anchor.diff:      fprof:stop(),
       ok.
   
  -ssl_opts(listen) ->
  -    [{backlog, 500} | ssl_opts("server")];
  -ssl_opts(connect) ->
  -    [{verify, verify_peer} | ssl_opts("client")];
  -ssl_opts(listen_der) ->
  -    [{backlog, 500} | ssl_opts("server_der")];
  -ssl_opts(connect_der) ->
  -    [{verify, verify_peer} | ssl_opts("client_der")];
  -ssl_opts(Role) ->
  -    CertData = cert_data(Role),
  -    Opts = [{active, false},
  -            {depth, 2},
  -            {reuseaddr, true},
  -            {mode,binary},
  -            {nodelay, true},
  -            {ciphers, [{dhe_rsa,aes_256_cbc,sha}]}
  -            |CertData],
  -    case Role of
  -        "client" ++ _ ->
  -            [{server_name_indication, disable} | Opts];
  -        "server" ++ _ ->
  -            Opts
  -    end.
  -
  -cert_data(Der) when Der =:= "server_der"; Der =:= "client_der" ->
  -    [Role,_] = string:tokens(Der, "_"),
  -    Dir = filename:join([code:lib_dir(ssl), "examples", "certs", "etc"]),
  -    {ok, CaCert0} = file:read_file(filename:join([Dir, Role, "cacerts.pem"])),
  -    {ok, Cert0} = file:read_file(filename:join([Dir, Role, "cert.pem"])),
  -    {ok, Key0} = file:read_file(filename:join([Dir, Role, "key.pem"])),
  -    [{_, Cert, _}] = public_key:pem_decode(Cert0),
  -    CaCert1 = public_key:pem_decode(CaCert0),
  -    CaCert = [CCert || {_, CCert, _} <- CaCert1],
  -    [{KeyType, Key, _}] = public_key:pem_decode(Key0),
  -    [{cert, Cert},
  -     {cacerts, CaCert},
  -     {key, {KeyType, Key}}];
  -cert_data(Role) ->
  -    Dir = filename:join([code:lib_dir(ssl), "examples", "certs", "etc"]),
  -    [{cacertfile, filename:join([Dir, Role, "cacerts.pem"])},
  -     {certfile, filename:join([Dir, Role, "cert.pem"])},
  -     {keyfile, filename:join([Dir, Role, "key.pem"])}].
  +ssl_opts(listen, Opts, Certs) ->
  +    [{backlog, 500} | ssl_opts(server_config, Opts, Certs)];
  +ssl_opts(connect, Opts, Certs) ->
  +    [{verify, verify_peer} | ssl_opts(client_config, Opts, Certs)];
  +ssl_opts(Role, TCOpts, Certs) ->
  +    CertData = maps:get(Role, Certs),
  +    {Version, KeyEx} =
  +        case proplists:get_value(version, TCOpts) of
  +            'tlsv1.2' = V -> {V, ecdhe_ecdsa};
  +            'tlsv1.3' = V -> {V, any}
  +        end,
  +    Opts0 = [{active, false},
  +             {depth, 2},
  +             {reuseaddr, true},
  +             {mode,binary},
  +             {nodelay, true},
  +             {versions, [Version]},
  +             {ciphers, [ #{key_exchange => KeyEx, cipher => aes_128_gcm,
  +                           mac => aead, prf => sha256}
  +                       ]}
  +            | CertData ],
  +    Opts1 = case Role of
  +                client_config -> [{server_name_indication, disable} | Opts0];
  +                server_config -> Opts0
  +            end,
  +    Opts = case proplists:get_value(no_reuse, TCOpts) of
  +               true -> [{reuse_sessions, false}|Opts1];
  +               _ -> Opts1
  +           end,
  +    Opts.
  +
  +cert_data() ->
  +    ssl_test_lib:make_cert_chains_der(ecdhe_ecdsa, []).
   
   bypass_pem_cache_supported() ->
       %% This function is currently critical to support cache bypass
  
positive.code: 
  suite() -> [{ct_hooks,[{ts_install_cth,[{nodenames,2}]}]}].
  
  all() -> [{group, basic}, {group, setup}, {group, payload}, {group, pem_cache}].
  
  groups() ->
      [{basic, [], [basic_pem_cache]},
       {setup, [{repeat, 3}], [setup_sequential, setup_concurrent]},
       {payload, [{repeat, 3}], [payload_simple]},
       {pem_cache, [{repeat, 3}], [use_pem_cache, bypass_pem_cache]}
      ].
  
  init_per_group(_GroupName, Config) ->
  
negative.code:     SPid ! quit,
      {ok, TestPerSecond}.
  
  server_init(ssl, {setup_connection, Opts}, _, _, Server, Certs) ->
      {ok, LSocket} = ssl:listen(0, ssl_opts(listen, Opts, Certs)),
      {ok, {_Host, Port}} = ssl:sockname(LSocket),
      {ok, Host} = inet:gethostname(),
      ?FPROF_SERVER andalso start_profile(fprof, [whereis(ssl_manager), new]),
  