anchor.diff:        (* Should never happen *)
         | PSServer(_) -> unexpectedError "[recv_fragment_client] should only be invoked when in client role."
   
  -// Move to Certificate? 
  -let getServerCert cs ops =
  -    (* TODO: Properly get the server certificate. Note this should be a list of certificates...*)
  -    let data = System.IO.File.ReadAllBytes (ops.server_cert_file + ".cer") in
  -    match certificate_of_bytes data with
  -    | Error(x,y) -> Error(HSError(AD_internal_error),HSSendAlert)
  -    | Correct(cert) ->
  -        let pri = System.IO.File.ReadAllText(ops.server_cert_file + ".pvk") in
  -        let cert = set_priKey cert pri in
  -        (* FIXME TODO DEBUG: Remove next printing lines *)
  -        printfn "Sending certificate of"
  -        printfn "%s" (get_CN cert)
  -        correct (cert)
  -
   let prepare_server_output_full state maxClVer =
       let ext = 
         if state.poptions.safe_renegotiation then
  
positive.code:         | _ -> (* Handshake already ongoing, ignore this request *)
              (false,state)
  
  let storeSession sDB (sinfo, ms, role) =
      match sinfo.sessionID with
      | [||] -> (* Non-resumable session *)
          sDB
      | sid ->
          SessionDB.insert sDB sinfo.sessionID (sinfo, ms, role)
  
  // FIXME: Seems we can skip this function with the new state machine *)
  (*
  let goToIdle state =
      let init_sessionInfo = null_sessionInfo state.poptions.minVer in
      match state.pstate with
      | PSClient (_) ->
          let sDB = storeSession Client state in
          {hs_outgoing = [||];
           ccs_outgoing = None;
           hs_outgoing_after_ccs = [||];
           hs_incoming = [||];
           ccs_incoming = None
           poptions = state.poptions;
           sDB = sDB;
           pstate = PSClient(CIdle);
           hs_msg_log = [||]
           hs_next_info = init_sessionInfo
           next_ms = empty_masterSecret init_sessionInfo
           ki_crand = [||]
           ki_srand = [||]
           hs_renegotiation_info_cVerifyData = state.hs_renegotiation_info_cVerifyData
           hs_renegotiation_info_sVerifyData = state.hs_renegotiation_info_sVerifyData}
      | PSServer (_) ->
          let rand = makeRandom () in
          let init_sessionInfo = {init_sessionInfo with init_srand = rand} in
          let sDB = storeSession Server state in
          {hs_outgoing = [||];
           ccs_outgoing = None;
           hs_outgoing_after_ccs = [||];
           hs_incoming = [||];
           ccs_incoming = None
           poptions = state.poptions;
           sDB = sDB;
           pstate = PSServer(SIdle);
           hs_msg_log = [||]
           hs_next_info = init_sessionInfo
           next_ms = empty_masterSecret init_sessionInfo
           ki_crand = [||]
           ki_srand = rand
           hs_renegotiation_info_cVerifyData = state.hs_renegotiation_info_cVerifyData
           hs_renegotiation_info_sVerifyData = state.hs_renegotiation_info_sVerifyData}
  *)
  
  let invalidateSession ci state =
      let si = epochSI(ci.id_in) // FIXME: which epoch to choose? Here it matters since they could be mis-aligned
      match si.sessionID with
  
negative.code:         match hstype with
          | HT_client_hello ->
              match sState with
              | x when x = ClientHello || x = ServerIdle ->
                  match parseClientHello payload with
                  | Error(x,y) -> InError(HSError(AD_decode_error),HSSendAlert,state)
                  | Correct (cHello) ->
                  (* Log the received message *)
                  let log = to_log in
                  (* handle extensions: for now only renegotiation_info *)
                  let extRes =
                      if state.poptions.safe_renegotiation then
  