anchor.diff:  			   {options,[{validate_extensions_fun, Fun} | ClientOpts]}]),
       
       ssl_test_lib:check_result(Server, ok, Client, ok),
  +    
  +    ssl_test_lib:close(Server),
  +    ssl_test_lib:close(Client).
  +
  +%%--------------------------------------------------------------------
  +no_authority_key_identifier(doc) -> 
  +    ["Test cert that does not have authorityKeyIdentifier extension"];
  +
  +no_authority_key_identifier(suite) -> 
  +    [];
  +no_authority_key_identifier(Config) when is_list(Config) -> 
  +    ClientOpts = ?config(client_opts, Config),
  +    ServerOpts = ?config(server_opts, Config),
  +    PrivDir = ?config(priv_dir, Config),
  +   
  +    KeyFile = filename:join(PrivDir, "otpCA/private/key.pem"),
  +    {ok, [KeyInfo]} = public_key:pem_to_der(KeyFile),
  +    {ok, Key} = public_key:decode_private_key(KeyInfo),
  +
  +    CertFile = proplists:get_value(certfile, ServerOpts),
  +    NewCertFile = filename:join(PrivDir, "server/new_cert.pem"),
  +    {ok, [{cert, DerCert, _}]} = public_key:pem_to_der(CertFile),
  +    {ok, OTPCert} = public_key:pkix_decode_cert(DerCert, otp),
  +    OTPTbsCert = OTPCert#'OTPCertificate'.tbsCertificate,
  +    Extensions =  OTPTbsCert#'OTPTBSCertificate'.extensions,
  +    NewExtensions =  delete_authority_key_extension(Extensions, []),
  +    NewOTPTbsCert =  OTPTbsCert#'OTPTBSCertificate'{extensions = NewExtensions},
  +
  +    test_server:format("Extensions ~p~n, NewExtensions: ~p~n", [Extensions, NewExtensions]),
  +
  +    NewDerCert = public_key:sign(NewOTPTbsCert, Key), 
  +    public_key:der_to_pem(NewCertFile, [{cert, NewDerCert}]),
  +    NewServerOpts = [{certfile, NewCertFile} | proplists:delete(certfile, ServerOpts)],
  +
  +    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
  +    
  +    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
  +					{from, self()}, 
  +			   {mfa, {?MODULE, send_recv_result_active, []}},
  +			   {options, NewServerOpts}]),
  +    Port = ssl_test_lib:inet_port(Server),
  +    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
  +					{host, Hostname},
  +			   {from, self()}, 
  +			   {mfa, {?MODULE, send_recv_result_active, []}},
  +			   {options, [{verify, verify_peer} | ClientOpts]}]),
  +    
  +    ssl_test_lib:check_result(Server, ok, Client, ok),
  +    
  +    ssl_test_lib:close(Server),
  +    ssl_test_lib:close(Client).
  +
  +delete_authority_key_extension([], Acc) ->
  +    lists:reverse(Acc);
  +delete_authority_key_extension([#'Extension'{extnID = ?'id-ce-authorityKeyIdentifier'} | Rest], 
  +			       Acc) ->
  +    delete_authority_key_extension(Rest, Acc);
  +delete_authority_key_extension([Head | Rest], Acc) ->
  +    delete_authority_key_extension(Rest, [Head | Acc]).
  +
  +%%--------------------------------------------------------------------
  +
  +invalid_signature_server(doc) -> 
  +    ["Test server with invalid signature"];
  +
  +invalid_signature_server(suite) -> 
  +    [];
  +
  +invalid_signature_server(Config) when is_list(Config) -> 
  +    ClientOpts = ?config(client_opts, Config),
  +    ServerOpts = ?config(server_verification_opts, Config),
  +    PrivDir = ?config(priv_dir, Config),
  +   
  +    KeyFile = filename:join(PrivDir, "server/key.pem"),
  +    {ok, [KeyInfo]} = public_key:pem_to_der(KeyFile),
  +    {ok, Key} = public_key:decode_private_key(KeyInfo),
  +
  +    ServerCertFile = proplists:get_value(certfile, ServerOpts),
  +    NewServerCertFile = filename:join(PrivDir, "server/invalid_cert.pem"),
  +    {ok, [{cert, ServerDerCert, _}]} = public_key:pem_to_der(ServerCertFile),
  +    {ok, ServerOTPCert} = public_key:pkix_decode_cert(ServerDerCert, otp),
  +    ServerOTPTbsCert = ServerOTPCert#'OTPCertificate'.tbsCertificate,
  +    NewServerDerCert = public_key:sign(ServerOTPTbsCert, Key), 
  +    public_key:der_to_pem(NewServerCertFile, [{cert, NewServerDerCert}]),
  +    NewServerOpts = [{certfile, NewServerCertFile} | proplists:delete(certfile, ServerOpts)],
  +    
  +    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
  +    
  +    Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0}, 
  +					      {from, self()}, 
  +					      {options, NewServerOpts}]),
  +    Port = ssl_test_lib:inet_port(Server),
  +    Client = ssl_test_lib:start_client_error([{node, ClientNode}, {port, Port}, 
  +					      {host, Hostname},
  +					      {from, self()}, 
  +					      {options, [{verify, verify_peer} | ClientOpts]}]),
  +    
  +    ssl_test_lib:check_result(Server, {error, "bad certificate"}, 
  +			      Client, {error,"bad certificate"}),
  +    
  +    ssl_test_lib:close(Server),
  +    ssl_test_lib:close(Client).
  +
  +%%--------------------------------------------------------------------
  +
  +invalid_signature_client(doc) -> 
  +    ["Test server with invalid signature"];
  +
  +invalid_signature_client(suite) -> 
  +    [];
  +
  +invalid_signature_client(Config) when is_list(Config) -> 
  +    ClientOpts = ?config(client_verification_opts, Config),
  +    ServerOpts = ?config(server_verification_opts, Config),
  +    PrivDir = ?config(priv_dir, Config),
  +   
  +    KeyFile = filename:join(PrivDir, "client/key.pem"),
  +    {ok, [KeyInfo]} = public_key:pem_to_der(KeyFile),
  +    {ok, Key} = public_key:decode_private_key(KeyInfo),
  +
  +    ClientCertFile = proplists:get_value(certfile, ClientOpts),
  +    NewClientCertFile = filename:join(PrivDir, "client/invalid_cert.pem"),
  +    {ok, [{cert, ClientDerCert, _}]} = public_key:pem_to_der(ClientCertFile),
  +    {ok, ClientOTPCert} = public_key:pkix_decode_cert(ClientDerCert, otp),
  +    ClientOTPTbsCert = ClientOTPCert#'OTPCertificate'.tbsCertificate,
  +    NewClientDerCert = public_key:sign(ClientOTPTbsCert, Key), 
  +    public_key:der_to_pem(NewClientCertFile, [{cert, NewClientDerCert}]),
  +    NewClientOpts = [{certfile, NewClientCertFile} | proplists:delete(certfile, ClientOpts)],
  +
  +    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
  +    
  +    Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0}, 
  +					{from, self()}, 
  +					{options, [{verify, verify_peer} | ServerOpts]}]),
  +    Port = ssl_test_lib:inet_port(Server),
  +    Client = ssl_test_lib:start_client_error([{node, ClientNode}, {port, Port}, 
  +					{host, Hostname},
  +					{from, self()}, 
  +					{options, NewClientOpts}]),
  +    
  +    ssl_test_lib:check_result(Server, {error, "bad certificate"}, 
  +			      Client, {error,"bad certificate"}),
       
       ssl_test_lib:close(Server),
       ssl_test_lib:close(Client).
  
positive.code:     ssl_test_lib:check_result(Server, ok, Client, ok),
      
      ssl_test_lib:close(Server),
      ssl_test_lib:close(Client).
  
  socket_options_result(Socket, Options, DefaultValues, NewOptions, NewValues) ->
      %% Test get/set emulated opts
  
negative.code: -include("test_server.hrl").
  -include("test_server_line.hrl").
  -include_lib("public_key/include/public_key.hrl").
  -include("ssl_alert.hrl").
  
  -define('24H_in_sec', 86400).  
  -define(TIMEOUT, 60000).
  