anchor.diff:                             imemSslOpts,[],'$no_ssl_conf',
                              "SSL listen socket options") of
                          '$no_ssl_conf' ->
  -                           CertFile = filename:join(
  -                                       [Pwd, proplists:get_value(certfile, Opts)]),
  -                           KeyFile = filename:join(
  -                                       [Pwd, proplists:get_value(keyfile, Opts)]),
  -                           ImemSslDefault =
  -                           [{versions, ['tlsv1.2','tlsv1.1',tlsv1]} |
  -                            get_cert_key({file, CertFile}) ++
  -                            get_cert_key({file, KeyFile})],
  -                           ?Info("Installing SSL certificates ~p~nKeys ~p",
  -                                 [catch decode_cert_key({file, CertFile}),
  -                                  catch decode_cert_key({file, KeyFile})]),
  +                           {ok, CertBin} =
  +                           file:read_file(
  +                             filename:join(
  +                               [Pwd, proplists:get_value(certfile, Opts)])),
  +                           {ok, KeyBin} =
  +                           file:read_file(
  +                             filename:join(
  +                               [Pwd, proplists:get_value(keyfile, Opts)])),
  +                           Cert = get_cert_key(CertBin),
  +                           Key = get_cert_key(KeyBin),
  +                           ImemSslDefault = Cert ++ Key,
  +                           ?Info("Installing SSL ~p", [ImemSslDefault]),
                              ?PUT_CONFIG(
  -                              imemSslOpts, [], ImemSslDefault,
  +                              imemSslOpts, [], #{cert => CertBin, key => KeyBin},
                                 list_to_binary(
  -                                io_lib:format("Installed at ~p on ~s",
  -                                              [node(), imem_datatype:timestamp_to_io(os:timestamp())]
  -                                             ))),
  +                                io_lib:format(
  +                                  "Installed at ~p on ~s",
  +                                  [node(), imem_datatype:timestamp_to_io(os:timestamp())]
  +                                 ))),
                              ImemSslDefault ++
                              proplists:delete(keyfile, proplists:delete(certfile, Opts));
  -                       ImemSslDefault ->
  -                           ImemSslDefault ++ 
  +                       #{cert := CertBin, key := KeyBin} ->
  +                           CertFile = filename:join([Pwd, proplists:get_value(certfile, Opts)]),
  +                           case file:read_file(CertFile) of
  +                               {ok, CertBin} -> nop;
  +                               _ -> ok = file:write_file(CertFile, CertBin)
  +                           end,
  +                           KeyFile = filename:join([Pwd, proplists:get_value(keyfile, Opts)]),
  +                           case file:read_file(KeyFile) of
  +                               {ok, KeyBin} -> nop;
  +                               _ -> ok = file:write_file(KeyFile, KeyBin)
  +                           end,
  +                           Cert = get_cert_key(CertBin),
  +                           Key = get_cert_key(KeyBin),
  +                           Cert ++ Key ++
                              proplists:delete(keyfile, proplists:delete(certfile, Opts))
                      end;
                  true -> Opts
  
positive.code:                             end];
          [{KeyType,Key,_}|_] -> [{key, {KeyType, Key}}]
      end.
  
  -spec decode_cert_key({file, list()} | {bin, binary()}) -> list().
  decode_cert_key({file, CertFile}) when is_list(CertFile) ->
      {ok, CertBin} = file:read_file(CertFile),
      decode_cert_key({bin,CertBin});
  decode_cert_key({bin,CertBin}) when is_binary(CertBin) ->
      [public_key:pem_entry_decode(Cert)
       || Cert <- public_key:pem_decode(CertBin)].
  
negative.code:         ]).
  
  %% -- Certificate management APIs --
  -export([get_cert_key/1]).
   
  start_link(Params) ->
      Interface   = proplists:get_value(tcp_ip,Params),
  