anchor.diff:                                    password => crypto:password()
                                    }.
   -type state_name()           :: hello | abbreviated | certify | cipher | connection.
  --type gen_fsm_state_return() :: {next_state, state_name(), term()} |
  -				{next_state, state_name(), term(), timeout()} |
  -				{stop, term(), term()}.
  +
  +-type gen_fsm_state_return() :: {next_state, state_name(), any()} |
  +				{next_state, state_name(), any(), timeout()} |
  +				{stop, any(), any()}.
  +-type ssl_options()          :: #ssl_options{}.
  +
   -endif. % -ifdef(ssl_internal).
   
   
  
positive.code: -define('24H_in_sec', 86400).
  
  -record(ssl_options, {
  	  protocol    :: tls | dtls,
  	  versions    :: [ssl_record:ssl_version()], %% ssl_record:atom_version() in API
  	  verify      :: verify_none | verify_peer,
  	  verify_fun,  %%:: fun(CertVerifyErrors::term()) -> boolean(),
  	  partial_chain       :: fun(),
  	  fail_if_no_peer_cert ::  boolean(),
  	  verify_client_once   ::  boolean(),
  	  %% fun(Extensions, State, Verify, AccError) ->  {Extensions, State, AccError}
  	  validate_extensions_fun, 
  	  depth                :: integer(),
  	  certfile             :: binary(),
  	  cert                 :: public_key:der_encoded() | secret_printout() | 'undefined',
  	  keyfile              :: binary(),
  	  key	               :: {'RSAPrivateKey' | 'DSAPrivateKey' | 'ECPrivateKey' | 'PrivateKeyInfo', 
                                     public_key:der_encoded()} | key_map() | secret_printout() | 'undefined',
  	  password	       :: string() | secret_printout() | 'undefined',
  	  cacerts              :: [public_key:der_encoded()] | secret_printout() | 'undefined',
  	  cacertfile           :: binary(),
  	  dh                   :: public_key:der_encoded() | secret_printout(),
  	  dhfile               :: binary() | secret_printout() | 'undefined',
  	  user_lookup_fun,  % server option, fun to lookup the user
  	  psk_identity         :: binary() | secret_printout() | 'undefined',
  
negative.code: 	  reuse_session        :: fun() | binary() | undefined, %% Server side is a fun()
  	  %% If false sessions will never be reused, if true they
  	  %% will be reused if possible.
  	  reuse_sessions       :: boolean() | save | 'undefined',  %% Only client side can use value save
  	  renegotiate_at,
  	  secure_renegotiate,
  	  client_renegotiation,
  	  %% undefined if not hibernating, or number of ms of
  	  %% inactivity after which ssl_connection will go into
  	  %% hibernation
  	  hibernate_after      :: timeout() | 'undefined',
  	  %% This option should only be set to true by inet_tls_dist
  	  erl_dist = false     :: boolean(),
            alpn_advertised_protocols = undefined :: [binary()] | undefined,
            alpn_preferred_protocols = undefined  :: [binary()] | undefined,
  	  next_protocols_advertised = undefined :: [binary()] | undefined,
  	  next_protocol_selector = undefined,  %% fun([binary()]) -> binary())
  	  log_alert             :: boolean(),
  	  server_name_indication = undefined,
  	  sni_hosts  :: [{inet:hostname(), [tuple()]}] | 'undefined',
  	  sni_fun :: function() | undefined,
  	  %% Should the server prefer its own cipher order over the one provided by
  	  %% the client?
  