anchor.diff:      2 = get_total_counter(),
       [6, 6, 2, 2] = get_table_sizes(),
       [{pem_cache, PemCacheData0}, {cert, CertData0}, {ca_ref_cnt, CaRefCntData0},
  -     {ca_file_ref, CaFileRefData0}] = get_tables(),
  +                  {ca_file_ref, CaFileRefData0}] = get_tables(),
   
       ssl:clear_pem_cache(),
       _ = sys:get_status(whereis(ssl_manager)),
       [0, 6, 2, 2] = get_table_sizes(),
  -    [{pem_cache, PemCacheData1}, {cert, CertData0}, {ca_ref_cnt, CaRefCntData0},
  -     {ca_file_ref, CaFileRefData0}] = get_tables(),
  -    [true = lists:member(Row, PemCacheData0) || Row <- PemCacheData1],
  -
  +    check_tables([{pem_cache, []}, {cert, CertData0},
  +                  {ca_ref_cnt, CaRefCntData0}, {ca_file_ref, CaFileRefData0}]),
       {Server1, Client1} = basic_verify_test_no_close(Config),
       4 = get_total_counter(),
       [4, 6, 2, 2] = get_table_sizes(),
  -    [{pem_cache, PemCacheData2}, {cert, CertData0}, {ca_ref_cnt, _CaRefCntData1},
  -     {ca_file_ref, CaFileRefData0}] = get_tables(),
  +    [{pem_cache, PemCacheData2}, _, {ca_ref_cnt, CaRefCntData2}, _] = get_tables(),
  +    check_tables([{pem_cache, PemCacheData2}, {cert, CertData0},
  +                  {ca_ref_cnt, CaRefCntData2}, {ca_file_ref, CaFileRefData0}]),
       [true = lists:member(Row, PemCacheData0) || Row <- PemCacheData2],
   
       [ssl_test_lib:close(A) || A <- [Server, Client]],
  
positive.code:     end.
  
  get_tables() ->
      [{Id, get_table(T, Id)} || {Id, T} <- get_table_refs()].
  
  get_table(TableRef, Id) ->
      get_table(TableRef, Id, ets:first(TableRef), []).
  
  get_table(TableRef, Id, Key, Acc) ->
      case Key of
          '$end_of_table' ->
              Acc;
          _ ->
              get_table(TableRef, Id, ets:next(TableRef, Key),
                        [ets:lookup(TableRef, Key) | Acc])
      end.
  
  new_root_pem_helper(Config, CleanMode,
                     #{init := Init, connected1 := Connected1, cleaned := Cleaned,
                      connected2 := Connected2, disconnected1 := Disconnected1,
                      disconnected2 := Disconnected2} = _ExpectedStats, AccessMode) ->
      %% ExpectedStats map passed to function contains expected sizes of tables
      %% holding various cert, cacert, keyfile data.
      %% Init - represents initial state
      %% ConnectedN - state after establishing Nth connection
      %% Cleaned - state after periodical cleanup
      %% DisconnectedN - state after closing Nth connection
      {SCAFile, ClientConf0, ServerConf, OrgSRoot, ClientBase, ServerBase} =
          create_initial_config(Config),
  
      TryLink =
          fun(MakeLink, Conf0) ->
                  CACertfilePath = proplists:get_value(cacertfile, Conf0),
                  case MakeLink(CACertfilePath) of
                      {ok, LinkPath} ->
                           [{cacertfile, LinkPath} | proplists:delete(cacertfile, Conf0)];
                      {skip, Reason} ->
                          [{skip, Reason}]
                  end
          end,
      ClientConf = case AccessMode of
                       direct -> ClientConf0;
                       hardlink->
                           TryLink(fun make_hardlink/1, ClientConf0);
                       symlink->
                           TryLink(fun make_symlink/1, ClientConf0)
                   end,
  
      case proplists:lookup(skip, ClientConf) of
          none ->
              {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
              Init = get_table_sizes(),
              {Client0, Server0} =
                  make_connection_check_cert(OrgSRoot, ClientNode, ClientConf,
                                             ServerNode, ServerConf, Hostname, SCAFile),
              Connected1 = get_table_sizes(),
              [{pem_cache, PemCacheData0}, {cert, CertData0}, {ca_ref_cnt, CaRefCntData0},
               {ca_file_ref, CaFileRefData0}] = get_tables(),
  
              NewCert = overwrite_files_with_new_configuration(OrgSRoot, ClientBase, ServerBase),
              Connected1 = get_table_sizes(),
              [{pem_cache, PemCacheData0}, {cert, CertData0}, {ca_ref_cnt, CaRefCntData0},
               {ca_file_ref, CaFileRefData0}] = get_tables(),
  
              case CleanMode of
                  manual -> ssl:clear_pem_cache();
                  periodical -> ct:sleep(round(1.5 * ?CLEANUP_INTERVAL));
  
negative.code:     ExpectedStats = #{init => [0, 0, 0, 0], connected1 => [6, 6, 2, 2],
                        cleaned => [0, 6, 2, 2], connected2 => [4, 6, 2, 2],
                        disconnected1 => [4, 6, 2, 2], disconnected2 => [4,0,0,0]},
      new_root_pem_helper(Config, periodical, ExpectedStats, fun identity/1),
      %% verify also same key sequence for initial and overwritten certs PEM files
      new_root_pem_helper(Config, periodical, ExpectedStats, fun identity/1, 5).
  
  new_root_pem_no_cleanup() ->
      [{doc, "Test that changed PEM-files on disk not followed by any cleanup"
        " will not be used for making connection."
        "This test case recreates a PEM file, resulting with its actual content change."}].
  new_root_pem_no_cleanup(Config) when is_list(Config) ->
      ExpectedStats = #{init => [0, 0, 0, 0], connected1 => [6, 6, 2, 2],
                        cleaned => [6, 6, 2, 2], connected2 => [6, 6, 2, 2],
                        disconnected1 => [6, 6, 2, 2], disconnected2 => [6,0,0,0]},
      new_root_pem_helper(Config, no_cleanup, ExpectedStats, fun identity/1).
  
  new_root_pem_no_cleanup_symlink() ->
      [{doc, "Test that changed PEM-files on disk not followed by any cleanup"
        " will not be used for making connection - even with symlink. "
        "This test case recreates a PEM file, resulting with its actual content change."}].
  new_root_pem_no_cleanup_symlink(Config) when is_list(Config) ->
      ExpectedStats = #{init => [0, 0, 0, 0], connected1 => [6, 6, 2, 2],
                        cleaned => [6, 6, 2, 2], connected2 => [6, 6, 2, 2],
                        disconnected1 => [6, 6, 2, 2], disconnected2 => [6,0,0,0]},
      new_root_pem_helper(Config, no_cleanup, ExpectedStats, fun make_symlink/1).
  
  new_root_pem_no_cleanup_hardlink() ->
      [{doc, "Test that changed PEM-files on disk not followed by any cleanup"
        " will not be used for making connection - even with hardlink. "
        "This test case recreates a PEM file, resulting with its actual content change."}].
  new_root_pem_no_cleanup_hardlink(Config) when is_list(Config) ->
      ExpectedStats = #{init => [0, 0, 0, 0], connected1 => [6, 6, 2, 2],
                        cleaned => [6, 6, 2, 2], connected2 => [6, 6, 2, 2],
                        disconnected1 => [6, 6, 2, 2], disconnected2 => [6,0,0,0]},
      new_root_pem_helper(Config, no_cleanup, ExpectedStats, fun make_hardlink/1).
  
  alternative_path_hardlink() ->
      [{doc,"Test that internal reference table contains expected data for"
  