anchor.diff:  
   
   
  -add_options(Options, {ok, CaChainFile}, DhFile, Hostname, IPv6) ->
  -    NewOptions = [ {cacertfile, CaChainFile} | Options ],
  -    add_options(NewOptions, ok, DhFile, Hostname, IPv6);
  -add_options(Options, undefined, DhFile, Hostname, IPv6) ->
  -    lager:warning("Init: no ca-chain-file configured [cachain_file]!"),
  -    add_options(Options, ok, DhFile, Hostname, IPv6);
  -add_options(Options, CaChainFile,  {ok, none}, Hostname, IPv6) ->
  -    lager:warning("Init: no dh-file configured [dh_file]!"),
  -    add_options(Options, CaChainFile, ok, Hostname, IPv6);
  -add_options(Options, CaChainFile,  undefined, Hostname, IPv6) ->
  -    lager:warning("Init: no dh-file configured [dh_file]!"),
  -    add_options(Options, CaChainFile, ok, Hostname, IPv6);
  -add_options(Options, CaChainFile, {ok, DhFile}, Hostname, IPv6) ->
  -    NewOptions = [ {dhfile, DhFile} | Options ],
  -    add_options(NewOptions, CaChainFile, ok, Hostname, IPv6);
  -add_options(Options, CaChainFile, DhFile, {ok, Hostname}, IPv6) ->
  +add_options(Options, {ok, CaChain}, DhParam, Hostname, IPv6) ->
  +    NewOptions = [ {cacerts, CaChain} | Options ],
  +    add_options(NewOptions, ok, DhParam, Hostname, IPv6);
  +add_options(Options, undefined, DhParam, Hostname, IPv6) ->
  +    add_options(Options, ok, DhParam, Hostname, IPv6);
  +add_options(Options, CaChain,  undefined, Hostname, IPv6) ->
  +    add_options(Options, CaChain, ok, Hostname, IPv6);
  +add_options(Options, CaChain, {ok, DhParam}, Hostname, IPv6) ->
  +    NewOptions = [ {dh, DhParam} | Options ],
  +    add_options(NewOptions, CaChain, ok, Hostname, IPv6);
  +add_options(Options, CaChain, DhParam, {ok, Hostname}, IPv6) ->
       NewOptions =
           case {lists:suffix(".onion", Hostname), IPv6} of
               {true, true} ->
  
positive.code:     oidcc_client:register(watts_oidc_client),
      Dispatch = cowboy_router:compile([{'_', create_dispatch_list()}]),
      SSL = ?CONFIG(ssl),
      ListenPort = ?CONFIG(listen_port),
      case SSL of
          true ->
              CertFile = ?CONFIG(cert_file),
              KeyFile = ?CONFIG(key_file),
              BasicOptions =
                  [ {port, ListenPort},
                    {certfile, CertFile},
                    {keyfile, KeyFile}
                  ],
              Options = add_options(BasicOptions, ?CONFIG_(cachain_file),
                                    ?CONFIG_(dh_file), ?CONFIG_(hostname),
                                    ?CONFIG_(enable_ipv6)),
              {ok, _} = cowboy:start_https( http_handler
                                            , ?CONFIG(num_acceptors)
  
negative.code:     end,
  
      ok.
  
  read_ssl_files(true) ->
      CertOK = read_certificate(?CONFIG_(cert_file)),
      KeyOK = read_key(?CONFIG_(key_file)),
      ChainOK = read_cachain(?CONFIG_(cachain_file)),
      DhOK = read_dhparam(?CONFIG_(dh_file)),
      CertOK and KeyOK and ChainOK and DhOK;
  read_ssl_files(_) ->
      false.
  
  
  read_certificate({ok, Path}) ->
      case read_pem_entries(Path) of
          [Certificate] ->
              ?SETCONFIG(cert, Certificate),
              true;
          _ ->
              lager:error("Init: certificate ~p invalid", [Path]),
              false
      end;
  read_certificate(_) ->
      false.
  
  read_key({ok, Path}) ->
      case read_pem_entries(Path) of
          [PrivateKey] ->
              ?SETCONFIG(key, PrivateKey),
              true;
          _ ->
              lager:error("Init: private key ~p invalid", [Path]),
              false
      end;
  read_key(_) ->
      false.
  
  read_cachain({ok, Path}) ->
      case read_pem_entries(Path) of
          [] ->
              lager:error("Init: ca chain ~p is empty", [Path]),
              false;
          Certs ->
              ?SETCONFIG(cachain, Certs),
              true
      end;
  read_cachain(_) ->
      lager:warning("Init: no ca-chain-file configured [cachain_file]!"),
      ?SETCONFIG(cachain, []),
      true.
  
  read_dhparam({ok, none}) ->
      lager:warning("Init: no dh-file configured [dh_file]!"),
      ?SETCONFIG(dhparam, none),
      true;
  read_dhparam({ok, Path}) ->
      case read_pem_entries(Path) of
          [DhParam] ->
              ?SETCONFIG(dhparam, DhParam),
              true;
          _ ->
              lager:error("Init: dh-file ~p is invalid", [Path]),
              false
      end;
  read_dhparam(_) ->
      lager:warning("Init: no dh-file configured [dh_file]!"),
      ?SETCONFIG(dhparam, none),
      true.
  
  read_pem_entries(Path) ->
      extract_pem(file:read_file(Path), Path).
  
  extract_pem({ok, PemBin}, _) ->
      public_key:pem_decode(PemBin);
  extract_pem(Error, Path) ->
      lager:error("Init: error reading file ~p: ~p", [Path, Error]),
      [].
  
  
  
  create_dispatch_list() ->
      EpMain = ?CONFIG(ep_main),
  