First cut for a very conservative source tree cleanup:

1. merge various obsolete readme texts into doc/ssleay.txt
   where we collect the old documents and readme texts.

2. remove the first part of files where I'm already sure that we no longer need
   them because of three reasons: either they are just temporary files which
   were left by Eric or they are preserved original files where I've verified
   that the diff is also available in the CVS via "cvs diff -rSSLeay_0_8_1b"
   or they were renamed (as it was definitely the case for the crypto/md/
   stuff).

We've still a horrible mess under crypto/bn/asm/.  There for a lot of files
I'm sure whether we need them or not. So, when someone knows it better, feel
free to cleanup there.

5 files changed, 0 insertions, 761 deletions

diff --git a/ssl/KEYS b/ssl/KEYS
deleted file mode 100644
index 710d102324..0000000000
--- a/ssl/KEYS
+++ /dev/null
@@ -1,28 +0,0 @@
-EVP_PKEY_DSA
-EVP_PKEY_DSA2
-EVP_PKEY_DSA3
-EVP_PKEY_DSA4
-
-EVP_PKEY_RSA
-EVP_PKEY_RSA2
-
-valid DSA pkey types
-	NID_dsa
-	NID_dsaWithSHA
-	NID_dsaWithSHA1
-	NID_dsaWithSHA1_2
-
-valid RSA pkey types
-	NID_rsaEncryption
-	NID_rsa
-
-NID_dsaWithSHA	NID_dsaWithSHA			DSA		SHA
-NID_dsa		NID_dsaWithSHA1			DSA		SHA1
-NID_md2		NID_md2WithRSAEncryption	RSA-pkcs1	MD2
-NID_md5		NID_md5WithRSAEncryption	RSA-pkcs1	MD5
-NID_mdc2	NID_mdc2WithRSA			RSA-none	MDC2
-NID_ripemd160	NID_ripemd160WithRSA		RSA-pkcs1	RIPEMD160
-NID_sha		NID_shaWithRSAEncryption	RSA-pkcs1	SHA
-NID_sha1	NID_sha1WithRSAEncryption	RSA-pkcs1	SHA1
-:w
-
diff --git a/ssl/bio_ssl.orig.c b/ssl/bio_ssl.orig.c
deleted file mode 100644
index 25147d12e7..0000000000
--- a/ssl/bio_ssl.orig.c
+++ /dev/null
@@ -1,440 +0,0 @@
-/* ssl/bio_ssl.c */
-/* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#include "bio.h"
-#include "err.h"
-#include "ssl.h"
-
-#ifndef NOPROTO
-static int ssl_write(BIO *h,char *buf,int num);
-static int ssl_read(BIO *h,char *buf,int size);
-static int ssl_puts(BIO *h,char *str);
-static long ssl_ctrl(BIO *h,int cmd,long arg1,char *arg2);
-static int ssl_new(BIO *h);
-static int ssl_free(BIO *data);
-#else
-static int ssl_write();
-static int ssl_read();
-static int ssl_puts();
-static long ssl_ctrl();
-static int ssl_new();
-static int ssl_free();
-#endif
-
-static BIO_METHOD methods_sslp=
-	{
-	BIO_TYPE_SSL,"ssl",
-	ssl_write,
-	ssl_read,
-	ssl_puts,
-	NULL, /* ssl_gets, */
-	ssl_ctrl,
-	ssl_new,
-	ssl_free,
-	};
-
-BIO_METHOD *BIO_f_ssl()
-	{
-	return(&methods_sslp);
-	}
-
-static int ssl_new(bi)
-BIO *bi;
-	{
-	bi->init=0;
-	bi->ptr=NULL;	/* The SSL structure */
-	bi->flags=0;
-	return(1);
-	}
-
-static int ssl_free(a)
-BIO *a;
-	{
-	if (a == NULL) return(0);
-	if (a->ptr != NULL) SSL_shutdown((SSL *)a->ptr);
-	if (a->shutdown)
-		{
-		if (a->init) SSL_free((SSL *)a->ptr);
-		a->init=0;
-		a->flags=0;
-		a->ptr=NULL;
-		}
-	return(1);
-	}
-	
-static int ssl_read(b,out,outl)
-BIO *b;
-char *out;
-int outl;
-	{
-	int ret=1,dr,dw;
-	int inflags,outflags;
-	SSL *ssl;
-	int retry_reason=0;
-
-	if (out == NULL) return(0);
-	ssl=(SSL *)b->ptr;
-
-	inflags=outflags=b->flags;
-
-	dr=inflags&BIO_FLAGS_PROTOCOL_DELAYED_READ;
-	dw=inflags&BIO_FLAGS_PROTOCOL_DELAYED_WRITE;
-
-	outflags&= ~(BIO_FLAGS_RWS|BIO_FLAGS_SHOULD_RETRY|
-		BIO_FLAGS_PROTOCOL_DELAYED_WRITE|
-		BIO_FLAGS_PROTOCOL_DELAYED_READ);
-
-	if (!SSL_is_init_finished(ssl))
-		{
-		ret=SSL_do_handshake(ssl);
-#if 0
-		if (ret > 0)
-			{
-			outflags=(BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY|
-				BIO_FLAGS_PROTOCOL_DELAYED_READ|dw);
-			ret= -1;
-			goto end;
-			}
-#endif
-		}
-	if (ret > 0)
-		ret=SSL_read(ssl,out,outl);
-
-	switch (SSL_get_error(ssl,ret))
-		{
-	case SSL_ERROR_NONE:
-		if (ret <= 0) break;
-		if (dw)
-			outflags|=(BIO_FLAGS_WRITE|BIO_FLAGS_SHOULD_RETRY);
-		break;
-	case SSL_ERROR_WANT_READ:
-		outflags=(BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY|
-			BIO_FLAGS_PROTOCOL_DELAYED_READ|dw);
-		break;
-	case SSL_ERROR_WANT_WRITE:
-		outflags=(BIO_FLAGS_WRITE|BIO_FLAGS_SHOULD_RETRY|
-			BIO_FLAGS_PROTOCOL_DELAYED_READ|dw);
-		break;
-	case SSL_ERROR_WANT_X509_LOOKUP:
-		outflags=(BIO_FLAGS_IO_SPECIAL|BIO_FLAGS_SHOULD_RETRY|
-			BIO_FLAGS_PROTOCOL_DELAYED_READ|dw);
-		retry_reason=BIO_RR_SSL_X509_LOOKUP;
-		break;
-	case SSL_ERROR_WANT_CONNECT:
-		outflags=(BIO_FLAGS_IO_SPECIAL|BIO_FLAGS_SHOULD_RETRY|
-			BIO_FLAGS_PROTOCOL_DELAYED_READ|dw);
-		retry_reason=BIO_RR_CONNECT;
-		break;
-	case SSL_ERROR_SYSCALL:
-	case SSL_ERROR_SSL:
-	case SSL_ERROR_ZERO_RETURN:
-	default:
-		break;
-		}
-
-	b->retry_reason=retry_reason;
-	b->flags=outflags;
-	return(ret);
-	}
-
-static int ssl_write(b,out,outl)
-BIO *b;
-char *out;
-int outl;
-	{
-	int ret,dr,dw;
-	int inflags,outflags,retry_reason=0;
-	SSL *ssl;
-
-	if (out == NULL) return(0);
-	ssl=(SSL *)b->ptr;
-
-	inflags=outflags=b->flags;
-
-	dr=inflags&BIO_FLAGS_PROTOCOL_DELAYED_READ;
-	dw=inflags&BIO_FLAGS_PROTOCOL_DELAYED_WRITE;
-
-	outflags&= ~(BIO_FLAGS_RWS|BIO_FLAGS_SHOULD_RETRY|
-		BIO_FLAGS_PROTOCOL_DELAYED_WRITE|
-		BIO_FLAGS_PROTOCOL_DELAYED_READ);
-
-	ret=SSL_do_handshake(ssl);
-	if (ret > 0)
-		ret=SSL_write(ssl,out,outl);
-
-	switch (SSL_get_error(ssl,ret))
-		{
-	case SSL_ERROR_NONE:
-		if (ret <= 0) break;
-		if (dr)
-			outflags|=(BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY);
-		break;
-	case SSL_ERROR_WANT_WRITE:
-		outflags=(BIO_FLAGS_WRITE|BIO_FLAGS_SHOULD_RETRY|
-			BIO_FLAGS_PROTOCOL_DELAYED_WRITE|dr);
-		break;
-	case SSL_ERROR_WANT_READ:
-		outflags=(BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY|
-			BIO_FLAGS_PROTOCOL_DELAYED_WRITE|dr);
-		break;
-	case SSL_ERROR_WANT_X509_LOOKUP:
-		outflags=(BIO_FLAGS_IO_SPECIAL|BIO_FLAGS_SHOULD_RETRY|
-			BIO_FLAGS_PROTOCOL_DELAYED_WRITE|dr);
-		retry_reason=BIO_RR_SSL_X509_LOOKUP;
-		break;
-	case SSL_ERROR_WANT_CONNECT:
-		outflags=(BIO_FLAGS_IO_SPECIAL|BIO_FLAGS_SHOULD_RETRY|
-			BIO_FLAGS_PROTOCOL_DELAYED_READ|dw);
-		retry_reason=BIO_RR_CONNECT;
-	case SSL_ERROR_SYSCALL:
-	case SSL_ERROR_SSL:
-	default:
-		break;
-		}
-
-	b->retry_reason=retry_reason;
-	b->flags=outflags;
-	return(ret);
-	}
-
-static long ssl_ctrl(b,cmd,num,ptr)
-BIO *b;
-int cmd;
-long num;
-char *ptr;
-	{
-	SSL **sslp,*ssl;
-	BIO *dbio,*bio;
-	long ret=1;
-
-	ssl=(SSL *)b->ptr;
-	switch (cmd)
-		{
-	case BIO_CTRL_RESET:
-		SSL_shutdown(ssl);
-
-		if (ssl->handshake_func == ssl->method->ssl_connect)
-			SSL_set_connect_state(ssl);
-		else if (ssl->handshake_func == ssl->method->ssl_accept)
-			SSL_set_accept_state(ssl);
-
-		SSL_clear(ssl);
-
-		if (b->next_bio != NULL)
-			ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
-		else if (ssl->rbio != NULL)
-			ret=BIO_ctrl(ssl->rbio,cmd,num,ptr);
-		else
-			ret=1;
-		break;
-	case BIO_CTRL_EOF:
-	case BIO_CTRL_INFO:
-		ret=0;
-		break;
-	case BIO_C_SSL_MODE:
-		if (num) /* client mode */
-			SSL_set_connect_state(ssl);
-		else
-			SSL_set_accept_state(ssl);
-		break;
-	case BIO_C_SET_SSL:
-		ssl_free(b);
-		b->shutdown=(int)num;
-		b->ptr=ptr;
-		ssl=(SSL *)ptr;
-		bio=SSL_get_rbio(ssl);
-		if (bio != NULL)
-			{
-			if (b->next_bio != NULL)
-				BIO_push(bio,b->next_bio);
-			b->next_bio=bio;
-			}
-		b->init=1;
-		break;
-	case BIO_C_GET_SSL:
-		if (ptr != NULL)
-			{
-			sslp=(SSL **)ptr;
-			*sslp=ssl;
-			}
-		break;
-	case BIO_CTRL_GET_CLOSE:
-		ret=b->shutdown;
-		break;
-	case BIO_CTRL_SET_CLOSE:
-		b->shutdown=(int)num;
-		break;
-	case BIO_CTRL_WPENDING:
-		ret=BIO_ctrl(ssl->wbio,cmd,num,ptr);
-		break;
-	case BIO_CTRL_PENDING:
-		ret=SSL_pending(ssl);
-		if (ret == 0)
-			ret=BIO_pending(ssl->rbio);
-		break;
-	case BIO_CTRL_FLUSH:
-		BIO_clear_retry_flags(b);
-		ret=BIO_ctrl(ssl->wbio,cmd,num,ptr);
-		BIO_copy_next_retry(b);
-		break;
-	case BIO_CTRL_PUSH:
-		if (b->next_bio != NULL)
-			{
-			SSL_set_bio(ssl,b->next_bio,b->next_bio);
-			b->next_bio->references++;
-			}
-		break;
-	case BIO_CTRL_POP:
-		/* ugly bit of a hack */
-		if (ssl->rbio != ssl->wbio) /* we are in trouble :-( */
-			{
-			BIO_free_all(ssl->wbio);
-			}
-		ssl->wbio=NULL;
-		ssl->rbio=NULL;
-		break;
-	case BIO_C_DO_STATE_MACHINE:
-		BIO_clear_retry_flags(b);
-
-		b->retry_reason=0;
-		ret=(int)SSL_do_handshake(ssl);
-
-		switch (SSL_get_error(ssl,ret))
-			{
-		case SSL_ERROR_WANT_READ:
-			BIO_set_flags(b,
-				BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY);
-			break;
-		case SSL_ERROR_WANT_WRITE:
-			BIO_set_flags(b,
-				BIO_FLAGS_WRITE|BIO_FLAGS_SHOULD_RETRY);
-			break;
-		case SSL_ERROR_WANT_CONNECT:
-			BIO_set_flags(b,
-				BIO_FLAGS_IO_SPECIAL|BIO_FLAGS_SHOULD_RETRY);
-			b->retry_reason=b->next_bio->retry_reason;
-			break;
-		default:
-			break;
-			}
-		break;
-	case BIO_CTRL_DUP:
-		dbio=(BIO *)ptr;
-		if (dbio->ptr != NULL)
-			SSL_free((SSL *)dbio->ptr);
-		dbio->ptr=(char *)SSL_dup(ssl);
-		ret=(dbio->ptr != NULL);
-		break;
-	default:
-		return(0);
-		break;
-		}
-	return(ret);
-	}
-
-static int ssl_puts(bp,str)
-BIO *bp;
-char *str;
-	{
-	int n,ret;
-
-	n=strlen(str);
-	ret=BIO_write(bp,str,n);
-	return(ret);
-	}
-
-BIO *BIO_new_ssl(ctx,client)
-SSL_CTX *ctx;
-int client;
-	{
-	BIO *ret;
-	SSL *ssl;
-
-	if ((ret=BIO_new(BIO_f_ssl())) == NULL)
-		return(NULL);
-	if ((ssl=SSL_new(ctx)) == NULL)
-		{
-		BIO_free(ret);
-		return(NULL);
-		}
-	if (client)
-		SSL_set_connect_state(ssl);
-	else
-		SSL_set_accept_state(ssl);
-		
-	BIO_set_ssl(ret,ssl,BIO_CLOSE);
-	return(ret);
-	}
-
-int BIO_ssl_copy_session_id(t,f)
-BIO *t,*f;
-	{
-	t=BIO_find_type(t,BIO_TYPE_SSL);
-	f=BIO_find_type(f,BIO_TYPE_SSL);
-	if ((t == NULL) || (f == NULL))
-		return(0);
-	if ((t->ptr == NULL) || (f->ptr == NULL))
-		return(0);
-	SSL_copy_session_id((SSL *)t->ptr,(SSL *)f->ptr);
-	return(1);
-	}
-
-
diff --git a/ssl/build b/ssl/build
deleted file mode 100644
index d3308356b3..0000000000
--- a/ssl/build
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/bin/sh
-for i in BUILD_SSLV23 BUILD_SSLV2 BUILD_SSLV3 BUILD_SSL_COMMON BUILD_SSL_BIO BUILD_SSL_OPTIONAL
-do
-time gcc -D$i -o $i.o -c -I. -I../include -O3 -fomit-frame-pointer ssl.c
-done
-
diff --git a/ssl/changes.ssl b/ssl/changes.ssl
deleted file mode 100644
index ab94b95aa0..0000000000
--- a/ssl/changes.ssl
+++ /dev/null
@@ -1,10 +0,0 @@
-
-Must do a 
-SSL_init_eay_ciphers();
-before calls to SSL_CTX_new()
-
-SSL_CTX *SSL_CTX_new(void ) -> SSL_CTX *SSL_CTX_new(SSL_METHOD *meth);
-
-SSL_CTX_set_cert_verify_cb -> the callback is now
-int callback(char *arg,SSL *s,X509 *xs,STACK *cert_chain);
-where the 'cert_chain' has been added.
diff --git a/ssl/readme b/ssl/readme
deleted file mode 100644
index ca174848a1..0000000000
--- a/ssl/readme
+++ /dev/null
@@ -1,277 +0,0 @@
-22 Jun 1996
-This file belongs in ../apps, but I'll leave it here because it deals
-with SSL :-)  It is rather dated but it gives you an idea of how
-things work.
-===
-
-17 Jul 1995
-I have been changing things quite a bit and have not fully updated
-this file, so take what you read with a grain of salt
-eric
-===
-The s_client and s_server programs can be used to test SSL capable
-IP/port addresses and the verification of the X509 certificates in use
-by these services.  I strongly advise having a look at the code to get
-an idea of how to use the authentication under SSLeay.  Any feedback
-on changes and improvements would be greatly accepted.
-
-This file will probably be gibberish unless you have read
-rfc1421, rfc1422, rfc1423 and rfc1424 which describe PEM
-authentication.
-
-A Brief outline (and examples) how to use them to do so.
-
-NOTE:
-The environment variable SSL_CIPER is used to specify the prefered
-cipher to use, play around with setting it's value to combinations of
-RC4-MD5, EXP-RC4-MD5, CBC-DES-MD5, CBC3-DES-MD5, CFB-DES-NULL
-in a : separated list.
-
-This directory contains 3 X509 certificates which can be used by these programs.
-client.pem: a file containing a certificate and private key to be used
-	by s_client.
-server.pem :a file containing a certificate and private key to be used
-	by s_server.
-eay1024.pem:the certificate used to sign client.pem and server.pem.
-	This would be your CA's certificate.  There is also a link
-	from the file a8556381.0 to eay1024.PEM.  The value a8556381
-	is returned by 'x509 -hash -noout <eay1024.pem' and is the
-	value used by X509 verification routines to 'find' this
-	certificte when search a directory for it.
-	[the above is not true any more, the CA cert is 
-	 ../certs/testca.pem which is signed by ../certs/mincomca.pem]
-
-When testing the s_server, you may get
-bind: Address already in use
-errors.  These indicate the port is still being held by the unix
-kernel and you are going to have to wait for it to let go of it.  If
-this is the case, remember to use the port commands on the s_server and
-s_client to talk on an alternative port.
-
-=====
-s_client.
-This program can be used to connect to any IP/hostname:port that is
-talking SSL.  Once connected, it will attempt to authenticate the
-certificate it was passed and if everything works as expected, a 2
-directional channel will be open.  Any text typed will be sent to the
-other end.  type Q<cr> to exit.  Flags are as follows.
--host arg	: Arg is the host or IP address to connect to.
--port arg	: Arg is the port to connect to (https is 443).
--verify arg	: Turn on authentication of the server certificate.
-		: Arg specifies the 'depth', this will covered below.
--cert arg	: The optional certificate to use.  This certificate
-		: will be returned to the server if the server
-		: requests it for client authentication.
--key arg	: The private key that matches the certificate
-		: specified by the -cert option.  If this is not
-		: specified (but -cert is), the -cert file will be
-		: searched for the Private key.  Both files are
-		: assumed to be in PEM format.
--CApath arg	: When to look for certificates when 'verifying' the
-		: certificate from the server.
--CAfile arg	: A file containing certificates to be used for
-		: 'verifying' the server certificate.
--reconnect	: Once a connection has been made, drop it and
-		: reconnect with same session-id.  This is for testing :-).
-
-The '-verify n' parameter specifies not only to verify the servers
-certificate but to also only take notice of 'n' levels.  The best way
-to explain is to show via examples.
-Given
-s_server -cert server.PEM is running.
-
-s_client
-	CONNECTED
-	depth=0 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo server
-	issuer= /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA
-	verify error:num=1:unable to get issuer certificate
-	verify return:1
-	CIPHER is CBC-DES-MD5
-What has happened is that the 'SSLeay demo server' certificate's
-issuer ('CA') could not be found but because verify is not on, we
-don't care and the connection has been made anyway.  It is now 'up'
-using CBC-DES-MD5 mode.  This is an unauthenticate secure channel.
-You may not be talking to the right person but the data going to them
-is encrypted.
-
-s_client -verify 0
-	CONNECTED
-	depth=0 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo server
-	issuer= /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA
-	verify error:num=1:unable to get issuer certificate
-	verify return:1
-	CIPHER is CBC-DES-MD5
-We are 'verifying' but only to depth 0, so since the 'SSLeay demo server'
-certificate passed the date and checksum, we are happy to proceed.
-
-s_client -verify 1
-	CONNECTED
-	depth=0 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo server
-	issuer= /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA
-	verify error:num=1:unable to get issuer certificate
-	verify return:0
-	ERROR
-	verify error:unable to get issuer certificate
-In this case we failed to make the connection because we could not
-authenticate the certificate because we could not find the
-'CA' certificate.
-
-s_client -verify 1 -CAfile eay1024.PEM
-	CONNECTED
-	depth=0 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo server
-	verify return:1
-	depth=1 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA
-	verify return:1
-	CIPHER is CBC-DES-MD5
-We loaded the certificates from the file eay1024.PEM.  Everything
-checked out and so we made the connection.
-
-s_client -verify 1 -CApath .
-	CONNECTED
-	depth=0 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo server
-	verify return:1
-	depth=1 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA
-	verify return:1
-	CIPHER is CBC-DES-MD5
-We looked in out local directory for issuer certificates and 'found'
-a8556381.0 and so everything is ok.
-
-It is worth noting that 'CA' is a self certified certificate.  If you
-are passed one of these, it will fail to 'verify' at depth 0 because
-we need to lookup the certifier of a certificate from some information
-that we trust and keep locally.
-
-SSL_CIPHER=CBC3-DES-MD5:RC4-MD5
-export SSL_CIPHER
-s_client -verify 10 -CApath . -reconnect
-	CONNECTED
-	depth=0 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo server
-	verify return:1
-	depth=1 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA
-	verify return:1
-	drop the connection and reconnect with the same session id
-	CIPHER is CBC3-DES-MD5
-This has done a full connection and then re-estabished it with the
-same session id but a new socket.  No RSA stuff occures on the second
-connection.  Note that we said we would prefer to use CBC3-DES-MD5
-encryption and so, since the server supports it, we are.
-
-=====
-s_server
-This program accepts SSL connections on a specified port
-Once connected, it will estabish an SSL connection and optionaly
-attempt to authenticate the client.  A 2 directional channel will be
-open.  Any text typed will be sent to the other end.  Type Q<cr> to exit.
-Flags are as follows.
--port arg	: Arg is the port to listen on.
--verify arg	: Turn on authentication of the client if they have a
-		: certificate.  Arg specifies the 'depth'.
--Verify arg	: Turn on authentication of the client. If they don't
-		: have a valid certificate, drop the connection.
--cert arg	: The certificate to use.  This certificate
-		: will be passed to the client.  If it is not
-		: specified, it will default to server.PEM
--key arg	: The private key that matches the certificate
-		: specified by the -cert option.  If this is not
-		: specified (but -cert is), the -cert file will be
-		: searched for the Private key.  Both files are
-		: assumed to be in PEM format.  Default is server.PEM
--CApath arg	: When to look for certificates when 'verifying' the
-		: certificate from the client.
--CAfile arg	: A file containing certificates to be used for
-		: 'verifying' the client certificate.
-
-For the following 'demo'  I will specify the s_server command and
-the s_client command and then list the output from the s_server.
-s_server
-s_client
-	CONNECTED
-	CIPHER is CBC-DES-MD5
-Everything up and running
-
-s_server -verify 0
-s_client  
-	CONNECTED
-	CIPHER is CBC-DES-MD5
-Ok since no certificate was returned and we don't care.
-
-s_server -verify 0
-./s_client -cert client.PEM
-	CONNECTED
-	depth=0 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo client
-	issuer= /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA
-	verify error:num=1:unable to get issuer certificate
-	verify return:1
-	CIPHER is CBC-DES-MD5
-Ok since we were only verifying to level 0
-
-s_server -verify 4
-s_client -cert client.PEM
-	CONNECTED
-	depth=0 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo client
-	issuer= /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA
-	verify error:num=1:unable to get issuer certificate
-	verify return:0
-	ERROR
-	verify error:unable to get issuer certificate
-Bad because we could not authenticate the returned certificate.
-
-s_server -verify 4 -CApath .
-s_client -cert client.PEM
-	CONNECTED
-	depth=0 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo client
-	verify return:1
-	depth=1 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA
-	verify return:1
-	CIPHER is CBC-DES-MD5
-Ok because we could authenticate the returned certificate :-).
-
-s_server -Verify 0 -CApath .
-s_client
-	CONNECTED
-	ERROR
-	SSL error:function is:REQUEST_CERTIFICATE
-		 :error is   :client end did not return a certificate
-Error because no certificate returned.
-
-s_server -Verify 4 -CApath .
-s_client -cert client.PEM
-	CONNECTED
-	depth=0 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo client
-	verify return:1
-	depth=1 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA
-	verify return:1
-	CIPHER is CBC-DES-MD5
-Full authentication of the client.
-
-So in summary to do full authentication of both ends
-s_server -Verify 9 -CApath .
-s_client -cert client.PEM -CApath . -verify 9
-From the server side
-	CONNECTED
-	depth=0 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo client
-	verify return:1
-	depth=1 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA
-	verify return:1
-	CIPHER is CBC-DES-MD5
-From the client side
-	CONNECTED
-	depth=0 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo server
-	verify return:1
-	depth=1 /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA
-	verify return:1
-	CIPHER is CBC-DES-MD5
-
-For general probing of the 'internet https' servers for the
-distribution area, run
-s_client -host www.netscape.com -port 443 -verify 4 -CApath ../rsa/hash
-Then enter
-GET /
-and you should be talking to the https server on that host.
-
-www.rsa.com was refusing to respond to connections on 443 when I was
-testing.
-
-have fun :-).
-
-eric