
+[ xpclient_ext]
+extendedKeyUsage = 1.3.6.1.5.5.7.3.2
+crlDistributionPoints = URI:http://www.example.com/example_ca.crl
+
+[ xpserver_ext]
+extendedKeyUsage = 1.3.6.1.5.5.7.3.1
+crlDistributionPoints = URI:http://www.example.com/example_ca.crl
+
+#
+#  Add this to the PKCS#7 keybag attributes holding the client's private key
+#  for machine authentication.
+#
+#  the presence of this OID tells Windows XP that the cert is intended
+#  for use by the computer itself, and not by an end-user.
+#
+#  The other solution is to use Microsoft's web certificate server
+#  to generate these certs.
+#
+# 1.3.6.1.4.1.311.17.2
diff --git a/src/test/setup/radius-config/freeradius/radiusd.conf b/src/test/setup/radius-config/freeradius/radiusd.conf
index 327b10b..2995b6b 100644
--- a/src/test/setup/radius-config/freeradius/radiusd.conf
+++ b/src/test/setup/radius-config/freeradius/radiusd.conf
@@ -66,8 +66,8 @@
 #  Location of config and logfiles.
 confdir = ${raddbdir}
 modconfdir = ${confdir}/mods-config
-certdir = ${confdir}/certs_2
-cadir   = ${confdir}/certs_2
+certdir = ${confdir}/certs_3
+cadir   = ${confdir}/certs_3
 run_dir = ${localstatedir}/run/${name}
 
 # Should likely be ${localstatedir}/lib/radiusd
diff --git a/src/test/setup/radius-config/freeradius/start-radius.py b/src/test/setup/radius-config/freeradius/start-radius.py
index 5de9f7e..fb771d9 100755
--- a/src/test/setup/radius-config/freeradius/start-radius.py
+++ b/src/test/setup/radius-config/freeradius/start-radius.py
@@ -14,10 +14,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-import pexpect
-import time
-child = pexpect.spawn('sh -c radius')
-child.expect('Enter PEM pass phrase:')
-child.sendline('whatever')
-while True:
-    time.sleep(3600)
+import os
+import sys
+sys.exit(os.system('sh -c radius'))
diff --git a/src/test/utils/EapTLS.py b/src/test/utils/EapTLS.py
index 8a3e1c7..b5aad78 100644
--- a/src/test/utils/EapTLS.py
+++ b/src/test/utils/EapTLS.py
@@ -19,8 +19,9 @@
 import noseTlsAuthHolder as tlsAuthHolder
 from scapy_ssl_tls.ssl_tls import *
 from scapy_ssl_tls.ssl_tls_crypto import *
+from tls_cert import Key
 from socket import *
-from struct import *
+import struct
 import scapy
 from nose.tools import *
 from CordTestBase import CordTester
@@ -56,7 +57,8 @@
     server_hello_done_signature = '\x0e\x00\x00\x00'
     SERVER_HELLO = '\x02'
     SERVER_CERTIFICATE = '\x0b'
-    SERVER_HELLO_DONE = '\x0d'
+    CERTIFICATE_REQUEST = '\x0d'
+    SERVER_HELLO_DONE = '\x0e'
     SERVER_UNKNOWN = '\xff'
     HANDSHAKE = '\x16'
     CHANGE_CIPHER = '\x14'
@@ -64,30 +66,41 @@
     HDR_IDX = 0
     DATA_IDX = 1
     CB_IDX = 2
+
     CLIENT_CERT = """-----BEGIN CERTIFICATE-----
-MIIDvTCCAqWgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
+MIICuDCCAiGgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
 CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
 IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
-RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwMzExMTg1MzM2WhcN
-MTcwMzA2MTg1MzM2WjBnMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
+RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwNjA2MjExMjI3WhcN
+MTcwNjAxMjExMjI3WjBnMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
 BAoTCkNpZW5hIEluYy4xFzAVBgNVBAMUDnVzZXJAY2llbmEuY29tMR0wGwYJKoZI
-hvcNAQkBFg51c2VyQGNpZW5hLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
-AQoCggEBAOxemcBsPn9tZsCa5o2JA6sQDC7A6JgCNXXl2VFzKLNNvB9PS6D7ZBsQ
-5An0zEDMNzi51q7lnrYg1XyiE4S8FzMGAFr94RlGMQJUbRD9V/oqszMX4k++iAOK
-tIA1gr3x7Zi+0tkjVSVzXTmgNnhChAamdMsjYUG5+CY9WAicXyy+VEV3zTphZZDR
-OjcjEp4m/TSXVPYPgYDXI40YZKX5BdvqykWtT/tIgZb48RS1NPyN/XkCYzl3bv21
-qx7Mc0fcEbsJBIIRYTUkfxnsilcnmLxSYO+p+DZ9uBLBzcQt+4Rd5pLSfi21WM39
-2Z2oOi3vs/OYAPAqgmi2JWOv3mePa/8CAwEAAaNPME0wEwYDVR0lBAwwCgYIKwYB
-BQUHAwIwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5leGFtcGxlLmNvbS9l
-eGFtcGxlX2NhLmNybDANBgkqhkiG9w0BAQUFAAOCAQEALBzMPDTIB6sLyPl0T6JV
-MjOkyldAVhXWiQsTjaGQGJUUe1cmUJyZbUZEc13MygXMPOM4x7z6VpXGuq1c/Vxn
-VzQ2fNnbJcIAHi/7G8W5/SQfPesIVDsHTEc4ZspPi5jlS/MVX3HOC+BDbOjdbwqP
-RX0JEr+uOyhjO+lRxG8ilMRACoBUbw1eDuVDoEBgErSUC44pq5ioDw2xelc+Y6hQ
-dmtYwfY0DbvwxHtA495frLyPcastDiT/zre7NL51MyUDPjjYjghNQEwvu66IKbQ3
-T1tJBrgI7/WI+dqhKBFolKGKTDWIHsZXQvZ1snGu/FRYzg1l+R/jT8cRB9BDwhUt
-yg==
+hvcNAQkBFg51c2VyQGNpZW5hLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
+gYEAwvXiSzb9LZ6c7uNziUfKvoHO7wu/uiFC5YUpXbmVGuGZizbVrny0xnR85Dfe
++9R4diansfDhIhzOUl1XjN3YDeSS9OeF5YWNNE8XDhlz2d3rVzaN6hIhdotBkUjg
+rUewjTg5OFR31QEyG3v8xR3CLgiE9xQELjZbSA07pD79zuUCAwEAAaNPME0wEwYD
+VR0lBAwwCgYIKwYBBQUHAwIwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5l
+eGFtcGxlLmNvbS9leGFtcGxlX2NhLmNybDANBgkqhkiG9w0BAQUFAAOBgQDAjkrY
+6tDChmKbvr8w6Du/t8vHjTCoCIocHTN0qzWOeb1YsAGX89+TrWIuO1dFyYd+Z0KC
+PDKB5j/ygml9Na+AklSYAVJIjvlzXKZrOaPmhZqDufi+rXWti/utVqY4VMW2+HKC
+nXp37qWeuFLGyR1519Y1d6F/5XzqmvbwURuEug==
 -----END CERTIFICATE-----"""
 
+    CLIENT_PRIV_KEY = """-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDC9eJLNv0tnpzu43OJR8q+gc7vC7+6IULlhSlduZUa4ZmLNtWu
+fLTGdHzkN9771Hh2Jqex8OEiHM5SXVeM3dgN5JL054XlhY00TxcOGXPZ3etXNo3q
+EiF2i0GRSOCtR7CNODk4VHfVATIbe/zFHcIuCIT3FAQuNltIDTukPv3O5QIDAQAB
+AoGBAJha7NgYhevzqvIov25Fs1QDP0Kh7Ne5DH0u/e+nirUyHfqkBILSI7d+6uay
+Hsiv9t9mP+CXvGgbGMVW+oc0CpUbZw4Y64jZhg/vakMuHVhpgUCyPyzjk+7Z7STg
+2B1DEAxILApU8azjrDBIRHM8q0CH6NFwJPpFjg2oi7li6hPhAkEA56e/UT7Mh+57
+qWb2q9CuI+unQcav1tqxRxUtrGHl0YSO5YTWCnaT7vVFUSbemwUhEHJs8h+Qw41L
+g4eBu/qXLQJBANdy7puiDBBvV8XxQms14VRAEUUpCwqmzieG3RNmgr7wYRKyXzws
+hbgp5HIkGFIM4FOIrFj5jUP6CuF2BfoYaZkCQGRIny75w6s413nfY/u/TBOqyW5V
+J/wYElSWW35bpxTLkNzVY5+F88ankUlvTUDIuKaZEobCmXW+bilTeRs6gUUCQGeo
+2Lzw3rUZnTWTus0yg1Ox751C/hkF4LKL5NpsvAN6THpecAvXsA7HuS5hx4HSyCvo
+2mOEzj8ikxGfY4jNLiECQE09wQ39Gw3oGKCzdsTcWy8PXIWjOS44+7N/GjUB52+o
+CK7BGBOdZGZUSFc1rVA7eWKzxFDZ+EK264z6DL95mRw=
+-----END RSA PRIVATE KEY-----"""
+
     def handle_server_hello_done(self, server_hello_done):
         if server_hello_done[-4:] == self.server_hello_done_signature:
             self.server_hello_done_received = True
@@ -109,13 +122,20 @@
         self.pkt_history = []
         self.pkt_map = { self.SERVER_HELLO: ['', '', lambda pkt: pkt ],
                          self.SERVER_CERTIFICATE: ['', '', lambda pkt: pkt ],
+                         self.CERTIFICATE_REQUEST: ['', '', lambda pkt: pkt ],
                          self.SERVER_HELLO_DONE: ['', '', self.handle_server_hello_done ],
                          self.SERVER_UNKNOWN: ['', '', lambda pkt: pkt ]
                        }
         self.tls_ctx = TLSSessionCtx(client = True)
 
     def load_tls_record(self, data, pkt_type = ''):
-        if pkt_type not in [ self.SERVER_HELLO_DONE, self.SERVER_UNKNOWN ]:
+        #if pkt_type not in [ self.SERVER_HELLO_DONE, self.SERVER_UNKNOWN ]:
+        if pkt_type == self.SERVER_HELLO_DONE:
+            data = str(TLSRecord(content_type=TLSContentType.HANDSHAKE)/data)
+        elif pkt_type == self.CERTIFICATE_REQUEST:
+            data = str(TLSRecord()/TLSHandshake(type=TLSHandshakeType.CERTIFICATE_REQUEST)/data[9:])
+            data = None #For now ignore this record
+        if data:
             TLS(data, ctx = self.tls_ctx)
 
     def pkt_update(self, pkt_type, data, hdr=None, reassembled = False):
@@ -139,6 +159,7 @@
         r = str(pkt)
         offset = self.TLS_OFFSET
         tls_data = r[offset:]
+        type_hdrlen = 0
         if self.pending_bytes > 0:
             if len(tls_data) >= self.pending_bytes:
                 self.pkt_update(self.pkt_last, tls_data[:self.pending_bytes], reassembled = True)
@@ -154,9 +175,13 @@
             self.pending_bytes = bytes_to_num(tls_data[3:5])
             if tls_data[0] == self.HANDSHAKE:
                 pkt_type = tls_data[5]
-                if len(tls_data) - 5 >= self.pending_bytes:
-                    data_received = tls_data[5: 5 + self.pending_bytes]
-                    offset += 5 + self.pending_bytes
+                if pkt_type in [ self.CERTIFICATE_REQUEST ]:
+                    self.pending_bytes = bytes_to_num(tls_data[6:9])
+                    type_hdrlen = 4
+                if len(tls_data) - 5 - type_hdrlen >= self.pending_bytes:
+                    data_received = tls_data[5: 5 + type_hdrlen + self.pending_bytes ]
+                    offset += 5 + type_hdrlen + self.pending_bytes
+                    type_hdrlen = 0
                     self.pending_bytes = 0
                     self.pkt_update(pkt_type, data_received,
                                     hdr = tls_data[:5],
@@ -165,10 +190,13 @@
                     self.pkt_update(pkt_type, tls_data[5:],
                                     hdr = tls_data[:5],
                                     reassembled = False)
-                    self.pending_bytes -= len(tls_data) - 5
+                    self.pending_bytes -= len(tls_data) - 5 - type_hdrlen
                     self.pkt_last = pkt_type
                     log.info('Pending bytes left %d' %(self.pending_bytes))
                     assert self.pending_bytes > 0
+            elif tls_data[0] == self.SERVER_HELLO_DONE:
+                self.pkt_update(tls_data[0], tls_data, reassembled = True)
+                break
             else:
                 self.pkt_last = self.SERVER_UNKNOWN
                 if len(tls_data) - 5 >= self.pending_bytes:
@@ -210,11 +238,12 @@
                                                    gmt_unix_time=1234,
                                                    random_bytes= '\xAB' * 28,
                                                    session_id='',
-                                                   compression_methods=(TLSCompressionMethod.NULL),
+                                                   compression_methods=[TLSCompressionMethod.NULL],
                                                    cipher_suites=[TLSCipherSuite.RSA_WITH_AES_256_CBC_SHA]
                                                    )
-                self.pkt_history.append( str(self.client_hello) )
-                reqdata = TLSRecord()/TLSHandshake()/self.client_hello
+                client_hello_data = TLSHandshake()/self.client_hello
+                self.pkt_history.append( str(client_hello_data) )
+                reqdata = TLSRecord()/client_hello_data
                 self.load_tls_record(str(reqdata))
                 log.info("Sending Client Hello TLS payload of len %d, id %d" %(len(reqdata),pkt[EAP].id))
                 eap_payload = self.eapTLS(EAP_RESPONSE, pkt[EAP].id, TLS_LENGTH_INCLUDED, str(reqdata))
@@ -231,15 +260,31 @@
         ##send cert request when we receive the last server hello fragment
         self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_CERT_REQ
 
-    def get_encrypted_handshake_msg(self, finish_val=''):
+    def get_verify_data(self):
         all_handshake_pkts = ''.join(self.pkt_history)
+        return self.tls_ctx.get_verify_data(data = all_handshake_pkts)
+
+    def get_verify_signature(self, pem_data):
+        all_handshake_pkts = ''.join(self.pkt_history)
+        k = Key(pem_data)
+        signature = k.sign(all_handshake_pkts, t = 'pkcs', h = 'tls')
+        signature_data = '{}{}'.format(struct.pack('!H', len(signature)), signature)
+        return signature_data
+
+    def get_encrypted_handshake_msg(self, finish_val=''):
         if not finish_val:
-            finish_val = self.tls_ctx.get_verify_data(data = all_handshake_pkts)
+            finish_val = self.get_verify_data()
         msg = str(TLSHandshake(type=TLSHandshakeType.FINISHED)/finish_val)
         crypto_container = CryptoContainer(self.tls_ctx, data = msg,
                                            content_type = TLSContentType.HANDSHAKE)
         return crypto_container.encrypt()
 
+    def get_encrypted_application_msg(self, msg = ''):
+        '''Needed with tunneled TLS'''
+        if not msg:
+            msg = 'test data'
+        return to_raw(TLSPlaintext(data = 'GET / HTTP/1.1\r\nHOST: localhost\r\n\r\n'), self.tls_ctx)
+
     def _eapTlsCertReq(self):
 
         def eapol_cb(pkt):
@@ -249,21 +294,28 @@
                 assert self.server_hello_done_received == True
                 rex_pem = re.compile(r'\-+BEGIN[^\-]+\-+(.*?)\-+END[^\-]+\-+', re.DOTALL)
                 der_cert = rex_pem.findall(self.CLIENT_CERT)[0].decode("base64")
-                client_certificate = TLSRecord(version="TLS_1_0")/TLSHandshake()/TLSCertificateList(
+                client_certificate_list = TLSHandshake()/TLSCertificateList(
                     certificates=[TLSCertificate(data=x509.X509Cert(der_cert))])
+                client_certificate = TLSRecord(version="TLS_1_0")/client_certificate_list
                 kex_data = self.tls_ctx.get_client_kex_data()
-                client_key_ex = TLSRecord()/TLSHandshake()/kex_data
-                client_key_ex_data = str(TLSHandshake()/kex_data)
-                self.pkt_history.append(client_key_ex_data)
+                client_key_ex_data = TLSHandshake()/kex_data
+                client_key_ex = TLSRecord()/client_key_ex_data
+                self.load_tls_record(str(client_certificate))
                 self.load_tls_record(str(client_key_ex))
+                self.pkt_history.append(str(client_certificate_list))
+                self.pkt_history.append(str(client_key_ex_data))
+                verify_signature = self.get_verify_signature(self.CLIENT_PRIV_KEY)
+                client_cert_verify = TLSHandshake(type=TLSHandshakeType.CERTIFICATE_VERIFY)/verify_signature
+                client_cert_record = TLSRecord(content_type=TLSContentType.HANDSHAKE)/client_cert_verify
+                self.pkt_history.append(str(client_cert_verify))
                 #log.info('TLS ctxt: %s' %self.tls_ctx)
                 client_ccs = TLSRecord(version="TLS_1_0")/TLSChangeCipherSpec()
                 enc_handshake_msg = self.get_encrypted_handshake_msg()
                 handshake_msg = str(TLSRecord(content_type=TLSContentType.HANDSHAKE)/enc_handshake_msg)
-                reqdata = str(TLS.from_records( [client_certificate, client_key_ex, client_ccs] ))
+                reqdata = str(TLS.from_records([client_certificate, client_key_ex, client_cert_record, client_ccs]))
                 reqdata += handshake_msg
                 log.info("------> Sending Client Hello TLS Certificate payload of len %d ----------->" %len(reqdata))
-                eap_payload = self.eapTLS(EAP_RESPONSE, pkt[EAP].id, TLS_LENGTH_INCLUDED, str(reqdata))
+                eap_payload = self.eapTLS(EAP_RESPONSE, pkt[EAP].id, TLS_LENGTH_INCLUDED, reqdata)
                 self.eapol_send(EAPOL_EAPPACKET, eap_payload)
 
         self.eapol_scapy_recv(cb = eapol_cb,
@@ -274,9 +326,12 @@
     def _eapTlsChangeCipherSpec(self):
         def eapol_cb(pkt):
             r = str(pkt)
-            tls_data = r[TLS_OFFSET:]
+            tls_data = r[self.TLS_OFFSET:]
             log.info('Verifying TLS Change Cipher spec record type %x' %ord(tls_data[0]))
             assert tls_data[0] == self.CHANGE_CIPHER
+            log.info('Handshake finished. Sending empty data')
+            eap_payload = self.eapTLS(EAP_RESPONSE, pkt[EAP].id, 0, '')
+            self.eapol_send(EAPOL_EAPPACKET, eap_payload)
 
         self.eapol_scapy_recv(cb = eapol_cb,
                               lfilter =
@@ -286,10 +341,10 @@
     def _eapTlsFinished(self):
 
         def eapol_cb(pkt):
-                log.info('Got Server finished')
+            log.info('Server authentication successfull')
 
         self.eapol_scapy_recv(cb = eapol_cb,
                               lfilter =
-                              lambda pkt: EAP in pkt and pkt[EAP].type == EAP_TYPE_TLS and pkt[EAP].code == EAP.REQUEST)
-        #We stop here as certification validation success implies auth success
+                              lambda pkt: EAP in pkt and pkt[EAP].code == EAP.SUCCESS)
+        self.eapol_logoff()
         self.nextEvent = None
diff --git a/src/test/utils/EapolAAA.py b/src/test/utils/EapolAAA.py
index 419c7e3..a897833 100644
--- a/src/test/utils/EapolAAA.py
+++ b/src/test/utils/EapolAAA.py
@@ -102,6 +102,10 @@
         eap_payload = self.eap(EAPOL_START, 2)
         return self.eapol_send(EAPOL_START, eap_payload)
 
+    def eapol_logoff(self):
+        eap_payload = self.eap(EAPOL_LOGOFF, 2)
+        return self.eapol_send(EAPOL_LOGOFF, eap_payload)
+
     def eapol_id_req(self, pkt_id = 0, user = USER):
         eap_payload = self.eap(EAP_RESPONSE, pkt_id, EAP_TYPE_ID, user)
         return self.eapol_send(EAPOL_EAPPACKET, eap_payload)
diff --git a/src/test/utils/tls_cert.py b/src/test/utils/tls_cert.py
new file mode 100644
index 0000000..68726e0
--- /dev/null
+++ b/src/test/utils/tls_cert.py
@@ -0,0 +1,1060 @@
+## This file is part of Scapy
+## See http://www.secdev.org/projects/scapy for more informations
+## Copyright (C) Arnaud Ebalard <arno@natisbad.org>
+## This program is published under a GPLv2 license
+
+"""
+Cryptographic certificates.
+"""
+
+import os, sys, math, struct, random
+from scapy.utils import strxor
+from scapy_ssl_tls.ssl_tls_crypto import x509_extract_pubkey_from_der
+try:
+    HAS_HASHLIB=True
+    import hashlib
+except:
+    HAS_HASHLIB=False
+
+from Crypto.PublicKey import *
+from Crypto.Cipher import *
+from Crypto.Hash import *
+from Crypto.Util import number
+
+# Maximum allowed size in bytes for a certificate file, to avoid
+# loading huge file when importing a cert
+MAX_KEY_SIZE=50*1024
+
+#####################################################################
+# Some helpers
+#####################################################################
+
+def warning(m):
+    print "WARNING: %s" % m
+
+def randstring(l):
+    """
+    Returns a random string of length l (l >= 0)
+    """
+    tmp = map(lambda x: struct.pack("B", random.randrange(0, 256, 1)), [""]*l)
+    return "".join(tmp)
+
+def zerofree_randstring(l):
+    """
+    Returns a random string of length l (l >= 0) without zero in it.
+    """
+    tmp = map(lambda x: struct.pack("B", random.randrange(1, 256, 1)), [""]*l)
+    return "".join(tmp)
+
+def strand(s1, s2):
+    """
+    Returns the binary AND of the 2 provided strings s1 and s2. s1 and s2
+    must be of same length.
+    """
+    return "".join(map(lambda x,y:chr(ord(x)&ord(y)), s1, s2))
+
+# OS2IP function defined in RFC 3447 for octet string to integer conversion
+def pkcs_os2ip(x):
+    """
+    Accepts a byte string as input parameter and return the associated long
+    value:
+
+    Input : x        octet string to be converted
+
+    Output: x        corresponding nonnegative integer
+
+    Reverse function is pkcs_i2osp()
+    """
+    return number.bytes_to_long(x) 
+
+# IP2OS function defined in RFC 3447 for octet string to integer conversion
+def pkcs_i2osp(x,xLen):
+    """
+    Converts a long (the first parameter) to the associated byte string
+    representation of length l (second parameter). Basically, the length
+    parameters allow the function to perform the associated padding.
+
+    Input : x        nonnegative integer to be converted
+            xLen     intended length of the resulting octet string
+
+    Output: x        corresponding nonnegative integer
+
+    Reverse function is pkcs_os2ip().
+    """
+    z = number.long_to_bytes(x)
+    padlen = max(0, xLen-len(z))
+    return '\x00'*padlen + z
+
+# for every hash function a tuple is provided, giving access to
+# - hash output length in byte
+# - associated hash function that take data to be hashed as parameter
+#   XXX I do not provide update() at the moment.
+# - DER encoding of the leading bits of digestInfo (the hash value
+#   will be concatenated to create the complete digestInfo).
+#
+# Notes:
+# - MD4 asn.1 value should be verified. Also, as stated in
+#   PKCS#1 v2.1, MD4 should not be used.
+# - hashlib is available from http://code.krypto.org/python/hashlib/
+# - 'tls' one is the concatenation of both md5 and sha1 hashes used
+#   by SSL/TLS when signing/verifying things
+_hashFuncParams = {
+    "md2"    : (16, 
+                lambda x: MD2.new(x).digest(),
+                '\x30\x20\x30\x0c\x06\x08\x2a\x86\x48\x86\xf7\x0d\x02\x02\x05\x00\x04\x10'),
+    "md4"    : (16,
+                lambda x: MD4.new(x).digest(), 
+                '\x30\x20\x30\x0c\x06\x08\x2a\x86\x48\x86\xf7\x0d\x02\x04\x05\x00\x04\x10'), # is that right ?
+    "md5"    : (16, 
+                lambda x: MD5.new(x).digest(), 
+                '\x30\x20\x30\x0c\x06\x08\x2a\x86\x48\x86\xf7\x0d\x02\x05\x05\x00\x04\x10'),
+    "sha1"   : (20,
+                lambda x: SHA.new(x).digest(), 
+                '\x30\x21\x30\x09\x06\x05\x2b\x0e\x03\x02\x1a\x05\x00\x04\x14'),
+    "tls"    : (36,
+                lambda x: MD5.new(x).digest() + SHA.new(x).digest(),
+                '') }
+
+if HAS_HASHLIB:
+    _hashFuncParams["sha224"] = (28,
+                lambda x: hashlib.sha224(x).digest(),
+                '\x30\x2d\x30\x0d\x06\x09\x60\x86\x48\x01\x65\x03\x04\x02\x04\x05\x00\x04\x1c')
+    _hashFuncParams["sha256"] = (32,
+                lambda x: hashlib.sha256(x).digest(),
+                '\x30\x31\x30\x0d\x06\x09\x60\x86\x48\x01\x65\x03\x04\x02\x01\x05\x00\x04\x20')
+    _hashFuncParams["sha384"] = (48,
+                lambda x: hashlib.sha384(x).digest(),
+               '\x30\x41\x30\x0d\x06\x09\x60\x86\x48\x01\x65\x03\x04\x02\x02\x05\x00\x04\x30')
+    _hashFuncParams["sha512"] = (64,
+               lambda x: hashlib.sha512(x).digest(),
+               '\x30\x51\x30\x0d\x06\x09\x60\x86\x48\x01\x65\x03\x04\x02\x03\x05\x00\x04\x40')
+else:
+    warning("hashlib support is not available. Consider installing it")
+    warning("if you need sha224, sha256, sha384 and sha512 algs.")
+
+def pkcs_mgf1(mgfSeed, maskLen, h):
+    """
+    Implements generic MGF1 Mask Generation function as described in
+    Appendix B.2.1 of RFC 3447. The hash function is passed by name.
+    valid values are 'md2', 'md4', 'md5', 'sha1', 'tls, 'sha256',
+    'sha384' and 'sha512'. Returns None on error.
+
+    Input:
+       mgfSeed: seed from which mask is generated, an octet string
+       maskLen: intended length in octets of the mask, at most 2^32 * hLen
+                hLen (see below)
+       h      : hash function name (in 'md2', 'md4', 'md5', 'sha1', 'tls',
+                'sha256', 'sha384'). hLen denotes the length in octets of
+                the hash function output.
+
+    Output:
+       an octet string of length maskLen
+    """
+
+    # steps are those of Appendix B.2.1
+    if not _hashFuncParams.has_key(h):
+        warning("pkcs_mgf1: invalid hash (%s) provided")
+        return None
+    hLen = _hashFuncParams[h][0]
+    hFunc = _hashFuncParams[h][1]
+    if maskLen > 2**32 * hLen:                               # 1)
+        warning("pkcs_mgf1: maskLen > 2**32 * hLen")
+        return None
+    T = ""                                                   # 2)
+    maxCounter = math.ceil(float(maskLen) / float(hLen))     # 3)
+    counter = 0
+    while counter < maxCounter:
+        C = pkcs_i2osp(counter, 4)
+        T += hFunc(mgfSeed + C)
+        counter += 1
+    return T[:maskLen]
+
+
+def pkcs_emsa_pss_encode(M, emBits, h, mgf, sLen):
+    """
+    Implements EMSA-PSS-ENCODE() function described in Sect. 9.1.1 of RFC 3447
+
+    Input:
+       M     : message to be encoded, an octet string
+       emBits: maximal bit length of the integer resulting of pkcs_os2ip(EM),
+               where EM is the encoded message, output of the function.
+       h     : hash function name (in 'md2', 'md4', 'md5', 'sha1', 'tls',
+               'sha256', 'sha384'). hLen denotes the length in octets of
+               the hash function output.
+       mgf   : the mask generation function f : seed, maskLen -> mask
+       sLen  : intended length in octets of the salt
+
+    Output:
+       encoded message, an octet string of length emLen = ceil(emBits/8)
+
+    On error, None is returned.
+    """
+
+    # 1) is not done
+    hLen = _hashFuncParams[h][0]                             # 2)
+    hFunc = _hashFuncParams[h][1]
+    mHash = hFunc(M)
+    emLen = int(math.ceil(emBits/8.))
+    if emLen < hLen + sLen + 2:                              # 3)
+        warning("encoding error (emLen < hLen + sLen + 2)")
+        return None
+    salt = randstring(sLen)                                  # 4)
+    MPrime = '\x00'*8 + mHash + salt                         # 5)
+    H = hFunc(MPrime)                                        # 6)
+    PS = '\x00'*(emLen - sLen - hLen - 2)                    # 7)
+    DB = PS + '\x01' + salt                                  # 8)
+    dbMask = mgf(H, emLen - hLen - 1)                        # 9)
+    maskedDB = strxor(DB, dbMask)                            # 10)
+    l = (8*emLen - emBits)/8                                 # 11)
+    rem = 8*emLen - emBits - 8*l # additionnal bits
+    andMask = l*'\x00'
+    if rem:
+        j = chr(reduce(lambda x,y: x+y, map(lambda x: 1<<x, range(8-rem))))
+        andMask += j
+        l += 1
+    maskedDB = strand(maskedDB[:l], andMask) + maskedDB[l:]
+    EM = maskedDB + H + '\xbc'                               # 12)
+    return EM                                                # 13)
+
+
+def pkcs_emsa_pss_verify(M, EM, emBits, h, mgf, sLen):
+    """
+    Implements EMSA-PSS-VERIFY() function described in Sect. 9.1.2 of RFC 3447
+
+    Input:
+       M     : message to be encoded, an octet string
+       EM    : encoded message, an octet string of length emLen = ceil(emBits/8)
+       emBits: maximal bit length of the integer resulting of pkcs_os2ip(EM)
+       h     : hash function name (in 'md2', 'md4', 'md5', 'sha1', 'tls',
+               'sha256', 'sha384'). hLen denotes the length in octets of
+               the hash function output.
+       mgf   : the mask generation function f : seed, maskLen -> mask
+       sLen  : intended length in octets of the salt
+
+    Output:
+       True if the verification is ok, False otherwise.
+    """
+
+    # 1) is not done
+    hLen = _hashFuncParams[h][0]                             # 2)
+    hFunc = _hashFuncParams[h][1]
+    mHash = hFunc(M)
+    emLen = int(math.ceil(emBits/8.))                        # 3)
+    if emLen < hLen + sLen + 2:
+        return False
+    if EM[-1] != '\xbc':                                     # 4)
+        return False
+    l = emLen - hLen - 1                                     # 5)
+    maskedDB = EM[:l]
+    H = EM[l:l+hLen]
+    l = (8*emLen - emBits)/8                                 # 6)
+    rem = 8*emLen - emBits - 8*l # additionnal bits
+    andMask = l*'\xff'
+    if rem:
+        val = reduce(lambda x,y: x+y, map(lambda x: 1<<x, range(8-rem)))
+        j = chr(~val & 0xff)
+        andMask += j
+        l += 1
+    if strand(maskedDB[:l], andMask) != '\x00'*l:
+        return False
+    dbMask = mgf(H, emLen - hLen - 1)                        # 7)
+    DB = strxor(maskedDB, dbMask)                            # 8)
+    l = (8*emLen - emBits)/8                                 # 9)
+    rem = 8*emLen - emBits - 8*l # additionnal bits
+    andMask = l*'\x00'
+    if rem:
+        j = chr(reduce(lambda x,y: x+y, map(lambda x: 1<<x, range(8-rem))))
+        andMask += j
+        l += 1
+    DB = strand(DB[:l], andMask) + DB[l:]
+    l = emLen - hLen - sLen - 1                              # 10)
+    if DB[:l] != '\x00'*(l-1) + '\x01':
+        return False
+    salt = DB[-sLen:]                                        # 11)
+    MPrime = '\x00'*8 + mHash + salt                         # 12)
+    HPrime = hFunc(MPrime)                                   # 13)
+    return H == HPrime                                       # 14)
+
+
+def pkcs_emsa_pkcs1_v1_5_encode(M, emLen, h): # section 9.2 of RFC 3447
+    """
+    Implements EMSA-PKCS1-V1_5-ENCODE() function described in Sect.
+    9.2 of RFC 3447.
+
+    Input:
+       M    : message to be encode, an octet string
+       emLen: intended length in octets of the encoded message, at least
+              tLen + 11, where tLen is the octet length of the DER encoding
+              T of a certain value computed during the encoding operation.
+       h    : hash function name (in 'md2', 'md4', 'md5', 'sha1', 'tls',
+              'sha256', 'sha384'). hLen denotes the length in octets of
+              the hash function output.
+
+    Output:
+       encoded message, an octet string of length emLen
+
+    On error, None is returned.
+    """
+    hLen = _hashFuncParams[h][0]                             # 1)
+    hFunc = _hashFuncParams[h][1]
+    H = hFunc(M)
+    hLeadingDigestInfo = _hashFuncParams[h][2]               # 2)
+    T = hLeadingDigestInfo + H
+    tLen = len(T)
+    if emLen < tLen + 11:                                    # 3)
+        warning("pkcs_emsa_pkcs1_v1_5_encode: intended encoded message length too short")
+        return None
+    PS = '\xff'*(emLen - tLen - 3)                           # 4)
+    EM = '\x00' + '\x01' + PS + '\x00' + T                   # 5)
+    return EM                                                # 6)
+
+
+#####################################################################
+# Public Key Cryptography related stuff
+#####################################################################
+
+class _EncryptAndVerify:
+    ### Below are encryption methods
+
+    def _rsaep(self, m):
+        """
+        Internal method providing raw RSA encryption, i.e. simple modular
+        exponentiation of the given message representative 'm', a long
+        between 0 and n-1.
+
+        This is the encryption primitive RSAEP described in PKCS#1 v2.1,
+        i.e. RFC 3447 Sect. 5.1.1.
+
+        Input:
+           m: message representative, a long between 0 and n-1, where
+              n is the key modulus.
+
+        Output:
+           ciphertext representative, a long between 0 and n-1
+
+        Not intended to be used directly. Please, see encrypt() method.
+        """
+
+        n = self.modulus
+        if type(m) is int:
+            m = long(m)
+        if type(m) is not long or m > n-1:
+            warning("Key._rsaep() expects a long between 0 and n-1")
+            return None
+
+        return self.key.encrypt(m, "")[0]
+
+
+    def _rsaes_pkcs1_v1_5_encrypt(self, M):
+        """
+        Implements RSAES-PKCS1-V1_5-ENCRYPT() function described in section
+        7.2.1 of RFC 3447.
+
+        Input:
+           M: message to be encrypted, an octet string of length mLen, where
+              mLen <= k - 11 (k denotes the length in octets of the key modulus)
+
+        Output:
+           ciphertext, an octet string of length k
+
+        On error, None is returned.
+        """
+
+        # 1) Length checking
+        mLen = len(M)
+        k = self.modulusLen / 8
+        if mLen > k - 11:
+            warning("Key._rsaes_pkcs1_v1_5_encrypt(): message too "
+                    "long (%d > %d - 11)" % (mLen, k))
+            return None
+
+        # 2) EME-PKCS1-v1_5 encoding
+        PS = zerofree_randstring(k - mLen - 3)      # 2.a)
+        EM = '\x00' + '\x02' + PS + '\x00' + M      # 2.b)
+
+        # 3) RSA encryption
+        m = pkcs_os2ip(EM)                          # 3.a)
+        c = self._rsaep(m)                          # 3.b)
+        C = pkcs_i2osp(c, k)                        # 3.c)
+
+        return C                                    # 4)
+
+
+    def _rsaes_oaep_encrypt(self, M, h=None, mgf=None, L=None):
+        """
+        Internal method providing RSAES-OAEP-ENCRYPT as defined in Sect.
+        7.1.1 of RFC 3447. Not intended to be used directly. Please, see
+        encrypt() method for type "OAEP".
+
+
+        Input:
+           M  : message to be encrypted, an octet string of length mLen
+                where mLen <= k - 2*hLen - 2 (k denotes the length in octets
+                of the RSA modulus and hLen the length in octets of the hash
+                function output)
+           h  : hash function name (in 'md2', 'md4', 'md5', 'sha1', 'tls',
+                'sha256', 'sha384'). hLen denotes the length in octets of
+                the hash function output. 'sha1' is used by default if not
+                provided.
+           mgf: the mask generation function f : seed, maskLen -> mask
+           L  : optional label to be associated with the message; the default
+                value for L, if not provided is the empty string
+
+        Output:
+           ciphertext, an octet string of length k
+
+        On error, None is returned.
+        """
+        # The steps below are the one described in Sect. 7.1.1 of RFC 3447.
+        # 1) Length Checking
+                                                    # 1.a) is not done
+        mLen = len(M)
+        if h is None:
+            h = "sha1"
+        if not _hashFuncParams.has_key(h):
+            warning("Key._rsaes_oaep_encrypt(): unknown hash function %s.", h)
+            return None
+        hLen = _hashFuncParams[h][0]
+        hFun = _hashFuncParams[h][1]
+        k = self.modulusLen / 8
+        if mLen > k - 2*hLen - 2:                   # 1.b)
+            warning("Key._rsaes_oaep_encrypt(): message too long.")
+            return None
+
+        # 2) EME-OAEP encoding
+        if L is None:                               # 2.a)
+            L = ""
+        lHash = hFun(L)
+        PS = '\x00'*(k - mLen - 2*hLen - 2)         # 2.b)
+        DB = lHash + PS + '\x01' + M                # 2.c)
+        seed = randstring(hLen)                     # 2.d)
+        if mgf is None:                             # 2.e)
+            mgf = lambda x,y: pkcs_mgf1(x,y,h)
+        dbMask = mgf(seed, k - hLen - 1)
+        maskedDB = strxor(DB, dbMask)               # 2.f)
+        seedMask = mgf(maskedDB, hLen)              # 2.g)
+        maskedSeed = strxor(seed, seedMask)         # 2.h)
+        EM = '\x00' + maskedSeed + maskedDB         # 2.i)
+
+        # 3) RSA Encryption
+        m = pkcs_os2ip(EM)                          # 3.a)
+        c = self._rsaep(m)                          # 3.b)
+        C = pkcs_i2osp(c, k)                        # 3.c)
+
+        return C                                    # 4)
+
+
+    def encrypt(self, m, t=None, h=None, mgf=None, L=None):
+        """
+        Encrypt message 'm' using 't' encryption scheme where 't' can be:
+
+        - None: the message 'm' is directly applied the RSAEP encryption
+                primitive, as described in PKCS#1 v2.1, i.e. RFC 3447
+                Sect 5.1.1. Simply put, the message undergo a modular
+                exponentiation using the public key. Additionnal method
+                parameters are just ignored.
+
+        - 'pkcs': the message 'm' is applied RSAES-PKCS1-V1_5-ENCRYPT encryption
+                scheme as described in section 7.2.1 of RFC 3447. In that
+                context, other parameters ('h', 'mgf', 'l') are not used.
+
+        - 'oaep': the message 'm' is applied the RSAES-OAEP-ENCRYPT encryption
+                scheme, as described in PKCS#1 v2.1, i.e. RFC 3447 Sect
+                7.1.1. In that context,
+
+                o 'h' parameter provides the name of the hash method to use.
+                  Possible values are "md2", "md4", "md5", "sha1", "tls",
+                  "sha224", "sha256", "sha384" and "sha512". if none is provided,
+                  sha1 is used.
+
+                o 'mgf' is the mask generation function. By default, mgf
+                  is derived from the provided hash function using the
+                  generic MGF1 (see pkcs_mgf1() for details).
+
+                o 'L' is the optional label to be associated with the
+                  message. If not provided, the default value is used, i.e
+                  the empty string. No check is done on the input limitation
+                  of the hash function regarding the size of 'L' (for
+                  instance, 2^61 - 1 for SHA-1). You have been warned.
+        """
+
+        if t is None: # Raw encryption
+            m = pkcs_os2ip(m)
+            c = self._rsaep(m)
+            return pkcs_i2osp(c, self.modulusLen/8)
+
+        elif t == "pkcs":
+            return self._rsaes_pkcs1_v1_5_encrypt(m)
+
+        elif t == "oaep":
+            return self._rsaes_oaep_encrypt(m, h, mgf, L)
+
+        else:
+            warning("Key.encrypt(): Unknown encryption type (%s) provided" % t)
+            return None
+
+    ### Below are verification related methods
+
+    def _rsavp1(self, s):
+        """
+        Internal method providing raw RSA verification, i.e. simple modular
+        exponentiation of the given signature representative 'c', an integer
+        between 0 and n-1.
+
+        This is the signature verification primitive RSAVP1 described in
+        PKCS#1 v2.1, i.e. RFC 3447 Sect. 5.2.2.
+
+        Input:
+          s: signature representative, an integer between 0 and n-1,
+             where n is the key modulus.
+
+        Output:
+           message representative, an integer between 0 and n-1
+
+        Not intended to be used directly. Please, see verify() method.
+        """
+        return self._rsaep(s)
+
+    def _rsassa_pss_verify(self, M, S, h=None, mgf=None, sLen=None):
+        """
+        Implements RSASSA-PSS-VERIFY() function described in Sect 8.1.2
+        of RFC 3447
+
+        Input:
+           M: message whose signature is to be verified
+           S: signature to be verified, an octet string of length k, where k
+              is the length in octets of the RSA modulus n.
+
+        Output:
+           True is the signature is valid. False otherwise.
+        """
+
+        # Set default parameters if not provided
+        if h is None: # By default, sha1
+            h = "sha1"
+        if not _hashFuncParams.has_key(h):
+            warning("Key._rsassa_pss_verify(): unknown hash function "
+                    "provided (%s)" % h)
+            return False
+        if mgf is None: # use mgf1 with underlying hash function
+            mgf = lambda x,y: pkcs_mgf1(x, y, h)
+        if sLen is None: # use Hash output length (A.2.3 of RFC 3447)
+            hLen = _hashFuncParams[h][0]
+            sLen = hLen
+
+        # 1) Length checking
+        modBits = self.modulusLen
+        k = modBits / 8
+        if len(S) != k:
+            return False
+
+        # 2) RSA verification
+        s = pkcs_os2ip(S)                           # 2.a)
+        m = self._rsavp1(s)                         # 2.b)
+        emLen = math.ceil((modBits - 1) / 8.)       # 2.c)
+        EM = pkcs_i2osp(m, emLen)
+
+        # 3) EMSA-PSS verification
+        Result = pkcs_emsa_pss_verify(M, EM, modBits - 1, h, mgf, sLen)
+
+        return Result                               # 4)
+
+
+    def _rsassa_pkcs1_v1_5_verify(self, M, S, h):
+        """
+        Implements RSASSA-PKCS1-v1_5-VERIFY() function as described in
+        Sect. 8.2.2 of RFC 3447.
+
+        Input:
+           M: message whose signature is to be verified, an octet string
+           S: signature to be verified, an octet string of length k, where
+              k is the length in octets of the RSA modulus n
+           h: hash function name (in 'md2', 'md4', 'md5', 'sha1', 'tls',
+                'sha256', 'sha384').
+
+        Output:
+           True if the signature is valid. False otherwise.
+        """
+
+        # 1) Length checking
+        k = self.modulusLen / 8
+        if len(S) != k:
+            warning("invalid signature (len(S) != k)")
+            return False
+
+        # 2) RSA verification
+        s = pkcs_os2ip(S)                           # 2.a)
+        m = self._rsavp1(s)                         # 2.b)
+        EM = pkcs_i2osp(m, k)                       # 2.c)
+
+        # 3) EMSA-PKCS1-v1_5 encoding
+        EMPrime = pkcs_emsa_pkcs1_v1_5_encode(M, k, h)
+        if EMPrime is None:
+            warning("Key._rsassa_pkcs1_v1_5_verify(): unable to encode.")
+            return False
+
+        # 4) Comparison
+        return EM == EMPrime
+
+
+    def verify(self, M, S, t=None, h=None, mgf=None, sLen=None):
+        """
+        Verify alleged signature 'S' is indeed the signature of message 'M' using
+        't' signature scheme where 't' can be:
+
+        - None: the alleged signature 'S' is directly applied the RSAVP1 signature
+                primitive, as described in PKCS#1 v2.1, i.e. RFC 3447 Sect
+                5.2.1. Simply put, the provided signature is applied a moular
+                exponentiation using the public key. Then, a comparison of the
+                result is done against 'M'. On match, True is returned.
+                Additionnal method parameters are just ignored.
+
+        - 'pkcs': the alleged signature 'S' and message 'M' are applied
+                RSASSA-PKCS1-v1_5-VERIFY signature verification scheme as
+                described in Sect. 8.2.2 of RFC 3447. In that context,
+                the hash function name is passed using 'h'. Possible values are
+                "md2", "md4", "md5", "sha1", "tls", "sha224", "sha256", "sha384"
+                and "sha512". If none is provided, sha1 is used. Other additionnal
+                parameters are ignored.
+
+        - 'pss': the alleged signature 'S' and message 'M' are applied
+                RSASSA-PSS-VERIFY signature scheme as described in Sect. 8.1.2.
+                of RFC 3447. In that context,
+
+                o 'h' parameter provides the name of the hash method to use.
+                   Possible values are "md2", "md4", "md5", "sha1", "tls", "sha224",
+                   "sha256", "sha384" and "sha512". if none is provided, sha1
+                   is used.
+
+                o 'mgf' is the mask generation function. By default, mgf
+                   is derived from the provided hash function using the
+                   generic MGF1 (see pkcs_mgf1() for details).
+
+                o 'sLen' is the length in octet of the salt. You can overload the
+                  default value (the octet length of the hash value for provided
+                  algorithm) by providing another one with that parameter.
+        """
+        if t is None: # RSAVP1
+            S = pkcs_os2ip(S)
+            n = self.modulus
+            if S > n-1:
+                warning("Signature to be verified is too long for key modulus")
+                return False
+            m = self._rsavp1(S)
+            if m is None:
+                return False
+            l = int(math.ceil(math.log(m, 2) / 8.)) # Hack
+            m = pkcs_i2osp(m, l)
+            return M == m
+
+        elif t == "pkcs": # RSASSA-PKCS1-v1_5-VERIFY
+            if h is None:
+                h = "sha1"
+            return self._rsassa_pkcs1_v1_5_verify(M, S, h)
+
+        elif t == "pss": # RSASSA-PSS-VERIFY
+            return self._rsassa_pss_verify(M, S, h, mgf, sLen)
+
+        else:
+            warning("Key.verify(): Unknown signature type (%s) provided" % t)
+            return None
+
+class _DecryptAndSignMethods:
+    ### Below are decryption related methods. Encryption ones are inherited
+    ### from PubKey
+
+    def _rsadp(self, c):
+        """
+        Internal method providing raw RSA decryption, i.e. simple modular
+        exponentiation of the given ciphertext representative 'c', a long
+        between 0 and n-1.
+
+        This is the decryption primitive RSADP described in PKCS#1 v2.1,
+        i.e. RFC 3447 Sect. 5.1.2.
+
+        Input:
+           c: ciphertest representative, a long between 0 and n-1, where
+              n is the key modulus.
+
+        Output:
+           ciphertext representative, a long between 0 and n-1
+
+        Not intended to be used directly. Please, see encrypt() method.
+        """
+
+        n = self.modulus
+        if type(c) is int:
+            c = long(c)
+        if type(c) is not long or c > n-1:
+            warning("Key._rsaep() expects a long between 0 and n-1")
+            return None
+
+        return self.key.decrypt(c)
+
+
+    def _rsaes_pkcs1_v1_5_decrypt(self, C):
+        """
+        Implements RSAES-PKCS1-V1_5-DECRYPT() function described in section
+        7.2.2 of RFC 3447.
+
+        Input:
+           C: ciphertext to be decrypted, an octet string of length k, where
+              k is the length in octets of the RSA modulus n.
+
+        Output:
+           an octet string of length k at most k - 11
+
+        on error, None is returned.
+        """
+
+        # 1) Length checking
+        cLen = len(C)
+        k = self.modulusLen / 8
+        if cLen != k or k < 11:
+            warning("Key._rsaes_pkcs1_v1_5_decrypt() decryption error "
+                    "(cLen != k or k < 11)")
+            return None
+
+        # 2) RSA decryption
+        c = pkcs_os2ip(C)                           # 2.a)
+        m = self._rsadp(c)                          # 2.b)
+        EM = pkcs_i2osp(m, k)                       # 2.c)
+
+        # 3) EME-PKCS1-v1_5 decoding
+
+        # I am aware of the note at the end of 7.2.2 regarding error
+        # conditions reporting but the one provided below are for _local_
+        # debugging purposes. --arno
+
+        if EM[0] != '\x00':
+            warning("Key._rsaes_pkcs1_v1_5_decrypt(): decryption error "
+                    "(first byte is not 0x00)")
+            return None
+
+        if EM[1] != '\x02':
+            warning("Key._rsaes_pkcs1_v1_5_decrypt(): decryption error "
+                    "(second byte is not 0x02)")
+            return None
+
+        tmp = EM[2:].split('\x00', 1)
+        if len(tmp) != 2:
+            warning("Key._rsaes_pkcs1_v1_5_decrypt(): decryption error "
+                    "(no 0x00 to separate PS from M)")
+            return None
+
+        PS, M = tmp
+        if len(PS) < 8:
+            warning("Key._rsaes_pkcs1_v1_5_decrypt(): decryption error "
+                    "(PS is less than 8 byte long)")
+            return None
+
+        return M                                    # 4)
+
+
+    def _rsaes_oaep_decrypt(self, C, h=None, mgf=None, L=None):
+        """
+        Internal method providing RSAES-OAEP-DECRYPT as defined in Sect.
+        7.1.2 of RFC 3447. Not intended to be used directly. Please, see
+        encrypt() method for type "OAEP".
+
+
+        Input:
+           C  : ciphertext to be decrypted, an octet string of length k, where
+                k = 2*hLen + 2 (k denotes the length in octets of the RSA modulus
+                and hLen the length in octets of the hash function output)
+           h  : hash function name (in 'md2', 'md4', 'md5', 'sha1', 'tls',
+                'sha256', 'sha384'). 'sha1' is used if none is provided.
+           mgf: the mask generation function f : seed, maskLen -> mask
+           L  : optional label whose association with the message is to be
+                verified; the default value for L, if not provided is the empty
+                string.
+
+        Output:
+           message, an octet string of length k mLen, where mLen <= k - 2*hLen - 2
+
+        On error, None is returned.
+        """
+        # The steps below are the one described in Sect. 7.1.2 of RFC 3447.
+
+        # 1) Length Checking
+                                                    # 1.a) is not done
+        if h is None:
+            h = "sha1"
+        if not _hashFuncParams.has_key(h):
+            warning("Key._rsaes_oaep_decrypt(): unknown hash function %s.", h)
+            return None
+        hLen = _hashFuncParams[h][0]
+        hFun = _hashFuncParams[h][1]
+        k = self.modulusLen / 8
+        cLen = len(C)
+        if cLen != k:                               # 1.b)
+            warning("Key._rsaes_oaep_decrypt(): decryption error. "
+                    "(cLen != k)")
+            return None
+        if k < 2*hLen + 2:
+            warning("Key._rsaes_oaep_decrypt(): decryption error. "
+                    "(k < 2*hLen + 2)")
+            return None
+
+        # 2) RSA decryption
+        c = pkcs_os2ip(C)                           # 2.a)
+        m = self._rsadp(c)                          # 2.b)
+        EM = pkcs_i2osp(m, k)                       # 2.c)
+
+        # 3) EME-OAEP decoding
+        if L is None:                               # 3.a)
+            L = ""
+        lHash = hFun(L)
+        Y = EM[:1]                                  # 3.b)
+        if Y != '\x00':
+            warning("Key._rsaes_oaep_decrypt(): decryption error. "
+                    "(Y is not zero)")
+            return None
+        maskedSeed = EM[1:1+hLen]
+        maskedDB = EM[1+hLen:]
+        if mgf is None:
+            mgf = lambda x,y: pkcs_mgf1(x, y, h)
+        seedMask = mgf(maskedDB, hLen)              # 3.c)
+        seed = strxor(maskedSeed, seedMask)         # 3.d)
+        dbMask = mgf(seed, k - hLen - 1)            # 3.e)
+        DB = strxor(maskedDB, dbMask)               # 3.f)
+
+        # I am aware of the note at the end of 7.1.2 regarding error
+        # conditions reporting but the one provided below are for _local_
+        # debugging purposes. --arno
+
+        lHashPrime = DB[:hLen]                      # 3.g)
+        tmp = DB[hLen:].split('\x01', 1)
+        if len(tmp) != 2:
+            warning("Key._rsaes_oaep_decrypt(): decryption error. "
+                    "(0x01 separator not found)")
+            return None
+        PS, M = tmp
+        if PS != '\x00'*len(PS):
+            warning("Key._rsaes_oaep_decrypt(): decryption error. "
+                    "(invalid padding string)")
+            return None
+        if lHash != lHashPrime:
+            warning("Key._rsaes_oaep_decrypt(): decryption error. "
+                    "(invalid hash)")
+            return None
+        return M                                    # 4)
+
+
+    def decrypt(self, C, t=None, h=None, mgf=None, L=None):
+        """
+        Decrypt ciphertext 'C' using 't' decryption scheme where 't' can be:
+
+        - None: the ciphertext 'C' is directly applied the RSADP decryption
+                primitive, as described in PKCS#1 v2.1, i.e. RFC 3447
+                Sect 5.1.2. Simply, put the message undergo a modular
+                exponentiation using the private key. Additionnal method
+                parameters are just ignored.
+
+        - 'pkcs': the ciphertext 'C' is applied RSAES-PKCS1-V1_5-DECRYPT
+                decryption scheme as described in section 7.2.2 of RFC 3447.
+                In that context, other parameters ('h', 'mgf', 'l') are not
+                used.
+
+        - 'oaep': the ciphertext 'C' is applied the RSAES-OAEP-DECRYPT decryption
+                scheme, as described in PKCS#1 v2.1, i.e. RFC 3447 Sect
+                7.1.2. In that context,
+
+                o 'h' parameter provides the name of the hash method to use.
+                  Possible values are "md2", "md4", "md5", "sha1", "tls",
+                  "sha224", "sha256", "sha384" and "sha512". if none is provided,
+                  sha1 is used by default.
+
+                o 'mgf' is the mask generation function. By default, mgf
+                  is derived from the provided hash function using the
+                  generic MGF1 (see pkcs_mgf1() for details).
+
+                o 'L' is the optional label to be associated with the
+                  message. If not provided, the default value is used, i.e
+                  the empty string. No check is done on the input limitation
+                  of the hash function regarding the size of 'L' (for
+                  instance, 2^61 - 1 for SHA-1). You have been warned.
+        """
+        if t is None:
+            C = pkcs_os2ip(C)
+            c = self._rsadp(C)
+            l = int(math.ceil(math.log(c, 2) / 8.)) # Hack
+            return pkcs_i2osp(c, l)
+
+        elif t == "pkcs":
+            return self._rsaes_pkcs1_v1_5_decrypt(C)
+
+        elif t == "oaep":
+            return self._rsaes_oaep_decrypt(C, h, mgf, L)
+
+        else:
+            warning("Key.decrypt(): Unknown decryption type (%s) provided" % t)
+            return None
+
+    ### Below are signature related methods. Verification ones are inherited from
+    ### PubKey
+
+    def _rsasp1(self, m):
+        """
+        Internal method providing raw RSA signature, i.e. simple modular
+        exponentiation of the given message representative 'm', an integer
+        between 0 and n-1.
+
+        This is the signature primitive RSASP1 described in PKCS#1 v2.1,
+        i.e. RFC 3447 Sect. 5.2.1.
+
+        Input:
+           m: message representative, an integer between 0 and n-1, where
+              n is the key modulus.
+
+        Output:
+           signature representative, an integer between 0 and n-1
+
+        Not intended to be used directly. Please, see sign() method.
+        """
+        return self._rsadp(m)
+
+
+    def _rsassa_pss_sign(self, M, h=None, mgf=None, sLen=None):
+        """
+        Implements RSASSA-PSS-SIGN() function described in Sect. 8.1.1 of
+        RFC 3447.
+
+        Input:
+           M: message to be signed, an octet string
+
+        Output:
+           signature, an octet string of length k, where k is the length in
+           octets of the RSA modulus n.
+
+        On error, None is returned.
+        """
+
+        # Set default parameters if not provided
+        if h is None: # By default, sha1
+            h = "sha1"
+        if not _hashFuncParams.has_key(h):
+            warning("Key._rsassa_pss_sign(): unknown hash function "
+                    "provided (%s)" % h)
+            return None
+        if mgf is None: # use mgf1 with underlying hash function
+            mgf = lambda x,y: pkcs_mgf1(x, y, h)
+        if sLen is None: # use Hash output length (A.2.3 of RFC 3447)
+            hLen = _hashFuncParams[h][0]
+            sLen = hLen
+
+        # 1) EMSA-PSS encoding
+        modBits = self.modulusLen
+        k = modBits / 8
+        EM = pkcs_emsa_pss_encode(M, modBits - 1, h, mgf, sLen)
+        if EM is None:
+            warning("Key._rsassa_pss_sign(): unable to encode")
+            return None
+
+        # 2) RSA signature
+        m = pkcs_os2ip(EM)                          # 2.a)
+        s = self._rsasp1(m)                         # 2.b)
+        S = pkcs_i2osp(s, k)                        # 2.c)
+
+        return S                                    # 3)
+
+
+    def _rsassa_pkcs1_v1_5_sign(self, M, h):
+        """
+        Implements RSASSA-PKCS1-v1_5-SIGN() function as described in
+        Sect. 8.2.1 of RFC 3447.
+
+        Input:
+           M: message to be signed, an octet string
+           h: hash function name (in 'md2', 'md4', 'md5', 'sha1', 'tls'
+                'sha256', 'sha384').
+
+        Output:
+           the signature, an octet string.
+        """
+
+        # 1) EMSA-PKCS1-v1_5 encoding
+        k = self.modulusLen / 8
+        EM = pkcs_emsa_pkcs1_v1_5_encode(M, k, h)
+        if EM is None:
+            warning("Key._rsassa_pkcs1_v1_5_sign(): unable to encode")
+            return None
+
+        # 2) RSA signature
+        m = pkcs_os2ip(EM)                          # 2.a)
+        s = self._rsasp1(m)                         # 2.b)
+        S = pkcs_i2osp(s, k)                        # 2.c)
+
+        return S                                    # 3)
+
+
+    def sign(self, M, t=None, h=None, mgf=None, sLen=None):
+        """
+        Sign message 'M' using 't' signature scheme where 't' can be:
+
+        - None: the message 'M' is directly applied the RSASP1 signature
+                primitive, as described in PKCS#1 v2.1, i.e. RFC 3447 Sect
+                5.2.1. Simply put, the message undergo a modular exponentiation
+                using the private key. Additionnal method parameters are just
+                ignored.
+
+        - 'pkcs': the message 'M' is applied RSASSA-PKCS1-v1_5-SIGN signature
+                scheme as described in Sect. 8.2.1 of RFC 3447. In that context,
+                the hash function name is passed using 'h'. Possible values are
+                "md2", "md4", "md5", "sha1", "tls", "sha224", "sha256", "sha384"
+                and "sha512". If none is provided, sha1 is used. Other additionnal
+                parameters are ignored.
+
+        - 'pss' : the message 'M' is applied RSASSA-PSS-SIGN signature scheme as
+                described in Sect. 8.1.1. of RFC 3447. In that context,
+
+                o 'h' parameter provides the name of the hash method to use.
+                   Possible values are "md2", "md4", "md5", "sha1", "tls", "sha224",
+                   "sha256", "sha384" and "sha512". if none is provided, sha1
+                   is used.
+
+                o 'mgf' is the mask generation function. By default, mgf
+                   is derived from the provided hash function using the
+                   generic MGF1 (see pkcs_mgf1() for details).
+
+                o 'sLen' is the length in octet of the salt. You can overload the
+                  default value (the octet length of the hash value for provided
+                  algorithm) by providing another one with that parameter.
+        """
+
+        if t is None: # RSASP1
+            M = pkcs_os2ip(M)
+            n = self.modulus
+            if M > n-1:
+                warning("Message to be signed is too long for key modulus")
+                return None
+            s = self._rsasp1(M)
+            if s is None:
+                return None
+            return pkcs_i2osp(s, self.modulusLen/8)
+
+        elif t == "pkcs": # RSASSA-PKCS1-v1_5-SIGN
+            if h is None:
+                h = "sha1"
+            return self._rsassa_pkcs1_v1_5_sign(M, h)
+
+        elif t == "pss": # RSASSA-PSS-SIGN
+            return self._rsassa_pss_sign(M, h, mgf, sLen)
+
+        else:
+            warning("Key.sign(): Unknown signature type (%s) provided" % t)
+            return None
+
+class Key(_DecryptAndSignMethods, _EncryptAndVerify):
+
+    def __init__(self, pem_data):
+        self.key = RSA.importKey(pem_data)
+        self.modulus = self.key.key.n
+        self.modulusLen = self.key.key.size() + 1
+        self.privExp = self.key.key.d
+        self.pubExp = self.key.key.e
+        self.prime1 = self.key.key.p
+        self.prime2 = self.key.key.q
+        self.exponent1 = 0
+        self.exponent2 = 0
+        self.coefficient = self.key.key.u