anchor.diff:     _ = pipe:b(Pipe, {ssl, S#fsm.peer, {terminated, timeout}}),
      {stop, normal, S};
   
  -'ESTABLISHED'(timeout_io,  Pipe, S) ->
  +'ESTABLISHED'(timeout_io,  _Pipe, S) ->
      {next_state, 'ESTABLISHED',
         S#fsm{
            packet  = 0,
            tout_io = tempus:reset(S#fsm.tout_io, timeout_io)
  +      }
  +   };
  +
  +'ESTABLISHED'({ssl_cert, ca, Cert}, _Pipe, S) ->
  +   {next_state, 'ESTABLISHED', 
  +      S#fsm{
  +         cert = [Cert | S#fsm.cert]
  +      }
  +   };
  +
  +'ESTABLISHED'({ssl_cert, peer, Cert}, _Pipe, S) ->
  +   Pckt = [public_key:pkix_encode('OTPCertificate', X, otp) || X <- [Cert | S#fsm.cert]],
  +   so_stats({packet, 0, erlang:iolist_size(Pckt)}, S),
  +   {next_state, 'ESTABLISHED', 
  +      S#fsm{
  +         cert = [Cert | S#fsm.cert]
         }
      };
   
  
positive.code:    end;
  
  %%
  'IDLE'({listen, Uri}, Pipe, S) ->
  	{stop, not_implemented, S};
  
  %%
  'IDLE'({accept, Uri}, Pipe, S) ->
  	{stop, not_implemented, S};
  
  %%
  
negative.code:       	{ok, Peer} = inet:peername(Tcp),
        	so_stats({connect, tempus:diff(T1)}, S#fsm{peer=Peer}),
        	T2 = os:timestamp(),
           case ssl:connect(Tcp, [{verify_fun, {fun ssl_ca_hook/3, self()}} | S#fsm.sopt], S#fsm.tout_peer) of
              {ok, Sock} ->
        		   {ok, Addr} = ssl:sockname(Sock),
        		   %{ok, {Tls, Cipher}} = ssl:connection_info(Sock),
  		         ok         = pns:register(knet, {ssl, Peer}),
           		?DEBUG("knet ssl ~p: established ~p (local ~p)", [self(), Peer, Addr]),
           		so_stats({handshake, tempus:diff(T2)}, S#fsm{peer=Peer}),
           		pipe:a(Pipe, {ssl, Peer, established}),
           		so_ioctl(Sock, S),
  		         {next_state, 'ESTABLISHED', 
  