anchor.diff:        	{ok, Peer} = inet:peername(Tcp),
         	so_stats({connect, tempus:diff(T1)}, S#fsm{peer=Peer}),
         	T2 = os:timestamp(),
  -         case ssl:connect(Tcp, S#fsm.sopt, S#fsm.tout_peer) of
  +         case ssl:connect(Tcp, [{verify_fun, {fun ssl_ca_hook/3, self()}} | S#fsm.sopt], S#fsm.tout_peer) of
               {ok, Sock} ->
         		   {ok, Addr} = ssl:sockname(Sock),
         		   %{ok, {Tls, Cipher}} = ssl:connection_info(Sock),
  -      		   {ok, Cert} = ssl:peercert(Sock),
   		         ok         = pns:register(knet, {ssl, Peer}),
            		?DEBUG("knet ssl ~p: established ~p (local ~p)", [self(), Peer, Addr]),
  -         		%so_stats({packet, tempus:diff(T2), size(Cert)}, S#fsm{peer=Peer}),
  -         		so_stats({handshake, tempus:diff(T2), size(Cert)}, S#fsm{peer=Peer}),
  +         		so_stats({handshake, tempus:diff(T2)}, S#fsm{peer=Peer}),
            		pipe:a(Pipe, {ssl, Peer, established}),
            		so_ioctl(Sock, S),
   		         {next_state, 'ESTABLISHED', 
  
positive.code:    _ = pipe:b(Pipe, {ssl, S#fsm.peer, {terminated, timeout}}),
     {stop, normal, S};
  
  'ESTABLISHED'(timeout_io,  Pipe, S) ->
     {next_state, 'ESTABLISHED',
        S#fsm{
           packet  = 0,
           tout_io = tempus:reset(S#fsm.tout_io, timeout_io)
        }
     };
  
  
negative.code:          {stop, Reason, S}
     end.
  
  
  %%%------------------------------------------------------------------
  %%%
  %%% private
  