anchor.diff:  			   {crl_cache, {ssl_crl_cache, {internal, [{http, 5000}]}}},
   			   {verify, verify_peer}];
   		      false ->
  -			  ?config(crl_cache_opts, Config) ++
  +			  proplists:get_value(crl_cache_opts, Config) ++
   			      [{cacertfile, filename:join([PrivDir, "server", "cacerts.pem"])},
   			       {crl_check, Check},
   			       {verify, verify_peer}]
  
positive.code: init_per_group(check_best_effort, Config) ->
      [{crl_check, best_effort} | Config];
  init_per_group(Group, Config0) ->
      case is_idp(Group) of
  	true ->
  	    [{idp_crl, true} | Config0];
  	false ->
  	    DataDir = proplists:get_value(data_dir, Config0), 
  	    CertDir = filename:join(proplists:get_value(priv_dir, Config0), Group),
  	    {CertOpts, Config} = init_certs(CertDir, Group, Config0),
  	    {ok, _} =  make_certs:all(DataDir, CertDir, CertOpts),
  	    case Group of
  		crl_hash_dir ->
  		    CrlDir = filename:join(CertDir, "crls"),
  		    %% Copy CRLs to their hashed filenames.
  		    %% Find the hashes with 'openssl crl -noout -hash -in crl.pem'.
  		    populate_crl_hash_dir(CertDir, CrlDir,
  					  [{"erlangCA", "d6134ed3"},
  					   {"otpCA", "d4c8d7e5"}],
  					  replace),
  		    CrlCacheOpts = [{crl_cache,
  				     {ssl_crl_hash_dir,
  				      {internal, [{dir, CrlDir}]}}}];
  		_ ->
  		    CrlCacheOpts = []
  	    end,
  	    [{crl_cache_opts, CrlCacheOpts},
  	     {cert_dir, CertDir},
  	     {idp_crl, false} | Config]
      end.
  
  end_per_group(_GroupName, Config) ->
  
negative.code: 	false ->
  	    Name
      end.
  
  new_ca(FileName, CA1, CA2) ->
      {ok, P1} = file:read_file(CA1),
      E1 = public_key:pem_decode(P1),
      {ok, P2} = file:read_file(CA2),
      E2 = public_key:pem_decode(P2),
      Pem = public_key:pem_encode(E1 ++E2),
      file:write_file(FileName,  Pem),
      FileName.
  