anchor.diff:     _ = pipe:b(Pipe, {ssl, S#fsm.peer, {terminated, timeout}}),
      {stop, normal, S};
   
  -'ESTABLISHED'(timeout_io,  Pipe, S) ->
  +'ESTABLISHED'(timeout_io,  _Pipe, S) ->
      {next_state, 'ESTABLISHED',
         S#fsm{
            packet  = 0,
            tout_io = tempus:reset(S#fsm.tout_io, timeout_io)
  +      }
  +   };
  +
  +'ESTABLISHED'({ssl_cert, ca, Cert}, _Pipe, S) ->
  +   {next_state, 'ESTABLISHED', 
  +      S#fsm{
  +         cert = [Cert | S#fsm.cert]
  +      }
  +   };
  +
  +'ESTABLISHED'({ssl_cert, peer, Cert}, _Pipe, S) ->
  +   Pckt = [public_key:pkix_encode('OTPCertificate', X, otp) || X <- [Cert | S#fsm.cert]],
  +   so_stats({packet, 0, erlang:iolist_size(Pckt)}, S),
  +   {next_state, 'ESTABLISHED', 
  +      S#fsm{
  +         cert = [Cert | S#fsm.cert]
         }
      };
   
  
positive.code:          {stop, Reason, S}
     end.
  
  %%%------------------------------------------------------------------
  %%%
  %%% private
  
negative.code:    sock :: port(),  % ssl socket
     peer :: any(),   % peer address  
     addr :: any(),   % local address
     cert :: [any()], % list of certificates
  
     % socket options
     topt        = undefined   :: list(),              %% list of tcp socket opts
  