anchor.diff:      (unless ssl-ctx
         ;; calling this explicitly here since
         ;; we want to create context before any call to make-ssl-client-stream
  -      (cl+ssl::ensure-initialized)
  -      (setf ssl-ctx (cl+ssl::ssl-ctx-new (cl+ssl::ssl-tlsv1-client-method)))
  -      (cl+ssl::ssl-ctx-set-session-cache-mode ssl-ctx cl+ssl::+ssl-sess-cache-client+)
  -      (add-verify-files ssl-ctx (merge-pathnames #p"data/trusted-certs.crt"))
  -      (cl+ssl::ssl-ctx-set-verify-depth ssl-ctx 100)
  -      (cl+ssl::ssl-ctx-set-verify ssl-ctx cl+ssl::+SSL-VERIFY-PEER+ (cffi:callback cl+ssl::cb-ssl-verify))
  -      (cffi:with-foreign-string (ciphers (format nil
  +      (handler-bind ((error #'(lambda (c) (declare (ignore c)) (setf ssl-ctx nil))))
  +        (cl+ssl::ensure-initialized)
  +        (setf ssl-ctx (cl+ssl::ssl-ctx-new (cl+ssl::ssl-tlsv1-client-method)))
  +        (cl+ssl::ssl-ctx-set-session-cache-mode ssl-ctx cl+ssl::+ssl-sess-cache-client+)
  +        (add-verify-files ssl-ctx (merge-pathnames #p"data/trusted-certs.crt" (asdf:component-pathname (asdf:find-system :cl-dropbox))))
  +        (cl+ssl::ssl-ctx-set-verify-depth ssl-ctx 100)
  +        (cl+ssl::ssl-ctx-set-verify ssl-ctx cl+ssl::+SSL-VERIFY-PEER+ (cffi:callback cl+ssl::cb-ssl-verify))
  +        (ssl-ctx-set-cipher-list ssl-ctx (format nil
                                                    "ECDHE-RSA-AES256-GCM-SHA384:~
                                                     ECDHE-RSA-AES256-SHA384:~
                                                     ECDHE-RSA-AES256-SHA:~
  
positive.code: 
  (in-package :cl-dropbox.ssl)
  
  (define-condition ssl-load-vertify-location (cl+ssl::ssl-error)
    ((location :initarg :locations))
    (:report (lambda (condition stream)
               (format stream "Unable to load verify location ~A" (slot-value condition 'location)))))
  
  (defun add-verify-files% (ssl-ctx files)
    (dolist (file files)
      (let ((namestring (if (pathnamep file) (namestring (truename file)) file)))
        (cffi:with-foreign-strings ((cafile namestring))
          (unless (eql 1 (cl+ssl::ssl-ctx-load-verify-locations
                          ssl-ctx
                          cafile
                          (cffi:null-pointer)))
            (error 'ssl-load-vertify-location :location cafile))))))
  
  (defun add-verify-files (ssl-ctx files)
    (cond
  
negative.code:                                                   AES128-GCM-SHA256:~
                                                    AES128-SHA256:~
                                                    AES128-SHA"))
          ;; TODO more session handling
          ))
      ssl-ctx))
  