anchor.diff:  	  %%mitigation entirely?
   	  beast_mitigation = one_n_minus_one :: one_n_minus_one | zero_n | disabled,
   	  fallback = false           :: boolean(),
  -	  crl_check                  :: boolean() | peer | best_effort, 
  +	  crl_check                  :: boolean() | peer | best_effort | 'undefined',
   	  crl_cache,
   	  signature_algs,
   	  signature_algs_cert,
   	  eccs,
   	  supported_groups,  %% RFC 8422, RFC 8446
  -	  honor_ecc_order            :: boolean(),
  -          max_handshake_size         :: integer(),
  +	  honor_ecc_order            :: boolean() | 'undefined',
  +          max_handshake_size         :: integer() | 'undefined',
             handshake,
             customize_hostname_check
       %%                 ,
  
positive.code: 	  reuse_session        :: fun() | binary() | undefined, %% Server side is a fun()
  	  %% If false sessions will never be reused, if true they
  	  %% will be reused if possible.
  	  reuse_sessions       :: boolean() | save,  %% Only client side can use value save
  	  renegotiate_at,
  	  secure_renegotiate,
  	  client_renegotiation,
  	  %% undefined if not hibernating, or number of ms of
  	  %% inactivity after which ssl_connection will go into
  	  %% hibernation
  	  hibernate_after      :: timeout(),          
  	  %% This option should only be set to true by inet_tls_dist
  	  erl_dist = false     :: boolean(),
            alpn_advertised_protocols = undefined :: [binary()] | undefined ,
            alpn_preferred_protocols = undefined  :: [binary()] | undefined,
  	  next_protocols_advertised = undefined :: [binary()] | undefined,
  	  next_protocol_selector = undefined,  %% fun([binary()]) -> binary())
  	  log_level = notice :: atom(),
  	  server_name_indication = undefined,
  	  sni_hosts  :: [{inet:hostname(), [tuple()]}],
  	  sni_fun :: function() | undefined,
  	  %% Should the server prefer its own cipher order over the one provided by
  	  %% the client?
  
negative.code: -define(VSN, "8.2.6").
  -define(SECRET_PRINTOUT, "***").
  
  -type reason()            :: any().
  -type reply()             :: any().
  -type msg()               :: any().
  -type from()              :: any().
  -type certdb_ref()        :: reference().
  -type db_handle()         :: any().
  -type der_cert()          :: binary().
  -type issuer()            :: tuple().
  -type serialnumber()      :: integer().
  