anchor.diff:                                    password => crypto:password()
                                    }.
   -type state_name()           :: hello | abbreviated | certify | cipher | connection.
  --type gen_fsm_state_return() :: {next_state, state_name(), term()} |
  -				{next_state, state_name(), term(), timeout()} |
  -				{stop, term(), term()}.
  +
  +-type gen_fsm_state_return() :: {next_state, state_name(), any()} |
  +				{next_state, state_name(), any(), timeout()} |
  +				{stop, any(), any()}.
  +-type ssl_options()          :: #ssl_options{}.
  +
   -endif. % -ifdef(ssl_internal).
   
   
  
positive.code: -define('24H_in_sec', 86400).
  
  -record(ssl_options, {
  	  protocol    :: tls | dtls,
  	  versions    :: [ssl_record:ssl_version()], %% ssl_record:atom_version() in API
  	  verify      :: verify_none | verify_peer,
  	  verify_fun,  %%:: fun(CertVerifyErrors::term()) -> boolean(),
  	  partial_chain       :: fun(),
  	  fail_if_no_peer_cert ::  boolean(),
  	  verify_client_once   ::  boolean(),
  	  %% fun(Extensions, State, Verify, AccError) ->  {Extensions, State, AccError}
  	  validate_extensions_fun, 
  	  depth                :: integer(),
  	  certfile             :: binary(),
  	  cert                 :: public_key:der_encoded() | secret_printout() | 'undefined',
  	  keyfile              :: binary(),
  	  key	               :: {'RSAPrivateKey' | 'DSAPrivateKey' | 'ECPrivateKey' | 'PrivateKeyInfo', 
                                     public_key:der_encoded()} | key_map() | secret_printout() | 'undefined',
  	  password	       :: string() | secret_printout() | 'undefined',
  	  cacerts              :: [public_key:der_encoded()] | secret_printout() | 'undefined',
  	  cacertfile           :: binary(),
  	  dh                   :: public_key:der_encoded() | secret_printout(),
  	  dhfile               :: binary() | secret_printout() | 'undefined',
  	  user_lookup_fun,  % server option, fun to lookup the user
  	  psk_identity         :: binary() | secret_printout() | 'undefined',
  
negative.code: 	  %%mitigation entirely?
  	  beast_mitigation = one_n_minus_one :: one_n_minus_one | zero_n | disabled,
  	  fallback = false           :: boolean(),
  	  crl_check                  :: boolean() | peer | best_effort | 'undefined',
  	  crl_cache,
  	  signature_algs,
  	  eccs,
  