anchor.diff:  	  reuse_session        :: fun() | binary() | undefined, %% Server side is a fun()
   	  %% If false sessions will never be reused, if true they
   	  %% will be reused if possible.
  -	  reuse_sessions       :: boolean() | save,  %% Only client side can use value save
  +	  reuse_sessions       :: boolean() | save | 'undefined',  %% Only client side can use value save
   	  renegotiate_at,
   	  secure_renegotiate,
   	  client_renegotiation,
   	  %% undefined if not hibernating, or number of ms of
   	  %% inactivity after which ssl_connection will go into
   	  %% hibernation
  -	  hibernate_after      :: timeout(),          
  +	  hibernate_after      :: timeout() | 'undefined',
   	  %% This option should only be set to true by inet_tls_dist
   	  erl_dist = false     :: boolean(),
  -          alpn_advertised_protocols = undefined :: [binary()] | undefined ,
  +          alpn_advertised_protocols = undefined :: [binary()] | undefined,
             alpn_preferred_protocols = undefined  :: [binary()] | undefined,
   	  next_protocols_advertised = undefined :: [binary()] | undefined,
   	  next_protocol_selector = undefined,  %% fun([binary()]) -> binary())
   	  log_level = notice :: atom(),
   	  server_name_indication = undefined,
  -	  sni_hosts  :: [{inet:hostname(), [tuple()]}],
  +	  sni_hosts  :: [{inet:hostname(), [tuple()]}] | 'undefined',
   	  sni_fun :: function() | undefined,
   	  %% Should the server prefer its own cipher order over the one provided by
   	  %% the client?
  
positive.code: 	  %%mitigation entirely?
  	  beast_mitigation = one_n_minus_one :: one_n_minus_one | zero_n | disabled,
  	  fallback = false           :: boolean(),
  	  crl_check                  :: boolean() | peer | best_effort, 
  	  crl_cache,
  	  signature_algs,
  	  signature_algs_cert,
  	  eccs,
  	  supported_groups,  %% RFC 8422, RFC 8446
  	  honor_ecc_order            :: boolean(),
            max_handshake_size         :: integer(),
            handshake,
            customize_hostname_check
      %%                 ,
  
negative.code: -define('24H_in_sec', 86400).
  
  -record(ssl_options, {
  	  protocol    :: tls | dtls | 'undefined',
  	  versions    :: [ssl_record:ssl_version()] | 'undefined', %% ssl_record:atom_version() in API
  	  verify      :: verify_none | verify_peer | 'undefined',
  	  verify_fun,  %%:: fun(CertVerifyErrors::term()) -> boolean(),
  	  partial_chain       :: fun() | 'undefined',
  	  fail_if_no_peer_cert ::  boolean() | 'undefined',
  	  verify_client_once   ::  boolean() | 'undefined',
  	  %% fun(Extensions, State, Verify, AccError) ->  {Extensions, State, AccError}
  	  validate_extensions_fun, 
  	  depth                :: integer() | 'undefined',
  	  certfile             :: binary() | 'undefined',
  	  cert                 :: public_key:der_encoded() | secret_printout() | 'undefined',
  	  keyfile              :: binary() | 'undefined',
  	  key	               :: {'RSAPrivateKey' | 'DSAPrivateKey' | 'ECPrivateKey' | 'PrivateKeyInfo' | 'undefined',
                                     public_key:der_encoded()} | map()  %%map() -> ssl:key() how to handle dialyzer?
                                  | secret_printout() | 'undefined',
  	  password	       :: string() | secret_printout() | 'undefined',
  	  cacerts              :: [public_key:der_encoded()] | secret_printout() | 'undefined',
  	  cacertfile           :: binary() | 'undefined',
  	  dh                   :: public_key:der_encoded() | secret_printout() | 'undefined',
  	  dhfile               :: binary() | secret_printout() | 'undefined',
  	  user_lookup_fun,  % server option, fun to lookup the user
  	  psk_identity         :: binary() | secret_printout() | 'undefined',
  