Merge branch 'develop' into mqtt5

2025-05-09 01:01:11 +08:00 · 2018-10-02 11:28:03 +01:00 · 2018-10-02 11:28:03 +01:00 · 6c9e8d51c2
commit 6c9e8d51c2
parent 4ee6941188 1867f30785
319 changed files with 20489 additions and 656 deletions
--- a/.gitignore
+++ b/.gitignore
@ -7,10 +7,21 @@ cpp/*.test
 *.pyc
 *.vglog

+build/
+
 client/mosquitto_pub
 client/mosquitto_sub
+
+dist/
+
 examples/mysql_log/mosquitto_mysql_log
 examples/temperature_conversion/mqtt_temperature_conversion
+
+lib/cpp/libmosquittopp.so*
+lib/cpp/libmosquittopp.a
+lib/libmosquitto.so*
+lib/libmosquitto.a
+
 man/mosquitto.8
 man/mosquitto-tls.7
 man/mosquitto.conf.5
@ -19,9 +30,11 @@ man/mosquitto_passwd.1
 man/mosquitto_pub.1
 man/mosquitto_sub.1
 man/mqtt.7
+
 src/db_dump/mosquitto_db_dump
 src/mosquitto
 src/mosquitto_passwd
+
 test/broker/broker.pid
 test/test_client
 test/fake_user
@ -32,15 +45,10 @@ test/msgsps_sub.dat
 test/broker/c/auth_plugin.so
 test/broker/c/*.test

-lib/cpp/libmosquittopp.so*
-lib/cpp/libmosquittopp.a
-lib/libmosquitto.so*
-lib/libmosquitto.a
-
 test/ssl/*.csr

 test/lib/c/*.test
 test/lib/cpp/*.test

-build/
-dist/
+www/cache/
+__pycache__
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@ -11,7 +11,7 @@ project(mosquitto)
 cmake_minimum_required(VERSION 2.8)
 # Only for version 3 and up. cmake_policy(SET CMP0042 NEW)

-set (VERSION 1.5.1)
+set (VERSION 1.5.3)

 add_definitions (-DCMAKE -DVERSION=\"${VERSION}\")

--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -32,9 +32,9 @@ Foundation IP policy.
 Please read the [Eclipse Foundation policy on accepting contributions via Git](http://wiki.eclipse.org/Development_Resources/Contributing_via_Git).

 1. Sign the [Eclipse ECA](http://www.eclipse.org/legal/ECA.php)
-  1. Register for an Eclipse Foundation User ID. You can register [here](https://dev.eclipse.org/site_login/createaccount.php).
-  2. Log into the [Projects Portal](https://projects.eclipse.org/), and click on the '[Eclipse ECA](https://projects.eclipse.org/user/sign/eca)' link.
-2. Go to your [account settings](https://dev.eclipse.org/site_login/myaccount.php#open_tab_accountsettings) and add your GitHub username to your account.
+    1. Register for an Eclipse Foundation User ID. You can register [here](https://accounts.eclipse.org/user/register).
+    2. Log into the [Accounts Portal](https://accounts.eclipse.org/), and click on the '[Eclipse Contributor Agreement](https://accounts.eclipse.org/user/eca)' link.
+2. Go to your [account settings](https://accounts.eclipse.org/user/edit) and add your GitHub username to your account.
 3. Make sure that you _sign-off_ your Git commits in the following format:
  ``` Signed-off-by: John Smith <johnsmith@nowhere.com> ``` This is usually at the bottom of the commit message. You can automate this by adding the '-s' flag when you make the commits. e.g.   ```git commit -s -m "Adding a cool feature"```
 4. Ensure that the email address that you make your commits with is the same one you used to sign up to the Eclipse Foundation website with.
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@ -1,3 +1,62 @@
+1.6 - 2018xxxx
+==============
+
+Client library features:
+- Add mosquitto_subscribe_multiple() for sending subscriptions to multiple
+  topics in one command.
+
+Client features:
+- Add -E to mosquitto_sub, which causes it to exit immediately after having
+  its subscriptions acknowledged. Use with -c to create a durable client
+  session without requiring a message to be received.
+
+
+1.5.3 - 20180925
+================
+
+Security:
+- Fix CVE-2018-12543. If a message is sent to Mosquitto with a topic that
+  begins with $, but is not $SYS, then an assert that should be unreachable is
+  triggered and Mosquitto will exit.
+
+Broker:
+- Elevate log level to warning for situation when socket limit is hit.
+- Remove requirement to use `user root` in snap package config files.
+- Fix retained messages not sent by bridges on outgoing topics at the first
+  connection. Closes #701.
+- Documentation fixes. Closes #520, #600.
+- Fix duplicate clients being added to by_id hash before the old client was
+  removed. Closes #645.
+- Fix Windows version not starting if include_dir did not contain any files.
+  Closes #566.
+
+Build:
+- Various fixes to ease building.
+
+
+1.5.2 - 20180919
+================
+
+Broker:
+- Fix build when using WITH_ADNS=yes.
+- Fix incorrect call to setsockopt() for TCP_NODELAY. Closes #941.
+- Fix excessive CPU usage when the number of sockets exceeds the system limit.
+  Closes #948.
+- Fix for bridge connections when using WITH_ADNS=yes.
+- Fix round_robin false behaviour. Closes #481.
+- Fix segfault on HUP when bridges and security options are configured.
+  Closes #965.
+
+Library:
+- Fix situation where username and password is used with SOCKS5 proxy. Closes
+  #927.
+- Fix SOCKS5 behaviour when passing IP addresses. Closes #927.
+
+Build:
+- Make it easier to build without bundled uthash.h using "WITH_BUNDLED_DEPS=no".
+- Fix build with OPENSSL_NO_ENGINE. Closes #932.
+
+
 1.5.1 - 20180816
 ================

--- a/client/client_shared.c
+++ b/client/client_shared.c
@ -479,6 +479,11 @@ int client_config_line_proc(struct mosq_config *cfg, int pub_or_sub, int argc, c
 				}
 			}
 			i++;
+		}else if(!strcmp(argv[i], "-E")){
+			if(pub_or_sub == CLIENT_PUB){
+				goto unknown_option;
+			}
+			cfg->exit_after_sub = true;
 		}else if(!strcmp(argv[i], "-F")){
 			if(pub_or_sub == CLIENT_PUB){
 				goto unknown_option;
--- a/client/client_shared.h
+++ b/client/client_shared.h
@ -74,6 +74,7 @@ struct mosq_config {
 	bool clean_session;
 	char **topics; /* sub */
 	int topic_count; /* sub */
+	bool exit_after_sub; /* sub */
 	bool no_retain; /* sub */
 	bool retained_only; /* sub */
 	char **filter_outs; /* sub */
--- a/client/sub_client.c
+++ b/client/sub_client.c
@ -96,9 +96,8 @@ void my_connect_callback(struct mosquitto *mosq, void *obj, int result, int flag
 	cfg = (struct mosq_config *)obj;

 	if(!result){
-		for(i=0; i<cfg->topic_count; i++){
-			mosquitto_subscribe(mosq, NULL, cfg->topics[i], cfg->qos);
-		}
+		mosquitto_subscribe_multiple(mosq, NULL, cfg->topic_count, (const char **)cfg->topics, cfg->qos);
+
 		for(i=0; i<cfg->unsub_topic_count; i++){
 			mosquitto_unsubscribe(mosq, NULL, cfg->unsub_topics[i]);
 		}
@ -123,6 +122,10 @@ void my_subscribe_callback(struct mosquitto *mosq, void *obj, int mid, int qos_c
 		if(!cfg->quiet) printf(", %d", granted_qos[i]);
 	}
 	if(!cfg->quiet) printf("\n");
+
+	if(cfg->exit_after_sub){
+		mosquitto_disconnect(mosq);
+	}
 }

 void my_log_callback(struct mosquitto *mosq, void *obj, int level, const char *str)
@ -139,7 +142,7 @@ void print_usage(void)
 	printf("mosquitto_sub version %s running on libmosquitto %d.%d.%d.\n\n", VERSION, major, minor, revision);
 	printf("Usage: mosquitto_sub {[-h host] [-p port] [-u username [-P password]] -t topic | -L URL [-t topic]}\n");
 	printf("                     [-c] [-k keepalive] [-q qos]\n");
-	printf("                     [-C msg_count] [-R] [--retained-only] [-T filter_out] [-U topic ...]\n");
+	printf("                     [-C msg_count] [-E] [-R] [--retained-only] [-T filter_out] [-U topic ...]\n");
 	printf("                     [-F format]\n");
 #ifndef WIN32
 	printf("                     [-W timeout_secs]\n");
@ -168,6 +171,7 @@ void print_usage(void)
 	printf(" -c : disable 'clean session' (store subscription and pending messages when client disconnects).\n");
 	printf(" -C : disconnect and exit after receiving the 'msg_count' messages.\n");
 	printf(" -d : enable debug messages.\n");
+	printf(" -E : Exit once all subscriptions have been acknowledged by the broker.\n");
 	printf(" -F : output format.\n");
 	printf(" -h : mqtt host to connect to. Defaults to localhost.\n");
 	printf(" -i : id to use for this client. Defaults to mosquitto_sub_ appended with the process id.\n");
--- a/config.h
+++ b/config.h
@ -1,10 +1,19 @@
 #ifndef CONFIG_H
 /* ============================================================
- * Control compile time options.
- * ============================================================
- *
- * Compile time options have moved to config.mk.
- */
+ * Platform options
+ * ============================================================ */
+
+#ifdef __APPLE__
+#  define __DARWIN_C_SOURCE
+#elif defined(__FreeBSD__) || defined(__NetBSD__) || defined(__SYMBIAN32__) || defined(__QNX__)
+#  define _XOPEN_SOURCE 700
+#  define __BSD_VISIBLE 1
+#  define HAVE_NETINET_IN_H
+#else
+#  define _XOPEN_SOURCE 700
+#  define _DEFAULT_SOURCE 1
+#  define _POSIX_C_SOURCE 200809L
+#endif


 /* ============================================================
@ -27,16 +36,4 @@
 #define uthash_malloc(sz) mosquitto__malloc(sz)
 #define uthash_free(ptr,sz) mosquitto__free(ptr)

-#ifdef __APPLE__
-#  define __DARWIN_C_SOURCE
-#elif defined(__FreeBSD__) || defined(__NetBSD__) || defined(__SYMBIAN32__) || defined(__QNX__)
-#  define _XOPEN_SOURCE 700
-#  define __BSD_VISIBLE 1
-#  define HAVE_NETINET_IN_H
-#else
-#  define _XOPEN_SOURCE 700
-#  define _DEFAULT_SOURCE 1
-#  define _POSIX_C_SOURCE 200809L
-#endif
-
 #endif
--- a/config.mk
+++ b/config.mk
@ -92,6 +92,9 @@ WITH_STATIC_LIBRARIES:=no
 # Build with epoll support.
 WITH_EPOLL:=yes

+# Build with bundled uthash.h
+WITH_BUNDLED_DEPS:=yes
+
 # =============================================================================
 # End of user configuration
 # =============================================================================
@ -99,7 +102,7 @@ WITH_EPOLL:=yes

 # Also bump lib/mosquitto.h, CMakeLists.txt,
 # installer/mosquitto.nsi, installer/mosquitto64.nsi
-VERSION=1.5.1
+VERSION=1.5.3

 # Client library SO version. Bump if incompatible API/ABI changes are made.
 SOVERSION=1
@ -272,9 +275,11 @@ ifeq ($(WITH_WEBSOCKETS),static)
 endif

 INSTALL?=install
-prefix=/usr/local
-mandir=${prefix}/share/man
-localedir=${prefix}/share/locale
+prefix?=/usr/local
+incdir?=${prefix}/include
+libdir?=${prefix}/lib${LIB_SUFFIX}
+localedir?=${prefix}/share/locale
+mandir?=${prefix}/share/man
 STRIP?=strip

 ifeq ($(WITH_STRIP),yes)
@ -287,3 +292,6 @@ ifeq ($(WITH_EPOLL),yes)
 	endif
 endif

+ifeq ($(WITH_BUNDLED_DEPS),yes)
+	BROKER_CFLAGS:=$(BROKER_CFLAGS) -Ideps
+endif
--- a/installer/mosquitto.nsi
+++ b/installer/mosquitto.nsi
@ -9,7 +9,7 @@
 !define env_hklm 'HKLM "SYSTEM\CurrentControlSet\Control\Session Manager\Environment"'

 Name "Eclipse Mosquitto"
-!define VERSION 1.5.1
+!define VERSION 1.5.3
 OutFile "mosquitto-${VERSION}-install-windows-x86.exe"

 InstallDir "$PROGRAMFILES\mosquitto"
--- a/installer/mosquitto64.nsi
+++ b/installer/mosquitto64.nsi
@ -9,7 +9,7 @@
 !define env_hklm 'HKLM "SYSTEM\CurrentControlSet\Control\Session Manager\Environment"'

 Name "Eclipse Mosquitto"
-!define VERSION 1.5.1
+!define VERSION 1.5.3
 OutFile "mosquitto-${VERSION}-install-windows-x64.exe"

 !include "x64.nsh"
--- a/lib/Makefile
+++ b/lib/Makefile
@ -48,22 +48,24 @@ all : ${ALL_DEPS}
 	$(MAKE) -C cpp

 install : all
-	$(INSTALL) -d "${DESTDIR}$(prefix)/lib${LIB_SUFFIX}/"
-	$(INSTALL) ${STRIP_OPTS} libmosquitto.so.${SOVERSION} "${DESTDIR}${prefix}/lib${LIB_SUFFIX}/libmosquitto.so.${SOVERSION}"
-	ln -sf libmosquitto.so.${SOVERSION} "${DESTDIR}${prefix}/lib${LIB_SUFFIX}/libmosquitto.so"
+	$(INSTALL) -d "${DESTDIR}${libdir}/"
+	$(INSTALL) ${STRIP_OPTS} libmosquitto.so.${SOVERSION} "${DESTDIR}${libdir}/libmosquitto.so.${SOVERSION}"
+	ln -sf libmosquitto.so.${SOVERSION} "${DESTDIR}${libdir}/libmosquitto.so"
 ifeq ($(WITH_STATIC_LIBRARIES),yes)
-	$(INSTALL) libmosquitto.a "${DESTDIR}${prefix}/lib${LIB_SUFFIX}/libmosquitto.a"
-	${CROSS_COMPILE}${STRIP} -g --strip-unneeded "${DESTDIR}${prefix}/lib${LIB_SUFFIX}/libmosquitto.a"
+	$(INSTALL) ${STRIP_OPTS} libmosquitto.a "${DESTDIR}${libdir}/libmosquitto.a"
 endif
-	$(INSTALL) -d "${DESTDIR}${prefix}/include/"
-	$(INSTALL) mosquitto.h "${DESTDIR}${prefix}/include/mosquitto.h"
+	$(INSTALL) -d "${DESTDIR}${incdir}/"
+	$(INSTALL) mosquitto.h "${DESTDIR}${incdir}/mosquitto.h"
+	$(INSTALL) -d "${DESTDIR}${libdir}/pkgconfig"
+	$(INSTALL) -m644 ../libmosquitto.pc.in "${DESTDIR}${libdir}/pkgconfig/libmosquitto.pc"
+	sed -i -e "s#@CMAKE_INSTALL_PREFIX@#${prefix}#" -e "s#@VERSION@#${VERSION}#" "${DESTDIR}${libdir}/pkgconfig/libmosquitto.pc"
 	$(MAKE) -C cpp install

 uninstall :
-	-rm -f "${DESTDIR}${prefix}/lib${LIB_SUFFIX}/libmosquitto.so.${SOVERSION}"
-	-rm -f "${DESTDIR}${prefix}/lib${LIB_SUFFIX}/libmosquitto.so"
-	-rm -f "${DESTDIR}${prefix}/lib${LIB_SUFFIX}/libmosquitto.a"
-	-rm -f "${DESTDIR}${prefix}/include/mosquitto.h"
+	-rm -f "${DESTDIR}${libdir}/libmosquitto.so.${SOVERSION}"
+	-rm -f "${DESTDIR}${libdir}/libmosquitto.so"
+	-rm -f "${DESTDIR}${libdir}/libmosquitto.a"
+	-rm -f "${DESTDIR}${incdir}/mosquitto.h"

 reallyclean : clean

--- a/lib/actions.c
+++ b/lib/actions.c
@ -105,7 +105,24 @@ int mosquitto_subscribe(struct mosquitto *mosq, int *mid, const char *sub, int q
 	if(mosquitto_sub_topic_check(sub)) return MOSQ_ERR_INVAL;
 	if(mosquitto_validate_utf8(sub, strlen(sub))) return MOSQ_ERR_MALFORMED_UTF8;

-	return send__subscribe(mosq, mid, sub, qos);
+	return send__subscribe(mosq, mid, 1, &sub, qos);
+}
+
+
+int mosquitto_subscribe_multiple(struct mosquitto *mosq, int *mid, int sub_count, const char **sub, int qos)
+{
+	int i;
+
+	if(!mosq || !sub_count || !sub) return MOSQ_ERR_INVAL;
+	if(qos < 0 || qos > 2) return MOSQ_ERR_INVAL;
+	if(mosq->sock == INVALID_SOCKET) return MOSQ_ERR_NO_CONN;
+
+	for(i=0; i<sub_count; i++){
+		if(mosquitto_sub_topic_check(sub[i])) return MOSQ_ERR_INVAL;
+		if(mosquitto_validate_utf8(sub[i], strlen(sub[i]))) return MOSQ_ERR_MALFORMED_UTF8;
+	}
+
+	return send__subscribe(mosq, mid, sub_count, sub, qos);
 }


--- a/lib/cpp/Makefile
+++ b/lib/cpp/Makefile
@ -15,21 +15,24 @@ endif
 all : ${ALL_DEPS}

 install : all
-	$(INSTALL) -d "${DESTDIR}$(prefix)/lib${LIB_SUFFIX}/"
-	$(INSTALL) ${STRIP_OPTS} libmosquittopp.so.${SOVERSION} "${DESTDIR}${prefix}/lib${LIB_SUFFIX}/libmosquittopp.so.${SOVERSION}"
-	ln -sf libmosquittopp.so.${SOVERSION} "${DESTDIR}${prefix}/lib${LIB_SUFFIX}/libmosquittopp.so"
+	$(INSTALL) -d "${DESTDIR}${libdir}/"
+	$(INSTALL) ${STRIP_OPTS} libmosquittopp.so.${SOVERSION} "${DESTDIR}${libdir}/libmosquittopp.so.${SOVERSION}"
+	ln -sf libmosquittopp.so.${SOVERSION} "${DESTDIR}${libdir}/libmosquittopp.so"
 ifeq ($(WITH_STATIC_LIBRARIES),yes)
-	$(INSTALL) libmosquittopp.a "${DESTDIR}${prefix}/lib${LIB_SUFFIX}/libmosquittopp.a"
-	${CROSS_COMPILE}${STRIP} -g --strip-unneeded "${DESTDIR}${prefix}/lib${LIB_SUFFIX}/libmosquittopp.a"
+	$(INSTALL) libmosquittopp.a "${DESTDIR}${libdir}/libmosquittopp.a"
+	${CROSS_COMPILE}${STRIP} -g --strip-unneeded "${DESTDIR}${libdir}/libmosquittopp.a"
 endif
-	$(INSTALL) -d "${DESTDIR}${prefix}/include/"
-	$(INSTALL) mosquittopp.h "${DESTDIR}${prefix}/include/mosquittopp.h"
-	
+	$(INSTALL) -d "${DESTDIR}${incdir}/"
+	$(INSTALL) mosquittopp.h "${DESTDIR}${incdir}/mosquittopp.h"
+	$(INSTALL) -d "${DESTDIR}${libdir}/pkgconfig/"
+	$(INSTALL) -m644 ../../libmosquittopp.pc.in "${DESTDIR}${libdir}/pkgconfig/libmosquittopp.pc"
+	sed -i -e "s#@CMAKE_INSTALL_PREFIX@#${prefix}#" -e "s#@VERSION@#${VERSION}#" "${DESTDIR}${libdir}/pkgconfig/libmosquittopp.pc"
+
 uninstall :
-	-rm -f "${DESTDIR}${prefix}/lib${LIB_SUFFIX}/libmosquittopp.so.${SOVERSION}"
-	-rm -f "${DESTDIR}${prefix}/lib${LIB_SUFFIX}/libmosquittopp.so"
-	-rm -f "${DESTDIR}${prefix}/lib${LIB_SUFFIX}/libmosquittopp.a"
-	-rm -f "${DESTDIR}${prefix}/include/mosquittopp.h"
+	-rm -f "${DESTDIR}${libdir}/libmosquittopp.so.${SOVERSION}"
+	-rm -f "${DESTDIR}${libdir}/libmosquittopp.so"
+	-rm -f "${DESTDIR}${libdir}/libmosquittopp.a"
+	-rm -f "${DESTDIR}${incdir}/mosquittopp.h"

 clean :
 	-rm -f *.o libmosquittopp.so.${SOVERSION} libmosquittopp.a
--- a/lib/linker.version
+++ b/lib/linker.version
@ -91,3 +91,8 @@ MOSQ_1.5 {
 		mosquitto_topic_matches_sub2;
 		mosquitto_connect_with_flags_callback_set;
 } MOSQ_1.4;
+
+MOSQ_1.6 {
+	global:
+		mosquitto_subscribe_multiple;
+} MOSQ_1.5;
--- a/lib/mosquitto.h
+++ b/lib/mosquitto.h
@ -47,7 +47,7 @@ extern "C" {

 #define LIBMOSQUITTO_MAJOR 1
 #define LIBMOSQUITTO_MINOR 5
-#define LIBMOSQUITTO_REVISION 1
+#define LIBMOSQUITTO_REVISION 3
 /* LIBMOSQUITTO_VERSION_NUMBER looks like 1002001 for e.g. version 1.2.1. */
 #define LIBMOSQUITTO_VERSION_NUMBER (LIBMOSQUITTO_MAJOR*1000000+LIBMOSQUITTO_MINOR*1000+LIBMOSQUITTO_REVISION)

@ -633,6 +633,30 @@ libmosq_EXPORT int mosquitto_publish(struct mosquitto *mosq, int *mid, const cha
 */
 libmosq_EXPORT int mosquitto_subscribe(struct mosquitto *mosq, int *mid, const char *sub, int qos);

+/*
+ * Function: mosquitto_subscribe_multiple
+ *
+ * Subscribe to multiple topics.
+ *
+ * Parameters:
+ *	mosq - a valid mosquitto instance.
+ *	mid -  a pointer to an int. If not NULL, the function will set this to
+ *	       the message id of this particular message. This can be then used
+ *	       with the subscribe callback to determine when the message has been
+ *	       sent.
+ *  sub_count - the count of subscriptions to be made
+ *	sub -  array of sub_count pointers, each pointing to a subscription string.
+ *	qos -  the requested Quality of Service for each subscription.
+ *
+ * Returns:
+ *	MOSQ_ERR_SUCCESS -        on success.
+ * 	MOSQ_ERR_INVAL -          if the input parameters were invalid.
+ * 	MOSQ_ERR_NOMEM -          if an out of memory condition occurred.
+ * 	MOSQ_ERR_NO_CONN -        if the client isn't connected to a broker.
+ * 	MOSQ_ERR_MALFORMED_UTF8 - if a topic is not valid UTF-8
+ */
+int mosquitto_subscribe_multiple(struct mosquitto *mosq, int *mid, int sub_count, const char **sub, int qos);
+
 /*
 * Function: mosquitto_unsubscribe
 *
--- a/lib/mosquitto_internal.h
+++ b/lib/mosquitto_internal.h
@ -209,6 +209,8 @@ struct mosquitto {
 #endif
 	bool clean_session;
 #ifdef WITH_BROKER
+	char *old_id; /* for when a duplicate client connects, but we still want to
+					 know what the id was */
 	bool is_dropping;
 	bool is_bridge;
 	struct mosquitto__bridge *bridge;
--- a/lib/net_mosq.c
+++ b/lib/net_mosq.c
@ -103,7 +103,9 @@ void net__cleanup(void)
 	#if OPENSSL_VERSION_NUMBER < 0x10100000L
 		ERR_remove_state(0);
 	#endif
-	ENGINE_cleanup();
+	#ifndef OPENSSL_NO_ENGINE
+		ENGINE_cleanup();
+	#endif
 	CONF_modules_unload(1);
 	ERR_free_strings();
 	EVP_cleanup();
--- a/lib/send_mosq.h
+++ b/lib/send_mosq.h
@ -31,7 +31,7 @@ int send__pubcomp(struct mosquitto *mosq, uint16_t mid);
 int send__publish(struct mosquitto *mosq, uint16_t mid, const char *topic, uint32_t payloadlen, const void *payload, int qos, bool retain, bool dup);
 int send__pubrec(struct mosquitto *mosq, uint16_t mid);
 int send__pubrel(struct mosquitto *mosq, uint16_t mid);
-int send__subscribe(struct mosquitto *mosq, int *mid, const char *topic, uint8_t topic_qos);
+int send__subscribe(struct mosquitto *mosq, int *mid, int topic_count, const char **topic, int topic_qos);
 int send__unsubscribe(struct mosquitto *mosq, int *mid, const char *topic);

 #endif
--- a/lib/send_subscribe.c
+++ b/lib/send_subscribe.c
@ -32,13 +32,13 @@ Contributors:
 #include "util_mosq.h"


-int send__subscribe(struct mosquitto *mosq, int *mid, const char *topic, uint8_t topic_qos)
+int send__subscribe(struct mosquitto *mosq, int *mid, int topic_count, const char **topic, int topic_qos)
 {
-	/* FIXME - only deals with a single topic */
 	struct mosquitto__packet *packet = NULL;
 	uint32_t packetlen;
 	uint16_t local_mid;
 	int rc;
+	int i;

 	assert(mosq);
 	assert(topic);
@ -46,7 +46,10 @@ int send__subscribe(struct mosquitto *mosq, int *mid, const char *topic, uint8_t
 	packet = mosquitto__calloc(1, sizeof(struct mosquitto__packet));
 	if(!packet) return MOSQ_ERR_NOMEM;

-	packetlen = 2 + 2+strlen(topic) + 1;
+	packetlen = 2;
+	for(i=0; i<topic_count; i++){
+		packetlen += 2+strlen(topic[i]) + 1;
+	}

 	packet->command = SUBSCRIBE | (1<<1);
 	packet->remaining_length = packetlen;
@ -62,15 +65,19 @@ int send__subscribe(struct mosquitto *mosq, int *mid, const char *topic, uint8_t
 	packet__write_uint16(packet, local_mid);

 	/* Payload */
-	packet__write_string(packet, topic, strlen(topic));
-	packet__write_byte(packet, topic_qos);
+	for(i=0; i<topic_count; i++){
+		packet__write_string(packet, topic[i], strlen(topic[i]));
+		packet__write_byte(packet, topic_qos);
+	}

 #ifdef WITH_BROKER
 # ifdef WITH_BRIDGE
-	log__printf(mosq, MOSQ_LOG_DEBUG, "Bridge %s sending SUBSCRIBE (Mid: %d, Topic: %s, QoS: %d)", mosq->id, local_mid, topic, topic_qos);
+	log__printf(mosq, MOSQ_LOG_DEBUG, "Bridge %s sending SUBSCRIBE (Mid: %d, Topic: %s, QoS: %d)", mosq->id, local_mid, topic[0], topic_qos);
 # endif
 #else
-	log__printf(mosq, MOSQ_LOG_DEBUG, "Client %s sending SUBSCRIBE (Mid: %d, Topic: %s, QoS: %d)", mosq->id, local_mid, topic, topic_qos);
+	for(i=0; i<topic_count; i++){
+		log__printf(mosq, MOSQ_LOG_DEBUG, "Client %s sending SUBSCRIBE (Mid: %d, Topic: %s, QoS: %d)", mosq->id, local_mid, topic[i], topic_qos);
+	}
 #endif

 	return packet__queue(mosq, packet);
--- a/lib/socks_mosq.c
+++ b/lib/socks_mosq.c
@ -18,6 +18,12 @@ Contributors:

 #include <errno.h>
 #include <string.h>
+#include <limits.h>
+#ifdef WIN32
+#  include <ws2tcpip.h>
+#else
+#  include <arpa/inet.h>
+#endif

 #include "mosquitto_internal.h"
 #include "memory_mosq.h"
@ -75,8 +81,10 @@ int mosquitto_socks5_set(struct mosquitto *mosq, const char *host, int port, con

 		if(password){
 			mosq->socks5_password = mosquitto__strdup(password);
-			mosquitto__free(mosq->socks5_username);
-			return MOSQ_ERR_NOMEM;
+			if(!mosq->socks5_password){
+				mosquitto__free(mosq->socks5_username);
+				return MOSQ_ERR_NOMEM;
+			}
 		}
 	}

@ -93,6 +101,11 @@ int socks5__send(struct mosquitto *mosq)
 	int slen;
 	int ulen, plen;

+	struct in_addr addr_ipv4;
+	struct in6_addr addr_ipv6;
+	int ipv4_pton_result;
+	int ipv6_pton_result;
+
 	if(mosq->state == mosq_cs_socks5_new){
 		packet = mosquitto__calloc(1, sizeof(struct mosquitto__packet));
 		if(!packet) return MOSQ_ERR_NOMEM;
@ -133,19 +146,53 @@ int socks5__send(struct mosquitto *mosq)
 		packet = mosquitto__calloc(1, sizeof(struct mosquitto__packet));
 		if(!packet) return MOSQ_ERR_NOMEM;

-		packet->packet_length = 7+strlen(mosq->host);
-		packet->payload = mosquitto__malloc(sizeof(uint8_t)*packet->packet_length);
+		ipv4_pton_result = inet_pton(AF_INET, mosq->host, &addr_ipv4);
+		ipv6_pton_result = inet_pton(AF_INET6, mosq->host, &addr_ipv6);

-		slen = strlen(mosq->host);
+		if(ipv4_pton_result == 1){
+			packet->packet_length = 10;
+			packet->payload = mosquitto__malloc(sizeof(uint8_t)*packet->packet_length);
+			if(!packet->payload){
+				mosquitto__free(packet);
+				return MOSQ_ERR_NOMEM;
+			}
+			packet->payload[3] = SOCKS_ATYPE_IP_V4;
+			memcpy(&(packet->payload[4]), (const void*)&addr_ipv4, 4);
+			packet->payload[4+4] = MOSQ_MSB(mosq->port);
+			packet->payload[4+4+1] = MOSQ_LSB(mosq->port);

+		}else if(ipv6_pton_result == 1){
+			packet->packet_length = 22;
+			packet->payload = mosquitto__malloc(sizeof(uint8_t)*packet->packet_length);
+			if(!packet->payload){
+				mosquitto__free(packet);
+				return MOSQ_ERR_NOMEM;
+			}
+			packet->payload[3] = SOCKS_ATYPE_IP_V6;
+			memcpy(&(packet->payload[4]), (const void*)&addr_ipv6, 16);
+			packet->payload[4+16] = MOSQ_MSB(mosq->port);
+			packet->payload[4+16+1] = MOSQ_LSB(mosq->port);
+
+		}else{
+			slen = strlen(mosq->host);
+			if(slen > UCHAR_MAX){
+				return MOSQ_ERR_NOMEM;
+			}
+			packet->packet_length = 7 + slen;
+			packet->payload = mosquitto__malloc(sizeof(uint8_t)*packet->packet_length);
+			if(!packet->payload){
+				mosquitto__free(packet);
+				return MOSQ_ERR_NOMEM;
+			}
+			packet->payload[3] = SOCKS_ATYPE_DOMAINNAME;
+			packet->payload[4] = (uint8_t)slen;
+			memcpy(&(packet->payload[5]), mosq->host, slen);
+			packet->payload[5+slen] = MOSQ_MSB(mosq->port);
+			packet->payload[6+slen] = MOSQ_LSB(mosq->port);
+		}
 		packet->payload[0] = 0x05;
-		packet->payload[1] = 1;
-		packet->payload[2] = 0;
-		packet->payload[3] = SOCKS_ATYPE_DOMAINNAME;
-		packet->payload[4] = slen;
-		memcpy(&(packet->payload[5]), mosq->host, slen);
-		packet->payload[5+slen] = MOSQ_MSB(mosq->port);
-		packet->payload[6+slen] = MOSQ_LSB(mosq->port);
+		packet->payload[1] = 0x01;
+		packet->payload[2] = 0x00;

 		pthread_mutex_lock(&mosq->state_mutex);
 		mosq->state = mosq_cs_socks5_request;
--- a/man/html.xsl
+++ b/man/html.xsl
@ -5,7 +5,6 @@
 	<xsl:param name="html.stylesheet">man.css</xsl:param>
 	<!-- Generate ansi style function synopses. -->
 	<xsl:param name="man.funcsynopsis.style">ansi</xsl:param>
-	<xsl:param name="funcsynopsis.style">ansi</xsl:param>
 	<xsl:param name="make.clean.html" select="1"></xsl:param>
 	<xsl:param name="make.valid.html" select="1"></xsl:param>
 	<xsl:param name="html.cleanup" select="1"></xsl:param>
--- a/man/libmosquitto.3.meta
+++ b/man/libmosquitto.3.meta
@ -0,0 +1,5 @@
+.. title: libmosquitto man page
+.. slug: libmosquitto-3
+.. category: man
+.. type: man
+.. pretty_url: False
--- a/man/mosquitto-tls.7.meta
+++ b/man/mosquitto-tls.7.meta
@ -0,0 +1,5 @@
+.. title: mosquitto-tls man page
+.. slug: mosquitto-tls-7
+.. category: man
+.. type: man
+.. pretty_url: False
--- a/man/mosquitto-tls.7.xml
+++ b/man/mosquitto-tls.7.xml
@ -26,6 +26,15 @@
 				you will experience difficult to diagnose errors.</para></note>
 	</refsect1>

+	<refsect1>
+		<title>Generating certificates</title>
+		<para>The sections below give the openssl commands that can be used to
+			generate certificates, but without any context. The asciicast at
+			<link
+				xlink:href="https://asciinema.org/a/201826">https://asciinema.org/a/201826</link>
+			gives a full run through of how to use those commands.</para>
+	</refsect1>
+
 	<refsect1>
 		<title>Certificate Authority</title>
 		<para>Generate a certificate authority certificate and key.</para>
--- a/man/mosquitto.8.meta
+++ b/man/mosquitto.8.meta
@ -0,0 +1,5 @@
+.. title: Mosquitto man page
+.. slug: mosquitto-8
+.. category: man
+.. type: man
+.. pretty_url: False
--- a/man/mosquitto.conf.5.meta
+++ b/man/mosquitto.conf.5.meta
@ -0,0 +1,5 @@
+.. title: mosquitto.conf man page
+.. slug: mosquitto-conf-5
+.. category: man
+.. type: man
+.. pretty_url: False
--- a/man/mosquitto.conf.5.xml
+++ b/man/mosquitto.conf.5.xml
@ -195,6 +195,17 @@
 					<para>Reloaded on reload signal.</para>
 				</listitem>
 			</varlistentry>
+			<varlistentry>
+				<term><option>allow_zero_length_clientid</option> [ true | false ]</term>
+				<listitem>
+					<para>MQTT 3.1.1 allows clients to connect with a zero
+						length client id and have the broker generate a client
+						id for them. Use this option to allow/disallow this
+						behaviour. Defaults to true.</para>
+					<para>See also the <option>auto_id_prefix</option> option.</para>
+					<para>Reloaded on reload signal.</para>
+				</listitem>
+			</varlistentry>
 			<varlistentry>
 				<term><option>auth_opt_*</option> <replaceable>value</replaceable></term>
 				<listitem>
@ -244,6 +255,17 @@
 					<para>Not currently reloaded on reload signal.</para>
 				</listitem>
 			</varlistentry>
+			<varlistentry>
+				<term><option>auto_id_prefix</option> <replaceable>prefix</replaceable></term>
+				<listitem>
+					<para>If <option>allow_zero_length_clientid</option> is
+						<replaceable>true</replaceable>, this option allows you
+						to set a string that will be prefixed to the
+						automatically generated client ids to aid visibility in
+						logs. Defaults to no prefix.</para>
+					<para>Reloaded on reload signal.</para>
+				</listitem>
+			</varlistentry>
 			<varlistentry>
 				<term><option>autosave_interval</option> <replaceable>seconds</replaceable></term>
 				<listitem>
@ -763,7 +785,7 @@
 							client connected to a listener with mount point
 							<replaceable>example</replaceable> can only see
 							messages that are published in the topic hierarchy
-							<replaceable>example</replaceable> and above.</para>
+							<replaceable>example</replaceable> and below.</para>
 						<para>Not reloaded on reload signal.</para>
 					</listitem>
 				</varlistentry>
--- a/man/mosquitto_passwd.1.meta
+++ b/man/mosquitto_passwd.1.meta
@ -0,0 +1,5 @@
+.. title: mosquitto_passwd man page
+.. slug: mosquitto_passwd-1
+.. category: man
+.. type: man
+.. pretty_url: False
--- a/man/mosquitto_pub.1.meta
+++ b/man/mosquitto_pub.1.meta
@ -0,0 +1,5 @@
+.. title: mosquitto_pub man page
+.. slug: mosquitto_pub-1
+.. category: man
+.. type: man
+.. pretty_url: False
--- a/man/mosquitto_sub.1.meta
+++ b/man/mosquitto_sub.1.meta
@ -0,0 +1,5 @@
+.. title: mosquitto_sub man page
+.. slug: mosquitto_sub-1
+.. category: man
+.. type: man
+.. pretty_url: False
--- a/man/mosquitto_sub.1.xml
+++ b/man/mosquitto_sub.1.xml
@ -36,6 +36,7 @@
 			<arg><option>-c</option></arg>
 			<arg><option>-C</option> <replaceable>msg count</replaceable></arg>
 			<arg><option>-d</option></arg>
+			<arg><option>-E</option></arg>
 			<arg><option>-i</option> <replaceable>client_id</replaceable></arg>
 			<arg><option>-I</option> <replaceable>client id prefix</replaceable></arg>
 			<arg><option>-k</option> <replaceable>keepalive time</replaceable></arg>
@ -209,6 +210,18 @@
 					<para>Enable debug messages.</para>
 				</listitem>
 			</varlistentry>
+			<varlistentry>
+				<term><option>-E</option></term>
+				<listitem>
+					<para>If this option is given,
+						<command>mosquitto_sub</command> will exit immediately
+						that all of its subscriptions have been acknowledged by
+						the broker. In conjunction with <option>-c</option>
+						this allows a durable client session to be initialised
+						on the broker for future use without requiring any
+						messages to be received.</para>
+				</listitem>
+			</varlistentry>
 			<varlistentry>
 				<term><option>-F</option></term>
 				<listitem>
--- a/man/mqtt.7.meta
+++ b/man/mqtt.7.meta
@ -0,0 +1,6 @@
+.. title: MQTT man page
+.. slug: mqtt-7
+.. category: man
+.. type: man
+.. pretty_url: False
+.. hide_title: True
--- a/set-version.sh
+++ b/set-version.sh
@ -2,7 +2,7 @@

 MAJOR=1
 MINOR=5
-REVISION=1
+REVISION=3

 sed -i "s/^VERSION=.*/VERSION=${MAJOR}.${MINOR}.${REVISION}/" config.mk

--- a/snap/local/default_config.conf
+++ b/snap/local/default_config.conf
--- a/snap/local/launcher.sh
+++ b/snap/local/launcher.sh
--- a/snap/snapcraft.yaml
+++ b/snap/snapcraft.yaml
@ -1,5 +1,5 @@
 name: mosquitto
-version: 1.5.1
+version: 1.5.3
 summary: Eclipse Mosquitto MQTT broker
 description: This is a message broker that supports version 3.1 and 3.1.1 of the MQTT
    protocol.
@ -30,7 +30,7 @@ apps:
 parts:
  script:
    plugin: dump
-    source: snap/
+    source: snap/local/
    prime:
      - default_config.conf
      - launcher.sh
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@ -51,6 +51,11 @@ set (MOSQ_SRCS
 	../lib/will_mosq.c ../lib/will_mosq.h)


+option(WITH_BUNDLED_DEPS "Build with bundled dependencies?" ON)
+if (${WITH_BUNDLED_DEPS} STREQUAL ON)
+	include_directories(${mosquitto_SOURCE_DIR} ${mosquitto_SOURCE_DIR}/src/deps)
+endif (${WITH_BUNDLED_DEPS} STREQUAL ON)
+
 option(INC_BRIDGE_SUPPORT
 	"Include bridge support for connecting to other brokers?" ON)
 if (${INC_BRIDGE_SUPPORT} STREQUAL ON)
--- a/src/bridge.c
+++ b/src/bridge.c
@ -145,6 +145,9 @@ int bridge__connect_step1(struct mosquitto_db *db, struct mosquitto *context)
 		if(context->bridge->topics[i].direction == bd_out || context->bridge->topics[i].direction == bd_both){
 			log__printf(NULL, MOSQ_LOG_DEBUG, "Bridge %s doing local SUBSCRIBE on topic %s", context->id, context->bridge->topics[i].local_topic);
 			if(sub__add(db, context, context->bridge->topics[i].local_topic, context->bridge->topics[i].qos, &db->subs)) return 1;
+			sub__retain_queue(db, context,
+					context->bridge->topics[i].local_topic,
+					context->bridge->topics[i].qos);
 		}
 	}

@ -182,7 +185,7 @@ int bridge__connect_step1(struct mosquitto_db *db, struct mosquitto *context)
 		}
 	}

-	log__printf(NULL, MOSQ_LOG_NOTICE, "Connecting bridge %s (%s:%d)", context->bridge->name, context->bridge->addresses[context->bridge->cur_address].address, context->bridge->addresses[context->bridge->cur_address].port);
+	log__printf(NULL, MOSQ_LOG_NOTICE, "Connecting bridge (step 1) %s (%s:%d)", context->bridge->name, context->bridge->addresses[context->bridge->cur_address].address, context->bridge->addresses[context->bridge->cur_address].port);
 	rc = net__try_connect_step1(context, context->bridge->addresses[context->bridge->cur_address].address);
 	if(rc > 0 ){
 		if(rc == MOSQ_ERR_TLS){
@ -207,23 +210,9 @@ int bridge__connect_step2(struct mosquitto_db *db, struct mosquitto *context)

 	if(!context || !context->bridge) return MOSQ_ERR_INVAL;

-	log__printf(NULL, MOSQ_LOG_NOTICE, "Connecting bridge %s (%s:%d)", context->bridge->name, context->bridge->addresses[context->bridge->cur_address].address, context->bridge->addresses[context->bridge->cur_address].port);
+	log__printf(NULL, MOSQ_LOG_NOTICE, "Connecting bridge (step 2) %s (%s:%d)", context->bridge->name, context->bridge->addresses[context->bridge->cur_address].address, context->bridge->addresses[context->bridge->cur_address].port);
 	rc = net__try_connect_step2(context, context->bridge->addresses[context->bridge->cur_address].port, &context->sock);
-	if(rc > 0 ){
-		if(rc == MOSQ_ERR_TLS){
-			net__socket_close(db, context);
-			return rc; /* Error already printed */
-		}else if(rc == MOSQ_ERR_ERRNO){
-			log__printf(NULL, MOSQ_LOG_ERR, "Error creating bridge: %s.", strerror(errno));
-		}else if(rc == MOSQ_ERR_EAI){
-			log__printf(NULL, MOSQ_LOG_ERR, "Error creating bridge: %s.", gai_strerror(errno));
-		}
-
-		return rc;
-	}
-
-	rc = net__socket_connect_step3(context, context->bridge->addresses[context->bridge->cur_address].address, context->bridge->addresses[context->bridge->cur_address].port, NULL, false);
-	if(rc > 0 ){
+	if(rc > 0){
 		if(rc == MOSQ_ERR_TLS){
 			net__socket_close(db, context);
 			return rc; /* Error already printed */
@ -241,6 +230,32 @@ int bridge__connect_step2(struct mosquitto_db *db, struct mosquitto *context)
 	if(rc == MOSQ_ERR_CONN_PENDING){
 		context->state = mosq_cs_connect_pending;
 	}
+	return rc;
+}
+
+
+int bridge__connect_step3(struct mosquitto_db *db, struct mosquitto *context)
+{
+	int rc;
+
+	rc = net__socket_connect_step3(context, context->bridge->addresses[context->bridge->cur_address].address, context->bridge->addresses[context->bridge->cur_address].port, NULL, false);
+	if(rc > 0){
+		if(rc == MOSQ_ERR_TLS){
+			net__socket_close(db, context);
+			return rc; /* Error already printed */
+		}else if(rc == MOSQ_ERR_ERRNO){
+			log__printf(NULL, MOSQ_LOG_ERR, "Error creating bridge: %s.", strerror(errno));
+		}else if(rc == MOSQ_ERR_EAI){
+			log__printf(NULL, MOSQ_LOG_ERR, "Error creating bridge: %s.", gai_strerror(errno));
+		}
+
+		return rc;
+	}
+
+	if(context->bridge->round_robin == false && context->bridge->cur_address != 0){
+		context->bridge->primary_retry = mosquitto_time() + 5;
+	}
+
 	rc = send__connect(context, context->keepalive, context->clean_session);
 	if(rc == MOSQ_ERR_SUCCESS){
 		return MOSQ_ERR_SUCCESS;
@ -262,7 +277,7 @@ int bridge__connect_step2(struct mosquitto_db *db, struct mosquitto *context)

 int bridge__connect(struct mosquitto_db *db, struct mosquitto *context)
 {
-	int rc;
+	int rc, rc2;
 	int i;
 	char *notification_topic;
 	int notification_topic_len;
@ -296,6 +311,9 @@ int bridge__connect(struct mosquitto_db *db, struct mosquitto *context)
 		if(context->bridge->topics[i].direction == bd_out || context->bridge->topics[i].direction == bd_both){
 			log__printf(NULL, MOSQ_LOG_DEBUG, "Bridge %s doing local SUBSCRIBE on topic %s", context->id, context->bridge->topics[i].local_topic);
 			if(sub__add(db, context, context->bridge->topics[i].local_topic, context->bridge->topics[i].qos, &db->subs)) return 1;
+			sub__retain_queue(db, context,
+					context->bridge->topics[i].local_topic,
+					context->bridge->topics[i].qos);
 		}
 	}

@ -340,7 +358,7 @@ int bridge__connect(struct mosquitto_db *db, struct mosquitto *context)

 	log__printf(NULL, MOSQ_LOG_NOTICE, "Connecting bridge %s (%s:%d)", context->bridge->name, context->bridge->addresses[context->bridge->cur_address].address, context->bridge->addresses[context->bridge->cur_address].port);
 	rc = net__socket_connect(context, context->bridge->addresses[context->bridge->cur_address].address, context->bridge->addresses[context->bridge->cur_address].port, NULL, false);
-	if(rc > 0 ){
+	if(rc > 0){
 		if(rc == MOSQ_ERR_TLS){
 			net__socket_close(db, context);
 			return rc; /* Error already printed */
@ -351,28 +369,27 @@ int bridge__connect(struct mosquitto_db *db, struct mosquitto *context)
 		}

 		return rc;
+	}else if(rc == MOSQ_ERR_CONN_PENDING){
+		context->state = mosq_cs_connect_pending;
 	}

 	HASH_ADD(hh_sock, db->contexts_by_sock, sock, sizeof(context->sock), context);

-	if(rc == MOSQ_ERR_CONN_PENDING){
-		context->state = mosq_cs_connect_pending;
-	}
-	rc = send__connect(context, context->keepalive, context->clean_session);
-	if(rc == MOSQ_ERR_SUCCESS){
-		return MOSQ_ERR_SUCCESS;
-	}else if(rc == MOSQ_ERR_ERRNO && errno == ENOTCONN){
+	rc2 = send__connect(context, context->keepalive, context->clean_session);
+	if(rc2 == MOSQ_ERR_SUCCESS){
+		return rc;
+	}else if(rc2 == MOSQ_ERR_ERRNO && errno == ENOTCONN){
 		return MOSQ_ERR_SUCCESS;
 	}else{
-		if(rc == MOSQ_ERR_TLS){
-			return rc; /* Error already printed */
-		}else if(rc == MOSQ_ERR_ERRNO){
+		if(rc2 == MOSQ_ERR_TLS){
+			return rc2; /* Error already printed */
+		}else if(rc2 == MOSQ_ERR_ERRNO){
 			log__printf(NULL, MOSQ_LOG_ERR, "Error creating bridge: %s.", strerror(errno));
-		}else if(rc == MOSQ_ERR_EAI){
+		}else if(rc2 == MOSQ_ERR_EAI){
 			log__printf(NULL, MOSQ_LOG_ERR, "Error creating bridge: %s.", gai_strerror(errno));
 		}
 		net__socket_close(db, context);
-		return rc;
+		return rc2;
 	}
 }
 #endif
--- a/src/conf.c
+++ b/src/conf.c
@ -1157,6 +1157,7 @@ int config__read_file_core(struct mosquitto__config *config, bool reload, struct
 						cur_bridge->try_private = true;
 						cur_bridge->attempt_unsubscribe = true;
 						cur_bridge->protocol_version = mosq_p_mqtt311;
+						cur_bridge->primary_retry_sock = INVALID_SOCKET;
 					}else{
 						log__printf(NULL, MOSQ_LOG_ERR, "Error: Empty connection value in configuration.");
 						return MOSQ_ERR_INVAL;
@ -1207,8 +1208,8 @@ int config__read_file_core(struct mosquitto__config *config, bool reload, struct
 						snprintf(dirpath, MAX_PATH, "%s\\*.conf", token);
 						fh = FindFirstFile(dirpath, &find_data);
 						if(fh == INVALID_HANDLE_VALUE){
-							log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to open include_dir '%s'.", token);
-							return 1;
+							/* No files found */
+							continue;
 						}

 						do{
--- a/src/context.c
+++ b/src/context.c
@ -161,6 +161,10 @@ void context__cleanup(struct mosquitto_db *db, struct mosquitto *context, bool d
 		mosquitto__free(context->id);
 		context->id = NULL;
 	}
+	if(context->old_id){
+		mosquitto__free(context->old_id);
+		context->old_id = NULL;
+	}
 	packet__cleanup(&(context->in_packet));
 	if(context->current_out_packet){
 		packet__cleanup(context->current_out_packet);
--- a/src/deps/uthash.h
+++ b/src/deps/uthash.h
--- a/src/handle_connack.c
+++ b/src/handle_connack.c
@ -76,7 +76,7 @@ int handle__connack(struct mosquitto_db *db, struct mosquitto *context)
 				}
 				for(i=0; i<context->bridge->topic_count; i++){
 					if(context->bridge->topics[i].direction == bd_in || context->bridge->topics[i].direction == bd_both){
-						if(send__subscribe(context, NULL, context->bridge->topics[i].remote_topic, context->bridge->topics[i].qos)){
+						if(send__subscribe(context, NULL, 1, &context->bridge->topics[i].remote_topic, &context->bridge->topics[i].qos)){
 							return 1;
 						}
 					}else{
--- a/src/loop.c
+++ b/src/loop.c
@ -17,6 +17,10 @@ Contributors:

 #include "config.h"

+#ifndef WIN32
+#  define _GNU_SOURCE
+#endif
+
 #include <assert.h>
 #ifndef WIN32
 #ifdef WITH_EPOLL
@ -121,11 +125,12 @@ int mosquitto_main_loop(struct mosquitto_db *db, mosq_sock_t *listensock, int li
 	int pollfd_max;
 #endif
 #ifdef WITH_BRIDGE
-	mosq_sock_t bridge_sock;
 	int rc;
 #endif
 	time_t expiration_check_time = 0;
 	char *id;
+	int err;
+	socklen_t len;

 #ifndef WIN32
 	sigemptyset(&sigblock);
@ -227,12 +232,40 @@ int mosquitto_main_loop(struct mosquitto_db *db, mosq_sock_t *listensock, int li
 					mosquitto__check_keepalive(db, context);
 					if(context->bridge->round_robin == false
 							&& context->bridge->cur_address != 0
+							&& context->bridge->primary_retry
 							&& now > context->bridge->primary_retry){

-						if(net__try_connect(context, context->bridge->addresses[0].address, context->bridge->addresses[0].port, &bridge_sock, NULL, false) <= 0){
-							COMPAT_CLOSE(bridge_sock);
-							net__socket_close(db, context);
-							context->bridge->cur_address = context->bridge->address_count-1;
+						if(context->bridge->primary_retry_sock == INVALID_SOCKET){
+							rc = net__try_connect(context, context->bridge->addresses[0].address,
+									context->bridge->addresses[0].port,
+									&context->bridge->primary_retry_sock, NULL, false);
+
+							if(rc == 0){
+								COMPAT_CLOSE(context->bridge->primary_retry_sock);
+								context->bridge->primary_retry_sock = INVALID_SOCKET;
+								context->bridge->primary_retry = 0;
+								net__socket_close(db, context);
+								context->bridge->cur_address = 0;
+							}
+						}else{
+							len = sizeof(int);
+							if(!getsockopt(context->bridge->primary_retry_sock, SOL_SOCKET, SO_ERROR, (char *)&err, &len)){
+								if(err == 0){
+									COMPAT_CLOSE(context->bridge->primary_retry_sock);
+									context->bridge->primary_retry_sock = INVALID_SOCKET;
+									context->bridge->primary_retry = 0;
+									net__socket_close(db, context);
+									context->bridge->cur_address = context->bridge->address_count-1;
+								}else{
+									COMPAT_CLOSE(context->bridge->primary_retry_sock);
+									context->bridge->primary_retry_sock = INVALID_SOCKET;
+									context->bridge->primary_retry = now+5;
+								}
+							}else{
+								COMPAT_CLOSE(context->bridge->primary_retry_sock);
+								context->bridge->primary_retry_sock = INVALID_SOCKET;
+								context->bridge->primary_retry = now+5;
+							}
 						}
 					}
 				}
@ -320,16 +353,13 @@ int mosquitto_main_loop(struct mosquitto_db *db, mosq_sock_t *listensock, int li
 					if(context->bridge->cur_address == context->bridge->address_count){
 						context->bridge->cur_address = 0;
 					}
-					if(context->bridge->round_robin == false && context->bridge->cur_address != 0){
-						context->bridge->primary_retry = now + 5;
-					}
 				}else{
 					if((context->bridge->start_type == bst_lazy && context->bridge->lazy_reconnect)
 							|| (context->bridge->start_type == bst_automatic && now > context->bridge->restart_t)){
-						context->bridge->restart_t = 0;
+
 #if defined(__GLIBC__) && defined(WITH_ADNS)
 						if(context->adns){
-							/* Waiting on DNS lookup */
+							/* Connection attempted, waiting on DNS lookup */
 							rc = gai_error(context->adns);
 							if(rc == EAI_INPROGRESS){
 								/* Just keep on waiting */
@ -359,11 +389,14 @@ int mosquitto_main_loop(struct mosquitto_db *db, mosq_sock_t *listensock, int li
 									context->pollfd_index = pollfd_index;
 									pollfd_index++;
 #endif
+								}else if(rc == MOSQ_ERR_CONN_PENDING){
+									context->bridge->restart_t = 0;
 								}else{
 									context->bridge->cur_address++;
 									if(context->bridge->cur_address == context->bridge->address_count){
 										context->bridge->cur_address = 0;
 									}
+									context->bridge->restart_t = 0;
 								}
 							}else{
 								/* Need to retry */
@ -372,6 +405,7 @@ int mosquitto_main_loop(struct mosquitto_db *db, mosq_sock_t *listensock, int li
 								}
 								mosquitto__free(context->adns);
 								context->adns = NULL;
+								context->bridge->restart_t = 0;
 							}
 						}else{
 							rc = bridge__connect_step1(db, context);
@ -380,12 +414,19 @@ int mosquitto_main_loop(struct mosquitto_db *db, mosq_sock_t *listensock, int li
 								if(context->bridge->cur_address == context->bridge->address_count){
 									context->bridge->cur_address = 0;
 								}
+							}else{
+								/* Short wait for ADNS lookup */
+								context->bridge->restart_t = 1;
 							}
 						}
 #else
 						{
 							rc = bridge__connect(db, context);
 							if(rc == MOSQ_ERR_SUCCESS){
+								context->bridge->restart_t = 0;
+								if(context->bridge->round_robin == false && context->bridge->cur_address != 0){
+									context->bridge->primary_retry = now + 5;
+								}
 #ifdef WITH_EPOLL
 								ev.data.fd = context->sock;
 								ev.events = EPOLLIN;
@ -597,12 +638,17 @@ void do_disconnect(struct mosquitto_db *db, struct mosquitto *context)
 			context->sock = INVALID_SOCKET;
 			context->pollfd_index = -1;
 		}
+		HASH_DELETE(hh_id, db->contexts_by_id, context);
+		context->old_id = context->id;
+		context->id = NULL;
 	}else
 #endif
 	{
 		if(db->config->connection_messages == true){
 			if(context->id){
 				id = context->id;
+			}else if(context->old_id){
+				id = context->old_id;
 			}else{
 				id = "<unknown>";
 			}
@ -706,6 +752,12 @@ static void loop_handle_reads_writes(struct mosquitto_db *db, struct pollfd *pol
 				if(!getsockopt(context->sock, SOL_SOCKET, SO_ERROR, (char *)&err, &len)){
 					if(err == 0){
 						context->state = mosq_cs_new;
+#ifdef WITH_ADNS
+						if(context->bridge){
+							bridge__connect_step3(db, context);
+							continue;
+						}
+#endif
 					}
 				}else{
 					do_disconnect(db, context);
--- a/src/mosquitto.c
+++ b/src/mosquitto.c
@ -94,6 +94,12 @@ int drop_privileges(struct mosquitto__config *config, bool temporary)
 	char err[256];
 	int rc;

+	const char *snap = getenv("SNAP_NAME");
+	if(snap && !strcmp(snap, "mosquitto")){
+		/* Don't attempt to drop privileges if running as a snap */
+		return MOSQ_ERR_SUCCESS;
+	}
+
 	if(geteuid() == 0){
 		if(config->user && strcmp(config->user, "root")){
 			pwd = getpwnam(config->user);
@ -238,7 +244,7 @@ int main(int argc, char *argv[])

 	memset(&int_db, 0, sizeof(struct mosquitto_db));

-	net__init();
+	net__broker_init();

 	config__init(&int_db, &config);
 	rc = config__parse_args(&int_db, &config, argc, argv);
@ -432,7 +438,7 @@ int main(int argc, char *argv[])
 	}

 	config__cleanup(int_db.config);
-	net__cleanup();
+	net__broker_cleanup();

 	return rc;
 }
--- a/src/mosquitto_broker_internal.h
+++ b/src/mosquitto_broker_internal.h
@ -428,6 +428,7 @@ struct mosquitto__bridge{
 	int cur_address;
 	int address_count;
 	time_t primary_retry;
+	mosq_sock_t primary_retry_sock;
 	bool round_robin;
 	bool try_private;
 	bool try_private_accepted;
@ -514,6 +515,8 @@ int send__suback(struct mosquitto *context, uint16_t mid, uint32_t payloadlen, c
 /* ============================================================
 * Network functions
 * ============================================================ */
+void net__broker_init(void);
+void net__broker_cleanup(void);
 int net__socket_accept(struct mosquitto_db *db, mosq_sock_t listensock);
 int net__socket_listen(struct mosquitto__listener *listener);
 int net__socket_get_address(mosq_sock_t sock, char *buf, int len);
@ -596,6 +599,7 @@ int bridge__new(struct mosquitto_db *db, struct mosquitto__bridge *bridge);
 int bridge__connect(struct mosquitto_db *db, struct mosquitto *context);
 int bridge__connect_step1(struct mosquitto_db *db, struct mosquitto *context);
 int bridge__connect_step2(struct mosquitto_db *db, struct mosquitto *context);
+int bridge__connect_step3(struct mosquitto_db *db, struct mosquitto *context);
 void bridge__packet_cleanup(struct mosquitto *context);
 #endif

--- a/src/net.c
+++ b/src/net.c
@ -59,6 +59,25 @@ static int tls_ex_index_listener = -1;

 #include "sys_tree.h"

+/* For EMFILE handling */
+static mosq_sock_t spare_sock = INVALID_SOCKET;
+
+void net__broker_init(void)
+{
+	spare_sock = socket(AF_INET, SOCK_STREAM, 0);
+	net__init();
+}
+
+
+void net__broker_cleanup(void)
+{
+	if(spare_sock != INVALID_SOCKET){
+		COMPAT_CLOSE(spare_sock);
+		spare_sock = INVALID_SOCKET;
+	}
+	net__cleanup();
+}
+

 static void net__print_error(int log, const char *format_str)
 {
@ -97,7 +116,31 @@ int net__socket_accept(struct mosquitto_db *db, mosq_sock_t listensock)
 #endif

 	new_sock = accept(listensock, NULL, 0);
-	if(new_sock == INVALID_SOCKET) return -1;
+	if(new_sock == INVALID_SOCKET){
+#ifdef WIN32
+		errno = WSAGetLastError();
+		if(errno == WSAEMFILE){
+#else
+		if(errno == EMFILE || errno == ENFILE){
+#endif
+			/* Close the spare socket, which means we should be able to accept
+			 * this connection. Accept it, then close it immediately and create
+			 * a new spare_sock. This prevents the situation of ever properly
+			 * running out of sockets.
+			 * It would be nice to send a "server not available" connack here,
+			 * but there are lots of reasons why this would be tricky (TLS
+			 * being the big one). */
+			COMPAT_CLOSE(spare_sock);
+			new_sock = accept(listensock, NULL, 0);
+			if(new_sock != INVALID_SOCKET){
+				COMPAT_CLOSE(new_sock);
+			}
+			spare_sock = socket(AF_INET, SOCK_STREAM, 0);
+			log__printf(NULL, MOSQ_LOG_WARNING,
+					"Unable to accept new connection, system socket count has been exceeded. Try increasing \"ulimit -n\" or equivalent.");
+		}
+		return -1;
+	}

 	G_SOCKET_CONNECTIONS_INC();

@ -121,7 +164,7 @@ int net__socket_accept(struct mosquitto_db *db, mosq_sock_t listensock)

 	if(db->config->set_tcp_nodelay){
 		int flag = 1;
-		if(setsockopt(new_sock, IPPROTO_TCP, TCP_NODELAY, &flag, sizeof(int) != 0)){
+		if(setsockopt(new_sock, IPPROTO_TCP, TCP_NODELAY, &flag, sizeof(int)) != 0){
 			log__printf(NULL, MOSQ_LOG_WARNING, "Warning: Unable to set TCP_NODELAY.");
 		}
 	}
--- a/src/security_default.c
+++ b/src/security_default.c
@ -786,6 +786,7 @@ int mosquitto_unpwd_check_default(struct mosquitto_db *db, struct mosquitto *con
 	if(!db) return MOSQ_ERR_INVAL;

 	if(db->config->per_listener_settings){
+		if(context->bridge) return MOSQ_ERR_SUCCESS;
 		if(!context->listener) return MOSQ_ERR_INVAL;
 		if(!context->listener->unpwd) return MOSQ_ERR_PLUGIN_DEFER;
 		unpwd_ref = context->listener->unpwd;
@ -867,7 +868,12 @@ int mosquitto_security_apply_default(struct mosquitto_db *db)
 	HASH_ITER(hh_id, db->contexts_by_id, context, ctxt_tmp){
 		/* Check for anonymous clients when allow_anonymous is false */
 		if(db->config->per_listener_settings){
-			allow_anonymous = context->listener->security_options.allow_anonymous;
+			if(context->listener){
+				allow_anonymous = context->listener->security_options.allow_anonymous;
+			}else{
+				/* Client not currently connected, so defer judgement until it does connect */
+				allow_anonymous = true;
+			}
 		}else{
 			allow_anonymous = db->config->security_options.allow_anonymous;
 		}
--- a/src/signals.c
+++ b/src/signals.c
@ -105,7 +105,7 @@ void handle_sigusr2(int signal)
 DWORD WINAPI SigThreadProc(void* data)
 {
 	TCHAR evt_name[MAX_PATH];
-	static HANDLE evt[4];
+	static HANDLE evt[3];
 	int pid = GetCurrentProcessId();

 	sprintf_s(evt_name, MAX_PATH, "mosq%d_shutdown", pid);
--- a/src/subs.c
+++ b/src/subs.c
@ -459,7 +459,15 @@ int sub__add(struct mosquitto_db *db, struct mosquitto *context, const char *sub
 	if(sub__topic_tokenise(sub, &tokens)) return 1;

 	HASH_FIND(hh, *root, UHPA_ACCESS_TOPIC(tokens), tokens->topic_len, subhier);
-	assert(subhier);
+	if(!subhier){
+		subhier = sub__add_hier_entry(NULL, root, UHPA_ACCESS_TOPIC(tokens), tokens->topic_len);
+		if(!subhier){
+			sub__topic_tokens_free(tokens);
+			log__printf(NULL, MOSQ_LOG_ERR, "Error: Out of memory.");
+			return MOSQ_ERR_NOMEM;
+		}
+
+	}
 	rc = sub__add_recurse(db, context, qos, subhier, tokens);

 	sub__topic_tokens_free(tokens);
@ -481,8 +489,9 @@ int sub__remove(struct mosquitto_db *db, struct mosquitto *context, const char *
 	if(sub__topic_tokenise(sub, &tokens)) return 1;

 	HASH_FIND(hh, root, UHPA_ACCESS_TOPIC(tokens), tokens->topic_len, subhier);
-	assert(subhier);
-	rc = sub__remove_recurse(db, context, subhier, tokens);
+	if(subhier){
+		rc = sub__remove_recurse(db, context, subhier, tokens);
+	}

 	sub__topic_tokens_free(tokens);

@ -507,14 +516,15 @@ int sub__messages_queue(struct mosquitto_db *db, const char *source_id, const ch
 	(*stored)->ref_count++;

 	HASH_FIND(hh, db->subs, UHPA_ACCESS_TOPIC(tokens), tokens->topic_len, subhier);
-	assert(subhier);
-	if(retain){
-		/* We have a message that needs to be retained, so ensure that the subscription
-		 * tree for its topic exists.
-		 */
-		sub__add_recurse(db, NULL, 0, subhier, tokens);
+	if(subhier){
+		if(retain){
+			/* We have a message that needs to be retained, so ensure that the subscription
+			 * tree for its topic exists.
+			 */
+			sub__add_recurse(db, NULL, 0, subhier, tokens);
+		}
+		sub__search(db, subhier, tokens, source_id, topic, qos, retain, *stored, true);
 	}
-	sub__search(db, subhier, tokens, source_id, topic, qos, retain, *stored, true);
 	sub__topic_tokens_free(tokens);

 	/* Remove our reference and free if needed. */
@ -611,23 +621,25 @@ void sub__tree_print(struct mosquitto__subhier *root, int level)
 	struct mosquitto__subleaf *leaf;

 	HASH_ITER(hh, root, branch, branch_tmp){
-	for(i=0; i<(level+2)*2; i++){
-		printf(" ");
-	}
-	printf("%s", UHPA_ACCESS_TOPIC(branch));
-	leaf = branch->subs;
-	while(leaf){
-		if(leaf->context){
-			printf(" (%s, %d)", leaf->context->id, leaf->qos);
-		}else{
-			printf(" (%s, %d)", "", leaf->qos);
+	if(level > -1){
+		for(i=0; i<(level+2)*2; i++){
+			printf(" ");
 		}
-		leaf = leaf->next;
+		printf("%s", UHPA_ACCESS_TOPIC(branch));
+		leaf = branch->subs;
+		while(leaf){
+			if(leaf->context){
+				printf(" (%s, %d)", leaf->context->id, leaf->qos);
+			}else{
+				printf(" (%s, %d)", "", leaf->qos);
+			}
+			leaf = leaf->next;
+		}
+		if(branch->retained){
+			printf(" (r)");
+		}
+		printf("\n");
 	}
-	if(branch->retained){
-		printf(" (r)");
-	}
-	printf("\n");

 		sub__tree_print(branch->children, level+1);
 	}
@ -715,9 +727,10 @@ int sub__retain_queue(struct mosquitto_db *db, struct mosquitto *context, const
 	if(sub__topic_tokenise(sub, &tokens)) return 1;

 	HASH_FIND(hh, db->subs, UHPA_ACCESS_TOPIC(tokens), tokens->topic_len, subhier);
-	assert(subhier);

-	retain__search(db, subhier, tokens, context, sub, sub_qos, 0);
+	if(subhier){
+		retain__search(db, subhier, tokens, context, sub, sub_qos, 0);
+	}
 	while(tokens){
 		tail = tokens->next;
 		UHPA_FREE_TOPIC(tokens);
--- a/test/broker/03-publish-dollar.py
+++ b/test/broker/03-publish-dollar.py
@ -0,0 +1,40 @@
+#!/usr/bin/env python
+
+# Test whether a PUBLISH to a topic starting with $ succeeds
+
+import inspect, os, sys
+# From http://stackoverflow.com/questions/279237/python-import-a-module-from-a-folder
+cmd_subfolder = os.path.realpath(os.path.abspath(os.path.join(os.path.split(inspect.getfile( inspect.currentframe() ))[0],"..")))
+if cmd_subfolder not in sys.path:
+    sys.path.insert(0, cmd_subfolder)
+
+import mosq_test
+
+rc = 1
+mid = 19
+keepalive = 60
+connect_packet = mosq_test.gen_connect("pub-dollar-test", keepalive=keepalive)
+connack_packet = mosq_test.gen_connack(rc=0)
+
+publish_packet = mosq_test.gen_publish("$test/test", qos=1, mid=mid, payload="message")
+puback_packet = mosq_test.gen_puback(mid)
+
+port = mosq_test.get_port()
+broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port)
+
+try:
+    sock = mosq_test.do_client_connect(connect_packet, connack_packet, port=port)
+    mosq_test.do_send_receive(sock, publish_packet, puback_packet, "puback")
+
+    rc = 0
+
+    sock.close()
+finally:
+    broker.terminate()
+    broker.wait()
+    (stdo, stde) = broker.communicate()
+    if rc:
+        print(stde)
+
+exit(rc)
+
--- a/test/broker/Makefile
+++ b/test/broker/Makefile
@ -62,6 +62,7 @@ endif
 	./03-pattern-matching.py
 	#./03-publish-qos1-queued-bytes.py
 	./03-publish-invalid-utf8.py
+	./03-publish-dollar.py

 04 :
 	./04-retain-qos0.py
--- a/test/broker/ptest.py
+++ b/test/broker/ptest.py
@ -44,6 +44,7 @@ tests = [
    (1, './03-pattern-matching.py'),
    #(1, './03-publish-qos1-queued-bytes.py'),
    (1, './03-publish-invalid-utf8.py'),
+    (1, './03-publish-dollar.py'),

    (1, './04-retain-qos0.py'),
    (1, './04-retain-qos0-fresh.py'),
--- a/test/ssl/all-ca.crt
+++ b/test/ssl/all-ca.crt
@ -2,74 +2,74 @@ Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
-    Signature Algorithm: sha1WithRSAEncryption
+    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=Derbyshire, L=Derby, O=Mosquitto Project, OU=Testing, CN=Root CA
        Validity
-            Not Before: Aug 30 22:03:18 2013 GMT
-            Not After : Aug 29 22:03:18 2018 GMT
+            Not Before: Sep 18 10:49:47 2018 GMT
+            Not After : Sep 17 10:49:47 2023 GMT
        Subject: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
-                    00:a4:b5:b9:31:d8:b4:d6:de:49:c0:cc:15:3f:b8:
-                    50:8b:be:4a:f4:d3:94:a9:dd:53:2a:e9:df:aa:0d:
-                    3c:08:7b:a7:51:6d:b9:44:98:b7:8d:03:ab:67:9e:
-                    e1:c4:23:4d:33:8d:0a:90:9f:c6:de:82:14:4c:f6:
-                    75:5d:a4:e1:a3:ea:fc:9b:79:dd:cb:36:20:87:a3:
-                    9d:eb:e6:5b:0c:53:34:73:cb:dd:a8:e4:0e:7f:f0:
-                    5f:8a:3c:d8:8f:01:ff:66:31:16:41:1b:e3:7a:61:
-                    2c:3d:44:a5:a9:dd:1d:42:e5:5a:a1:df:29:35:dc:
-                    91:5e:9d:82:60:0d:7a:08:db
+                    00:b7:32:f2:08:04:4c:77:03:70:3e:10:88:84:cd:
+                    cd:f2:87:2f:3c:67:8f:78:01:5e:d5:51:f1:11:68:
+                    4d:a7:e2:73:b0:69:b5:67:07:59:88:cc:b8:7f:ce:
+                    97:52:bc:fb:73:7b:60:95:a2:7b:c2:9a:f1:4d:5a:
+                    c4:42:55:c4:6e:02:50:a1:71:41:68:d1:6c:96:e0:
+                    3d:af:10:3f:7b:64:c1:3a:3a:c3:a9:39:71:08:29:
+                    45:c8:cc:da:33:65:b4:70:fb:36:bc:15:0d:a7:31:
+                    ef:d5:ec:59:ac:75:2b:77:35:0b:f0:db:3d:14:f5:
+                    9a:41:e6:a0:b7:b7:62:2b:e7
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
-                40:43:50:14:D1:63:7E:0B:7C:97:14:20:63:E5:8A:95:96:9F:D4:AB
+                EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52
            X509v3 Authority Key Identifier: 
-                keyid:28:8D:BF:F8:DE:D1:F5:BB:26:37:A4:4D:27:FD:37:91:EC:6B:0C:DD
+                keyid:DA:20:AB:E0:98:22:39:28:E0:70:D6:74:65:53:26:E0:6B:4C:96:39

            X509v3 Basic Constraints: 
                CA:TRUE
-    Signature Algorithm: sha1WithRSAEncryption
-         8a:b1:49:b4:53:eb:bb:9d:5e:20:f4:d7:8d:b8:24:a1:28:95:
-         56:72:03:ed:15:ef:f0:ff:65:b5:6e:34:cf:27:83:7b:57:40:
-         a7:93:61:f0:93:ff:02:b4:74:e0:43:dc:65:0c:e8:a6:20:f9:
-         8c:88:82:8f:0e:8d:33:4d:ba:bb:28:ff:29:5f:a8:96:60:31:
-         f5:13:15:19:60:a4:00:0e:fc:a7:79:b6:10:95:0b:7b:88:75:
-         03:ec:7d:94:63:9e:67:2e:2e:9c:fe:79:89:61:93:75:52:f2:
-         36:48:a6:2d:c0:b2:a7:36:c2:36:50:53:b3:cd:e7:07:1d:e5:
-         6a:1d
+    Signature Algorithm: sha256WithRSAEncryption
+         8a:98:17:cd:e1:dc:2b:1b:5b:16:40:99:21:c4:d4:db:3f:5c:
+         6a:ed:7b:a2:b6:df:aa:7c:d8:6a:3f:11:39:da:4c:ce:3f:e5:
+         99:6a:a4:b8:82:1e:53:7a:5d:f1:52:be:df:f1:3b:59:9a:a8:
+         bb:7e:f1:30:33:4b:7c:c3:ab:85:1e:c4:0e:ac:d1:7e:2b:cb:
+         9d:19:5b:df:94:b4:89:e1:da:5d:31:19:85:34:d5:33:55:f8:
+         af:92:ea:9a:17:c9:da:68:00:df:10:e9:e4:33:35:cd:15:57:
+         80:56:1a:58:94:37:d7:f2:02:de:9b:0b:d3:02:64:c5:8e:6f:
+         25:31
 -----BEGIN CERTIFICATE-----
-MIICnTCCAgagAwIBAgIBATANBgkqhkiG9w0BAQUFADByMQswCQYDVQQGEwJHQjET
+MIICnTCCAgagAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJHQjET
 MBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkxGjAYBgNVBAoMEU1v
 c3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAwDgYDVQQDDAdSb290
-IENBMB4XDTEzMDgzMDIyMDMxOFoXDTE4MDgyOTIyMDMxOFowZTELMAkGA1UEBhMC
+IENBMB4XDTE4MDkxODEwNDk0N1oXDTIzMDkxNzEwNDk0N1owZTELMAkGA1UEBhMC
 R0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxGjAYBgNVBAoMEU1vc3F1aXR0byBQcm9q
 ZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRMwEQYDVQQDDApTaWduaW5nIENBMIGfMA0G
-CSqGSIb3DQEBAQUAA4GNADCBiQKBgQCktbkx2LTW3knAzBU/uFCLvkr005Sp3VMq
-6d+qDTwIe6dRbblEmLeNA6tnnuHEI00zjQqQn8beghRM9nVdpOGj6vybed3LNiCH
-o53r5lsMUzRzy92o5A5/8F+KPNiPAf9mMRZBG+N6YSw9RKWp3R1C5Vqh3yk13JFe
-nYJgDXoI2wIDAQABo1AwTjAdBgNVHQ4EFgQUQENQFNFjfgt8lxQgY+WKlZaf1Ksw
-HwYDVR0jBBgwFoAUKI2/+N7R9bsmN6RNJ/03kexrDN0wDAYDVR0TBAUwAwEB/zAN
-BgkqhkiG9w0BAQUFAAOBgQCKsUm0U+u7nV4g9NeNuCShKJVWcgPtFe/w/2W1bjTP
-J4N7V0Cnk2Hwk/8CtHTgQ9xlDOimIPmMiIKPDo0zTbq7KP8pX6iWYDH1ExUZYKQA
-DvynebYQlQt7iHUD7H2UY55nLi6c/nmJYZN1UvI2SKYtwLKnNsI2UFOzzecHHeVq
-HQ==
+CSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3MvIIBEx3A3A+EIiEzc3yhy88Z494AV7V
+UfERaE2n4nOwabVnB1mIzLh/zpdSvPtze2CVonvCmvFNWsRCVcRuAlChcUFo0WyW
+4D2vED97ZME6OsOpOXEIKUXIzNozZbRw+za8FQ2nMe/V7FmsdSt3NQvw2z0U9ZpB
+5qC3t2Ir5wIDAQABo1AwTjAdBgNVHQ4EFgQU7mC7xxdf03KsM+6OhMwt2xrMilIw
+HwYDVR0jBBgwFoAU2iCr4JgiOSjgcNZ0ZVMm4GtMljkwDAYDVR0TBAUwAwEB/zAN
+BgkqhkiG9w0BAQsFAAOBgQCKmBfN4dwrG1sWQJkhxNTbP1xq7Xuitt+qfNhqPxE5
+2kzOP+WZaqS4gh5Tel3xUr7f8TtZmqi7fvEwM0t8w6uFHsQOrNF+K8udGVvflLSJ
+4dpdMRmFNNUzVfivkuqaF8naaADfEOnkMzXNFVeAVhpYlDfX8gLemwvTAmTFjm8l
+MQ==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICsjCCAhugAwIBAgIJAPTHt3psLAUTMA0GCSqGSIb3DQEBBQUAMHIxCzAJBgNV
+MIICsjCCAhugAwIBAgIJAOcAUKw/VPlMMA0GCSqGSIb3DQEBCwUAMHIxCzAJBgNV
 BAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYDVQQHDAVEZXJieTEaMBgG
 A1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsMB1Rlc3RpbmcxEDAOBgNV
-BAMMB1Jvb3QgQ0EwHhcNMTMwODMwMjIwMzE2WhcNMjMwODI4MjIwMzE2WjByMQsw
+BAMMB1Jvb3QgQ0EwHhcNMTgwOTE4MTA0OTQ3WhcNMjgwOTE1MTA0OTQ3WjByMQsw
 CQYDVQQGEwJHQjETMBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkx
 GjAYBgNVBAoMEU1vc3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAw
-DgYDVQQDDAdSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDB3KGu
-pkiSYbDAaH0ewiCb44CLsAdV5PdYgZHH0jlH8oXkNH0MU3qs7Se2UWrnPQb1VbdI
-K2DpSTk+3XuWO0BOqQ+/JuRFN/omwrucyKcRNm4MQP1aY2Tm04zsP0Muy4aSyMIk
-F6jxQzAmIgj8VgkQ/y/knS5tbQ2kkoWKRn1RCQIDAQABo1AwTjAdBgNVHQ4EFgQU
-KI2/+N7R9bsmN6RNJ/03kexrDN0wHwYDVR0jBBgwFoAUKI2/+N7R9bsmN6RNJ/03
-kexrDN0wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQCn2WxbxDd5ar2U
-UvttJW4I+/V1h3iAQCXVDAegOGzsYp3cfIdd2oZY++Q9FhzHh8nP18D+CeC9MMu2
-H2iLULUV08cGSaDLlpo1eq2oJc5ygLOEt/XK7/aIMRwrlP/CoSrI2GPkeA8rka96
-G0WtyGRkzqBKHpt6CnseA2evP5NVcQ==
+DgYDVQQDDAdSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCeTh1y
+KRZ1NIeLVvhBxSQC3Cvfe9L3IC8415CVbgipLgZKe7Nl1JBqFYDxXKBn2eVQ6EwL
+sCz+U2oa2oCql8r5eYEKpmWFiIcKdrL8aSXNvMKEOu0AJlsIXBe2sDFPxuuw143n
+W/odqBiWedciVd5pmJWZZ93neWdkkjnPZZMN4wIDAQABo1AwTjAdBgNVHQ4EFgQU
+2iCr4JgiOSjgcNZ0ZVMm4GtMljkwHwYDVR0jBBgwFoAU2iCr4JgiOSjgcNZ0ZVMm
+4GtMljkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBIs2GY/GQL76rz
+0qSWZvQ7l+HovHdp7C49auI+hiSRAzv3p2y7y3DmZrpmYJlTZJWlaA8eg769sLg
+Cyfkt6AIsZPadJiTTUayh8oCF5aMH+OetC+63USFBNYXJN6AOXp9vu/K3TdM8ao6
+WsAf26+DKYAPmvu+oU7ScpCrCSdC+Q==
 -----END CERTIFICATE-----
--- a/test/ssl/client-encrypted.crt
+++ b/test/ssl/client-encrypted.crt
@ -5,55 +5,57 @@ Certificate:
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA
        Validity
-            Not Before: May 26 12:50:49 2014 GMT
-            Not After : May 25 12:50:49 2019 GMT
-        Subject: CN=test client encrypted
+            Not Before: Sep 18 10:50:08 2018 GMT
+            Not After : Sep 17 10:50:08 2023 GMT
+        Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production, CN=test client encrypted
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
-                    00:b5:a1:d6:a3:c8:4d:a1:e8:6a:4e:cc:ae:c0:42:
-                    2b:4a:37:38:8e:60:2f:0d:b0:c7:30:b9:d7:f2:01:
-                    2a:ce:5c:1e:c1:5e:e5:d8:a3:99:03:55:9f:62:ee:
-                    9a:2f:5a:04:26:5a:88:79:86:cf:0c:fb:d1:7e:4e:
-                    41:91:0f:07:27:14:bc:0e:bd:e1:4a:b8:9d:68:52:
-                    42:91:d7:70:f1:94:64:3c:ad:35:5e:00:41:7d:65:
-                    cb:a5:6d:7f:c0:92:e8:bd:8f:06:20:c3:1e:ca:dd:
-                    a6:80:1a:53:78:3f:5a:27:6d:62:63:7a:2b:3d:15:
-                    24:3e:1e:ee:6d:ad:ef:32:3d
+                    00:b6:a9:fe:16:1b:58:bb:96:6c:6e:a4:cf:39:60:
+                    d0:0a:8c:18:9c:0c:75:eb:6f:5b:31:f9:1f:15:a5:
+                    c8:7b:85:c1:cc:fc:1b:72:ba:af:ef:08:b8:e6:31:
+                    bb:e7:20:cb:6a:f1:af:9c:db:df:12:71:3c:d2:98:
+                    fb:14:dd:87:63:ed:6f:49:ab:30:12:aa:45:ab:ad:
+                    50:21:84:b5:9d:3e:b1:36:8e:92:87:e6:ee:b5:3b:
+                    9e:da:25:88:74:d9:28:c8:1f:6c:93:29:e7:1d:14:
+                    dc:dc:14:72:1f:b9:84:32:a1:09:d7:cc:e5:21:a8:
+                    30:8c:d7:73:d7:b1:6f:2d:b7
                Exponent: 65537 (0x10001)
        X509v3 extensions:
-            X509v3 Basic Constraints:
+            X509v3 Basic Constraints: 
                CA:FALSE
-            Netscape Comment:
+            Netscape Comment: 
                OpenSSL Generated Certificate
-            X509v3 Subject Key Identifier:
-                9D:E6:CA:2F:54:0A:F5:E4:D0:A1:44:C7:EE:D4:78:FB:75:23:C2:BF
-            X509v3 Authority Key Identifier:
-                keyid:40:43:50:14:D1:63:7E:0B:7C:97:14:20:63:E5:8A:95:96:9F:D4:AB
+            X509v3 Subject Key Identifier: 
+                CD:6E:DB:18:BC:30:76:0F:58:6D:6A:5A:1D:3E:AB:0B:D0:DB:BA:8C
+            X509v3 Authority Key Identifier: 
+                keyid:EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52

    Signature Algorithm: sha256WithRSAEncryption
-         1e:6e:24:24:4f:ae:5d:8a:82:8f:ea:77:76:2d:2a:96:b8:f0:
-         b0:f1:16:b7:fc:35:ff:96:98:c6:08:aa:8f:93:2f:6a:5f:09:
-         e7:f2:9b:30:53:01:e1:04:8e:55:4e:fe:8e:2f:d8:14:80:35:
-         d0:29:03:6d:b4:bd:05:c9:fb:71:c5:7f:25:3c:4d:67:d4:7b:
-         33:f5:a3:ec:cd:2e:dd:4b:a9:60:80:d2:e3:74:37:ee:b7:4c:
-         22:eb:b2:e2:47:d0:42:9c:e6:74:7d:8a:d4:a9:22:5c:08:20:
-         2b:97:68:3f:de:3d:6a:37:57:9e:2c:af:84:b3:74:e9:0d:36:
-         40:e1
+         34:91:a4:18:93:ce:b6:8d:2a:17:c4:cc:48:34:3f:00:99:4f:
+         c2:2a:23:47:2f:75:fe:ef:34:da:39:12:16:63:86:9b:eb:30:
+         b3:d7:26:ff:96:4b:d6:00:c9:71:05:5d:08:c7:e1:52:70:d1:
+         ab:55:4f:2b:da:a7:ae:47:6d:b7:5d:84:2c:5e:c6:2a:3e:81:
+         63:55:99:3f:8b:e1:43:a4:0a:5a:34:4e:50:3e:f8:0a:76:53:
+         6b:e0:fc:42:14:b0:7e:ce:25:17:19:b9:d9:8b:dd:99:be:7e:
+         6a:a9:7f:ae:d8:a3:7b:c6:48:7a:04:75:3b:8f:6b:85:c1:f0:
+         43:18
 -----BEGIN CERTIFICATE-----
-MIICdjCCAd+gAwIBAgIBBTANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET
+MIIC2TCCAkKgAwIBAgIBBTANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET
 MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx
-EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTQwNTI2
-MTI1MDQ5WhcNMTkwNTI1MTI1MDQ5WjAgMR4wHAYDVQQDDBV0ZXN0IGNsaWVudCBl
-bmNyeXB0ZWQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALWh1qPITaHoak7M
-rsBCK0o3OI5gLw2wxzC51/IBKs5cHsFe5dijmQNVn2Lumi9aBCZaiHmGzwz70X5O
-QZEPBycUvA694Uq4nWhSQpHXcPGUZDytNV4AQX1ly6Vtf8CS6L2PBiDDHsrdpoAa
-U3g/WidtYmN6Kz0VJD4e7m2t7zI9AgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJYIZI
-AYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQW
-BBSd5sovVAr15NChRMfu1Hj7dSPCvzAfBgNVHSMEGDAWgBRAQ1AU0WN+C3yXFCBj
-5YqVlp/UqzANBgkqhkiG9w0BAQsFAAOBgQAebiQkT65dioKP6nd2LSqWuPCw8Ra3
-/DX/lpjGCKqPky9qXwnn8pswUwHhBI5VTv6OL9gUgDXQKQNttL0FyftxxX8lPE1n
-1Hsz9aPszS7dS6lggNLjdDfut0wi67LiR9BCnOZ0fYrUqSJcCCArl2g/3j1qN1ee
-LK+Es3TpDTZA4Q==
+EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTgwOTE4
+MTA1MDA4WhcNMjMwOTE3MTA1MDA4WjCBgjELMAkGA1UEBhMCR0IxGDAWBgNVBAgM
+D05vdHRpbmdoYW1zaGlyZTETMBEGA1UEBwwKTm90dGluZ2hhbTEPMA0GA1UECgwG
+U2VydmVyMRMwEQYDVQQLDApQcm9kdWN0aW9uMR4wHAYDVQQDDBV0ZXN0IGNsaWVu
+dCBlbmNyeXB0ZWQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALap/hYbWLuW
+bG6kzzlg0AqMGJwMdetvWzH5HxWlyHuFwcz8G3K6r+8IuOYxu+cgy2rxr5zb3xJx
+PNKY+xTdh2Ptb0mrMBKqRautUCGEtZ0+sTaOkofm7rU7ntoliHTZKMgfbJMp5x0U
+3NwUch+5hDKhCdfM5SGoMIzXc9exby23AgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJ
+YIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1Ud
+DgQWBBTNbtsYvDB2D1htalodPqsL0Nu6jDAfBgNVHSMEGDAWgBTuYLvHF1/Tcqwz
+7o6EzC3bGsyKUjANBgkqhkiG9w0BAQsFAAOBgQA0kaQYk862jSoXxMxIND8AmU/C
+KiNHL3X+7zTaORIWY4ab6zCz1yb/lkvWAMlxBV0Ix+FScNGrVU8r2qeuR223XYQs
+XsYqPoFjVZk/i+FDpApaNE5QPvgKdlNr4PxCFLB+ziUXGbnZi92Zvn5qqX+u2KN7
+xkh6BHU7j2uFwfBDGA==
 -----END CERTIFICATE-----
--- a/test/ssl/client-encrypted.key
+++ b/test/ssl/client-encrypted.key
@ -1,18 +1,18 @@
 -----BEGIN RSA PRIVATE KEY-----
 Proc-Type: 4,ENCRYPTED
-DEK-Info: DES-EDE3-CBC,A17B16521713FB61
+DEK-Info: DES-EDE3-CBC,A17E5BCB1FEA5A08

-B/x474t6DV07g7r7Le3Ekh/ggZ7ZM8EdwdzqiXom4ZR8eSCk4gIDpQrfn7bqzVY2
-25CG1qc4xadk4gFV8GKQeXn3/bVdqfOsTnawq6X9RylwA1HV1st2fVows2DSqskg
-tHS+tAYW1ZEu1qGEM5g1zmAuE4odtMD7jzZR2JMEHHFi5O1XY31EHY25jifDjIml
-370zKyPV5VxjrvJRFJq+aY7gn+jnEeVUnF6RtG11RPb101a+vyax4C5z9xO+JfNQ
-JkEDdFTEejHWabz43gSju8lwgrrzlhR5Yo/AbItk5XduG9VkJX27Jezr87Cn7IqX
-Xqja+DCUSFGX++nUCDWLs46Pw9VCp6kZsZt/yUa2cA/JGnmZv06aEf1tn6WsGY5/
-Fnq7K5RJTwbkpPdUckXK6OQZdRwb4uRqbj7F2OaWLYwr/jfj2innk+TQXmcxs4xz
-d6greZqyKmx0LcXlI3mpcY3CqKXFazl1pVqiIDdYNMWrNucvMnWX1D5YlCCoyICl
-xMtOjk3I2nVba1bdOPtHSXb+BiGkf2Y67ffNCtg2Z7YMCF2yVLVXFuuf4hoRwbOU
-fTwdPcdNZeAMF86stw71hMVq0SDagPV4kTO2IuzbJAWts8sUI0xpZnqZ5AxbQF0v
-uuE5Q259K+dneI7NaLpSidWW6+wslMABwuKEhGRlO6vZcpN7bqtGbRKKvHoj2ii3
-ebVhk44meh74aWYDoVbtY5HeKFqMSOo6gz6vyZ4udXKM9YpMX4xPx66BBI+8SGez
-vouO1xEE1mTtxcQcSHdDFSE8aKdOX1sVwaq/S++dXBFklbwZzj0bAw==
+bK5ojhRrYmfh0nhgiLPZoGT6i6NqLoVmHrtxJBumois0wznY0n693KktYs4bIikl
+YG5xGU+oOyuPCsi6NH/krIuDpzZzN8r6lTNX3b9BQdiEEL02QO9RJ/qjBz7OqNJF
+QrtBZQiXpXw3GgkB9CCnLYV8MzEeEWFJnRifKYZLSN8kEdcekudm7m+ih/yLzoFH
+MsnWR52uSVv58vOPqsGSXT5mvIWxZIeHBF5qSgre55rZjzzj5dn3PM/wBOeFIwep
+ZWQlm/Y3cg+cpBBe9GRkC+E0WA7iHmBL7WIvuiGq8EHq/LkPsNVPuL4K9YjXL7fH
+GSIvJqNq6cZb/dSxHY+8rgckZpnE4y/QH5xRmN43T9uzsno1nkRmojm61M3viObJ
+85dlaagMrBgatJABmbtvUzRYQqabFG0R4xcITuZFxWaBZFAWzpn6C65adtN4myoU
+nREOHXVWX+oz6E8vZbCaEPH21d8No6geH6+RhRoe+49gnodf57ZY/tlHz+4TL2lP
+UQRcEGnZCXHRUZ0lg1eqs50/HB37GMs15pKA+4Bw42eRYQiUbYErsGtzFQPYsLYP
+jPyoK5dvq0ZdVOSw8wnIMVX0LgI6v8G9i5R4AOLGHigkUBApwtHA22f+6ubZP/tQ
+QHZGBZgpxhwe1aRPGmra6GGpDzzg61zFIulSowt1TXYtzj1CNHCVFMt5DF93bSo6
+g0i9O6fiw6DbX3gB587jvqSgiI2ia+5AA9hrG/Nld9wIH2kvtEa9IUNg97bl+GTr
+uen5Y2xlA7Q3HVsxAU9W1CzBIFJYdDBYVkrKHPlKt6HAp5m4NEy+2g==
 -----END RSA PRIVATE KEY-----
--- a/test/ssl/client-expired.crt
+++ b/test/ssl/client-expired.crt
@ -2,7 +2,7 @@ Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3 (0x3)
-    Signature Algorithm: sha1WithRSAEncryption
+    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA
        Validity
            Not Before: Aug 20 00:00:00 2012 GMT
@ -12,15 +12,15 @@ Certificate:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
-                    00:9a:f0:be:71:57:51:38:4e:1a:de:35:1d:3c:37:
-                    66:6a:d6:5a:77:17:7d:f9:66:55:2f:c5:b8:17:04:
-                    3c:59:e6:8f:aa:ae:16:b9:c1:64:a1:a0:3b:ca:0c:
-                    ed:35:e9:2a:85:e9:b6:36:65:d6:ae:62:71:d1:89:
-                    14:e6:3a:18:c1:0b:28:c8:77:c8:26:e2:fc:f9:51:
-                    76:6e:21:70:42:28:4e:32:80:9c:5e:a6:58:26:b2:
-                    6c:40:b9:af:97:23:c1:fe:4b:c1:7f:b6:05:d2:8e:
-                    f5:90:34:cc:0a:28:ed:31:d7:71:5b:dc:6d:2f:ff:
-                    43:6b:78:1a:c5:6f:42:03:1f
+                    00:cf:a2:94:2e:b7:84:9f:ec:67:86:ce:6a:71:75:
+                    6a:9d:9a:a3:69:2b:83:8e:a8:23:05:51:bc:ab:98:
+                    1e:01:bc:06:03:26:bd:34:ec:52:15:a7:4b:45:a5:
+                    62:f4:3c:c1:95:fe:7b:07:16:f7:03:ae:9a:19:4b:
+                    a2:b9:49:80:5d:63:8b:a8:cb:d4:ed:86:9d:da:71:
+                    4f:15:6f:c5:0d:c6:81:cb:ad:57:75:7c:d9:2e:65:
+                    a7:86:a4:8f:84:70:0d:c5:3a:53:6c:da:29:a3:1d:
+                    b2:ac:4b:a0:86:7f:f3:16:2e:8d:99:dd:44:30:2b:
+                    81:89:e3:ae:79:b8:d7:ae:e9
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
@ -28,34 +28,34 @@ Certificate:
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
-                CC:E1:DD:22:B5:A1:24:98:8F:47:1E:FF:4F:AE:88:7E:E5:40:56:DB
+                FB:66:3B:5D:45:33:5B:61:14:52:C0:E4:04:FF:12:73:AD:B3:9B:56
            X509v3 Authority Key Identifier: 
-                keyid:40:43:50:14:D1:63:7E:0B:7C:97:14:20:63:E5:8A:95:96:9F:D4:AB
+                keyid:EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52

-    Signature Algorithm: sha1WithRSAEncryption
-         05:13:6e:9f:27:8b:1e:7b:3c:83:d4:be:d7:d9:3d:95:85:3e:
-         3f:d2:56:05:01:fa:3c:1f:4d:f5:b1:39:2e:af:cb:fe:39:4d:
-         3b:11:54:68:3e:c1:a9:e2:8b:6f:40:78:65:f5:d3:ec:04:de:
-         53:a9:c1:44:64:24:46:69:66:5e:33:41:02:d1:b5:d6:77:de:
-         8f:cb:cd:46:97:4a:d2:8c:af:b4:7d:fe:72:48:38:40:d9:75:
-         93:2c:a1:4c:70:e3:7d:cb:92:30:93:96:0e:92:9f:05:21:6e:
-         39:2d:cb:ec:83:fc:a4:34:ee:d3:ef:89:a7:11:ff:48:fa:1b:
-         12:e5
+    Signature Algorithm: sha256WithRSAEncryption
+         80:89:73:0e:35:ea:ce:88:27:9e:71:7a:6c:13:46:2f:e9:cd:
+         2a:04:6d:86:98:83:e3:0d:c3:d4:75:9d:6a:96:ec:b4:92:d0:
+         7a:3f:f5:e2:84:bb:67:3e:1f:9f:f6:3b:b4:98:2d:17:7f:c6:
+         2b:27:8f:4d:e1:4b:5c:7e:ae:e6:e6:e8:b7:82:3f:50:4b:78:
+         af:ae:2f:13:bf:c6:f1:f1:95:16:c2:46:73:8d:d9:3e:25:cd:
+         90:15:e3:63:7d:0a:a2:19:f8:00:70:1e:7a:a1:a6:4e:3c:79:
+         b9:e1:66:7c:fd:67:40:69:c5:6b:3a:15:55:81:10:b6:4d:d2:
+         22:b1
 -----BEGIN CERTIFICATE-----
-MIIC1zCCAkCgAwIBAgIBAzANBgkqhkiG9w0BAQUFADBlMQswCQYDVQQGEwJHQjET
+MIIC1zCCAkCgAwIBAgIBAzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET
 MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx
 EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTIwODIw
 MDAwMDAwWhcNMTIwODIxMDAwMDAwWjCBgDELMAkGA1UEBhMCR0IxGDAWBgNVBAgM
 D05vdHRpbmdoYW1zaGlyZTETMBEGA1UEBwwKTm90dGluZ2hhbTEPMA0GA1UECgwG
 U2VydmVyMRMwEQYDVQQLDApQcm9kdWN0aW9uMRwwGgYDVQQDDBN0ZXN0IGNsaWVu
-dCBleHBpcmVkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCa8L5xV1E4Thre
-NR08N2Zq1lp3F335ZlUvxbgXBDxZ5o+qrha5wWShoDvKDO016SqF6bY2ZdauYnHR
-iRTmOhjBCyjId8gm4vz5UXZuIXBCKE4ygJxeplgmsmxAua+XI8H+S8F/tgXSjvWQ
-NMwKKO0x13Fb3G0v/0NreBrFb0IDHwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG
+dCBleHBpcmVkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPopQut4Sf7GeG
+zmpxdWqdmqNpK4OOqCMFUbyrmB4BvAYDJr007FIVp0tFpWL0PMGV/nsHFvcDrpoZ
+S6K5SYBdY4uoy9Tthp3acU8Vb8UNxoHLrVd1fNkuZaeGpI+EcA3FOlNs2imjHbKs
+S6CGf/MWLo2Z3UQwK4GJ4655uNeu6QIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG
 SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E
-FgQUzOHdIrWhJJiPRx7/T66IfuVAVtswHwYDVR0jBBgwFoAUQENQFNFjfgt8lxQg
-Y+WKlZaf1KswDQYJKoZIhvcNAQEFBQADgYEABRNunyeLHns8g9S+19k9lYU+P9JW
-BQH6PB9N9bE5Lq/L/jlNOxFUaD7BqeKLb0B4ZfXT7ATeU6nBRGQkRmlmXjNBAtG1
-1nfej8vNRpdK0oyvtH3+ckg4QNl1kyyhTHDjfcuSMJOWDpKfBSFuOS3L7IP8pDTu
-0++JpxH/SPobEuU=
+FgQU+2Y7XUUzW2EUUsDkBP8Sc62zm1YwHwYDVR0jBBgwFoAU7mC7xxdf03KsM+6O
+hMwt2xrMilIwDQYJKoZIhvcNAQELBQADgYEAgIlzDjXqzognnnF6bBNGL+nNKgRt
+hpiD4w3D1HWdapbstJLQej/14oS7Zz4fn/Y7tJgtF3/GKyePTeFLXH6u5ubot4I/
+UEt4r64vE7/G8fGVFsJGc43ZPiXNkBXjY30Kohn4AHAeeqGmTjx5ueFmfP1nQGnF
+azoVVYEQtk3SIrE=
 -----END CERTIFICATE-----
--- a/test/ssl/client-revoked.crt
+++ b/test/ssl/client-revoked.crt
@ -2,25 +2,25 @@ Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4 (0x4)
-    Signature Algorithm: sha1WithRSAEncryption
+    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA
        Validity
-            Not Before: Aug 30 22:03:34 2013 GMT
-            Not After : Aug 29 22:03:34 2018 GMT
+            Not Before: Sep 18 10:49:58 2018 GMT
+            Not After : Sep 17 10:49:58 2023 GMT
        Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production, CN=test client revoked
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
-                    00:ce:19:b3:0b:d1:87:97:06:48:44:84:77:65:bc:
-                    a7:25:fd:ec:49:16:0b:73:c9:2f:7a:9c:14:16:af:
-                    cd:d3:3e:9a:2a:18:1c:90:f1:1a:5b:6d:31:d5:fd:
-                    6c:04:2b:87:e2:fe:2b:a8:01:ad:00:64:50:c7:ec:
-                    d1:4f:ec:76:7f:4c:a3:f4:98:82:bf:53:af:06:e3:
-                    26:87:3e:44:e3:6b:bb:b8:9c:9d:ef:a2:fe:59:3e:
-                    bd:9a:31:c0:3c:77:a9:69:4c:3a:1a:aa:c4:3f:68:
-                    4c:7f:e2:05:ea:38:98:d6:be:93:27:26:fc:ac:a3:
-                    d0:b4:9c:65:a9:10:e6:5d:b7
+                    00:cf:30:dc:74:50:c8:4b:4c:0f:c5:15:b1:cc:f4:
+                    2d:c1:f2:f5:14:16:d3:c9:ff:82:0e:56:f2:98:8b:
+                    6d:d5:b9:c8:95:fa:33:cc:b3:9e:26:1d:5f:2a:0d:
+                    ce:8d:49:02:f3:6e:a5:c6:90:26:e3:15:4e:d2:bf:
+                    22:ac:1c:25:5b:b1:06:aa:03:6a:b9:d8:e6:09:e2:
+                    f6:31:e9:e2:76:08:b9:5a:a6:9d:a2:f2:ca:ec:f1:
+                    97:87:a1:5c:14:4a:06:44:77:1d:13:36:43:b8:36:
+                    bf:6d:6f:0a:c1:91:a6:0b:ea:37:34:08:7b:2d:9f:
+                    e0:ec:ba:5d:52:77:9e:a0:9f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
@ -28,34 +28,34 @@ Certificate:
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
-                96:E5:2B:FD:A2:61:F5:32:36:92:3F:CC:BA:28:A7:E2:4C:6C:A5:91
+                56:B4:1E:17:B3:35:C7:16:DB:45:A5:76:40:73:3E:C3:EA:42:5D:F8
            X509v3 Authority Key Identifier: 
-                keyid:40:43:50:14:D1:63:7E:0B:7C:97:14:20:63:E5:8A:95:96:9F:D4:AB
+                keyid:EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52

-    Signature Algorithm: sha1WithRSAEncryption
-         22:82:2d:16:57:95:84:10:a5:5b:5b:0f:20:1a:5b:db:59:f5:
-         5c:d8:42:24:72:42:80:a8:30:77:82:b2:9c:ee:3e:61:3e:af:
-         d0:4d:75:32:ee:cc:04:fc:d6:96:57:46:35:34:d6:7e:42:51:
-         41:fa:a3:2a:a5:02:3a:50:39:a6:5c:16:a3:8f:dc:2b:45:93:
-         d6:a0:fd:cf:5c:db:fc:5d:ae:f7:5c:e1:2e:36:de:ee:82:38:
-         de:db:76:af:fa:04:f2:a6:bc:14:56:2a:66:b9:9c:dc:88:41:
-         2d:e7:4e:2c:4d:a9:ae:22:ba:7c:29:65:15:48:85:e4:45:c5:
-         32:21
+    Signature Algorithm: sha256WithRSAEncryption
+         b5:42:ed:22:06:a9:6d:55:e7:72:c2:09:cf:05:6d:f1:cb:2b:
+         ae:38:24:63:b4:e2:f3:d6:13:ab:85:08:3f:e1:6e:e4:f4:2c:
+         30:7b:cd:ec:be:1d:c1:a6:4b:53:f6:0d:13:55:ef:10:60:b5:
+         85:72:b8:85:34:82:28:97:4c:d8:0e:70:7f:4a:b2:ec:ec:13:
+         50:14:53:94:ae:04:e3:bf:c8:02:19:ce:9e:d4:85:2a:59:27:
+         9b:dc:e7:5f:5a:c7:83:2e:fb:2b:47:e4:51:11:6f:ad:51:bb:
+         2e:85:2c:7c:a7:c3:a9:db:72:ab:54:93:f7:70:9e:9b:9c:50:
+         20:73
 -----BEGIN CERTIFICATE-----
-MIIC1zCCAkCgAwIBAgIBBDANBgkqhkiG9w0BAQUFADBlMQswCQYDVQQGEwJHQjET
+MIIC1zCCAkCgAwIBAgIBBDANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET
 MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx
-EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTMwODMw
-MjIwMzM0WhcNMTgwODI5MjIwMzM0WjCBgDELMAkGA1UEBhMCR0IxGDAWBgNVBAgM
+EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTgwOTE4
+MTA0OTU4WhcNMjMwOTE3MTA0OTU4WjCBgDELMAkGA1UEBhMCR0IxGDAWBgNVBAgM
 D05vdHRpbmdoYW1zaGlyZTETMBEGA1UEBwwKTm90dGluZ2hhbTEPMA0GA1UECgwG
 U2VydmVyMRMwEQYDVQQLDApQcm9kdWN0aW9uMRwwGgYDVQQDDBN0ZXN0IGNsaWVu
-dCByZXZva2VkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOGbML0YeXBkhE
-hHdlvKcl/exJFgtzyS96nBQWr83TPpoqGByQ8RpbbTHV/WwEK4fi/iuoAa0AZFDH
-7NFP7HZ/TKP0mIK/U68G4yaHPkTja7u4nJ3vov5ZPr2aMcA8d6lpTDoaqsQ/aEx/
-4gXqOJjWvpMnJvyso9C0nGWpEOZdtwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG
+dCByZXZva2VkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPMNx0UMhLTA/F
+FbHM9C3B8vUUFtPJ/4IOVvKYi23VuciV+jPMs54mHV8qDc6NSQLzbqXGkCbjFU7S
+vyKsHCVbsQaqA2q52OYJ4vYx6eJ2CLlapp2i8srs8ZeHoVwUSgZEdx0TNkO4Nr9t
+bwrBkaYL6jc0CHstn+Dsul1Sd56gnwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG
 SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E
-FgQUluUr/aJh9TI2kj/Muiin4kxspZEwHwYDVR0jBBgwFoAUQENQFNFjfgt8lxQg
-Y+WKlZaf1KswDQYJKoZIhvcNAQEFBQADgYEAIoItFleVhBClW1sPIBpb21n1XNhC
-JHJCgKgwd4KynO4+YT6v0E11Mu7MBPzWlldGNTTWfkJRQfqjKqUCOlA5plwWo4/c
-K0WT1qD9z1zb/F2u91zhLjbe7oI43tt2r/oE8qa8FFYqZrmc3IhBLedOLE2priK6
-fCllFUiF5EXFMiE=
+FgQUVrQeF7M1xxbbRaV2QHM+w+pCXfgwHwYDVR0jBBgwFoAU7mC7xxdf03KsM+6O
+hMwt2xrMilIwDQYJKoZIhvcNAQELBQADgYEAtULtIgapbVXncsIJzwVt8csrrjgk
+Y7Ti89YTq4UIP+Fu5PQsMHvN7L4dwaZLU/YNE1XvEGC1hXK4hTSCKJdM2A5wf0qy
+7OwTUBRTlK4E47/IAhnOntSFKlknm9znX1rHgy77K0fkURFvrVG7LoUsfKfDqdty
+q1ST93Cem5xQIHM=
 -----END CERTIFICATE-----
--- a/test/ssl/client-revoked.csr
+++ b/test/ssl/client-revoked.csr
@ -1,12 +0,0 @@
-----BEGIN CERTIFICATE REQUEST-----
-MIIBwTCCASoCAQAwgYAxCzAJBgNVBAYTAkdCMRgwFgYDVQQIDA9Ob3R0aW5naGFt
-c2hpcmUxEzARBgNVBAcMCk5vdHRpbmdoYW0xDzANBgNVBAoMBlNlcnZlcjETMBEG
-A1UECwwKUHJvZHVjdGlvbjEcMBoGA1UEAwwTdGVzdCBjbGllbnQgcmV2b2tlZDCB
-nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzhmzC9GHlwZIRIR3ZbynJf3sSRYL
-c8kvepwUFq/N0z6aKhgckPEaW20x1f1sBCuH4v4rqAGtAGRQx+zRT+x2f0yj9JiC
-v1OvBuMmhz5E42u7uJyd76L+WT69mjHAPHepaUw6GqrEP2hMf+IF6jiY1r6TJyb8
-rKPQtJxlqRDmXbcCAwEAAaAAMA0GCSqGSIb3DQEBBQUAA4GBABqc8X/e5amA7jA3
-cBEICNfQmwXl7KHkLN3vkoa6bm+gGkYWRQYKVk2lQ1zoWuuVSSRcHZhFAJEayQFq
-xLF+lr72707ncc+yUAwnw4/TTmsDizmDcYj3GwjF+u20CSxnbSgLQfpp5xgSNluc
-07XSxkm6Zeolt9GyKliqTJ1kojLY
-----END CERTIFICATE REQUEST-----
--- a/test/ssl/client-revoked.key
+++ b/test/ssl/client-revoked.key
@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQDOGbML0YeXBkhEhHdlvKcl/exJFgtzyS96nBQWr83TPpoqGByQ
-8RpbbTHV/WwEK4fi/iuoAa0AZFDH7NFP7HZ/TKP0mIK/U68G4yaHPkTja7u4nJ3v
-ov5ZPr2aMcA8d6lpTDoaqsQ/aEx/4gXqOJjWvpMnJvyso9C0nGWpEOZdtwIDAQAB
-AoGAWOgPK6b8dbK5FA2Mr+98r0/lUPXYhN8hwyN3Kv41rM3RlR0HnaLUOuJU4DnN
-EdNxcAMy8+udJJEho8zN0ktwJd3Mi/LHVRAZx5EwuZ1m5kSbM/n4iD5TMpDIoFD4
-hkq/sxl6EcPBjwDAoykWiYYMcatAyjlxQzs4/FxP9VsgM3kCQQDnUz0K+3zSgE12
-MNx5+mynN6Ugt9wp731sNNirkPrLkp7AG6VF5nX5j4SMqROMOfGSPZ2sKwXnyFUz
-/Aj4KXWbAkEA5BWm8VB1hI1vklGdkCfEcE6lIrND62mQ1hmoF3oaxL8XwnLgzv2U
-9r3jWUJWZE9AFx0VHj457oN5GpbU/xaoFQJAEr02e7ZFtVO5crKgma0EskMauFzM
-lAUXlvVs+/EBsA4PmCZlLBVwRyguJ6rmr3xeKmedZz4Q+2bKKCzpmRjaswJAEJuT
-AFc/d1tlGF5g/rIml5biZ1huRaH2LeDIYI0/jbvsWvhKbkgApMbG2yT9bWhn3kb7
-1qvpQ/jGxKze7YQU0QJALPCnF5/cvmnvOgsCbtLvD4yobKpeYTOUz8BESqDWzKKA
-L9WyvcvAGneKR55UzIGNeo3c51WWGovlh66TMrXfmA==
+MIICXQIBAAKBgQDPMNx0UMhLTA/FFbHM9C3B8vUUFtPJ/4IOVvKYi23VuciV+jPM
+s54mHV8qDc6NSQLzbqXGkCbjFU7SvyKsHCVbsQaqA2q52OYJ4vYx6eJ2CLlapp2i
+8srs8ZeHoVwUSgZEdx0TNkO4Nr9tbwrBkaYL6jc0CHstn+Dsul1Sd56gnwIDAQAB
+AoGBAMqQ0Nh/qnPDl59uiHkDOkFnEilj8AiL4FG4vFJb7zSIAQ5wong+HB7TlJj/
+CrSjb1klErrBcOOPj5MIABQZKINrwgsHlkQIzvC2EGF/I0tfFJDbUjlZ7y1Vh15O
+pAOhhx2SuBwvNMHrz6L70Koqg9Y2v1WHQ2IBPuo8i5VBcWSxAkEA9DUZm/Tj4Gqb
+pXWiSd2/gV5H2NgVT2t9Jth1Z9nfK9g6GTfVEMbKkp4EGHW3rqL3UbphNK72/v3S
+2YTMU0JM7QJBANkyKUbgdUMcqYDypZoBliom2qUqk+kIvWdGSp+W3M5LEQgfuTkN
+uW9qz7ncXT3d8cka7Xlg7KO2UKAKnGJbvjsCQQCTYXiTJrhgN/a3ZMcMzUdGTCAQ
+PlieFcDyMLCqfFKzo0ts7MUp2s9mrPbLzD+OpcudB16i7PUj7wvROtQVa24BAkAW
+5M6tBePWWyMS0IDcJuapMsdBOae1nJI6XJJpGAHWTNtSu+VOOkAdmmii8rNxXf+q
+bwgxDyJib0k4VWX+iCUZAkBWqLqyXcclfqAsiTKdzEfQV8uoiu+6hQ6OCh0J1Np3
+7g9p/MLyXkwtAgrtz80zWxkQH+FcFgdTwebrEF1z5kpx
 -----END RSA PRIVATE KEY-----
--- a/test/ssl/client.crt
+++ b/test/ssl/client.crt
@ -2,25 +2,25 @@ Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2 (0x2)
-    Signature Algorithm: sha1WithRSAEncryption
+    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA
        Validity
-            Not Before: Aug 30 22:03:31 2013 GMT
-            Not After : Aug 29 22:03:31 2018 GMT
+            Not Before: Sep 18 10:49:56 2018 GMT
+            Not After : Sep 17 10:49:56 2023 GMT
        Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production, CN=test client
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
-                    00:9a:f0:be:71:57:51:38:4e:1a:de:35:1d:3c:37:
-                    66:6a:d6:5a:77:17:7d:f9:66:55:2f:c5:b8:17:04:
-                    3c:59:e6:8f:aa:ae:16:b9:c1:64:a1:a0:3b:ca:0c:
-                    ed:35:e9:2a:85:e9:b6:36:65:d6:ae:62:71:d1:89:
-                    14:e6:3a:18:c1:0b:28:c8:77:c8:26:e2:fc:f9:51:
-                    76:6e:21:70:42:28:4e:32:80:9c:5e:a6:58:26:b2:
-                    6c:40:b9:af:97:23:c1:fe:4b:c1:7f:b6:05:d2:8e:
-                    f5:90:34:cc:0a:28:ed:31:d7:71:5b:dc:6d:2f:ff:
-                    43:6b:78:1a:c5:6f:42:03:1f
+                    00:cf:a2:94:2e:b7:84:9f:ec:67:86:ce:6a:71:75:
+                    6a:9d:9a:a3:69:2b:83:8e:a8:23:05:51:bc:ab:98:
+                    1e:01:bc:06:03:26:bd:34:ec:52:15:a7:4b:45:a5:
+                    62:f4:3c:c1:95:fe:7b:07:16:f7:03:ae:9a:19:4b:
+                    a2:b9:49:80:5d:63:8b:a8:cb:d4:ed:86:9d:da:71:
+                    4f:15:6f:c5:0d:c6:81:cb:ad:57:75:7c:d9:2e:65:
+                    a7:86:a4:8f:84:70:0d:c5:3a:53:6c:da:29:a3:1d:
+                    b2:ac:4b:a0:86:7f:f3:16:2e:8d:99:dd:44:30:2b:
+                    81:89:e3:ae:79:b8:d7:ae:e9
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
@ -28,34 +28,34 @@ Certificate:
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
-                CC:E1:DD:22:B5:A1:24:98:8F:47:1E:FF:4F:AE:88:7E:E5:40:56:DB
+                FB:66:3B:5D:45:33:5B:61:14:52:C0:E4:04:FF:12:73:AD:B3:9B:56
            X509v3 Authority Key Identifier: 
-                keyid:40:43:50:14:D1:63:7E:0B:7C:97:14:20:63:E5:8A:95:96:9F:D4:AB
+                keyid:EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52

-    Signature Algorithm: sha1WithRSAEncryption
-         0f:0c:fa:e2:7d:c6:64:58:70:0b:f1:22:1b:bc:ef:ba:60:17:
-         d8:29:9b:51:bf:a7:6f:cd:89:7c:bd:b7:02:b8:3c:4e:f2:22:
-         24:31:3d:4a:54:4d:14:98:ce:37:14:3a:74:23:31:bd:50:53:
-         b2:aa:d1:9e:d0:b0:a8:1d:e2:b5:be:7e:6f:26:20:d8:b2:5b:
-         5c:c4:9d:5d:f1:c3:6f:e1:3b:c1:ea:eb:18:39:79:d9:78:96:
-         44:c7:88:65:68:41:05:58:40:83:99:8e:fc:11:64:1b:cf:96:
-         fe:62:df:68:a8:a7:cb:fe:f1:cc:bf:a6:cb:8a:74:94:14:dd:
-         69:12
+    Signature Algorithm: sha256WithRSAEncryption
+         48:b6:47:12:77:53:07:36:44:93:d7:ea:88:f0:f5:4f:b0:b4:
+         52:06:36:ec:7b:df:80:cc:2a:31:fa:b3:b4:c9:0e:4a:6c:b0:
+         83:0a:89:2d:58:25:f2:ee:0f:60:93:01:59:db:0a:6d:93:81:
+         ad:ea:21:cf:ee:d1:a9:b4:c2:b8:77:8c:bf:9d:1f:78:3c:35:
+         c2:2d:18:11:25:02:f8:7c:9c:42:fd:9b:0f:21:7b:81:88:b3:
+         c3:84:62:b1:b9:24:3c:8c:94:24:93:c2:74:33:2c:82:ca:b3:
+         8f:37:3f:71:6d:b7:79:9b:dd:2e:ee:36:bd:7c:fa:0a:4d:3b:
+         88:4b
 -----BEGIN CERTIFICATE-----
-MIICzjCCAjegAwIBAgIBAjANBgkqhkiG9w0BAQUFADBlMQswCQYDVQQGEwJHQjET
+MIICzjCCAjegAwIBAgIBAjANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET
 MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx
-EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTMwODMw
-MjIwMzMxWhcNMTgwODI5MjIwMzMxWjB4MQswCQYDVQQGEwJHQjEYMBYGA1UECAwP
+EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTgwOTE4
+MTA0OTU2WhcNMjMwOTE3MTA0OTU2WjB4MQswCQYDVQQGEwJHQjEYMBYGA1UECAwP
 Tm90dGluZ2hhbXNoaXJlMRMwEQYDVQQHDApOb3R0aW5naGFtMQ8wDQYDVQQKDAZT
 ZXJ2ZXIxEzARBgNVBAsMClByb2R1Y3Rpb24xFDASBgNVBAMMC3Rlc3QgY2xpZW50
-MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCa8L5xV1E4ThreNR08N2Zq1lp3
-F335ZlUvxbgXBDxZ5o+qrha5wWShoDvKDO016SqF6bY2ZdauYnHRiRTmOhjBCyjI
-d8gm4vz5UXZuIXBCKE4ygJxeplgmsmxAua+XI8H+S8F/tgXSjvWQNMwKKO0x13Fb
-3G0v/0NreBrFb0IDHwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQf
-Fh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUzOHdIrWh
-JJiPRx7/T66IfuVAVtswHwYDVR0jBBgwFoAUQENQFNFjfgt8lxQgY+WKlZaf1Ksw
-DQYJKoZIhvcNAQEFBQADgYEADwz64n3GZFhwC/EiG7zvumAX2CmbUb+nb82JfL23
-Arg8TvIiJDE9SlRNFJjONxQ6dCMxvVBTsqrRntCwqB3itb5+byYg2LJbXMSdXfHD
-b+E7werrGDl52XiWRMeIZWhBBVhAg5mO/BFkG8+W/mLfaKiny/7xzL+my4p0lBTd
-aRI=
+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPopQut4Sf7GeGzmpxdWqdmqNp
+K4OOqCMFUbyrmB4BvAYDJr007FIVp0tFpWL0PMGV/nsHFvcDrpoZS6K5SYBdY4uo
+y9Tthp3acU8Vb8UNxoHLrVd1fNkuZaeGpI+EcA3FOlNs2imjHbKsS6CGf/MWLo2Z
+3UQwK4GJ4655uNeu6QIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQf
+Fh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQU+2Y7XUUz
+W2EUUsDkBP8Sc62zm1YwHwYDVR0jBBgwFoAU7mC7xxdf03KsM+6OhMwt2xrMilIw
+DQYJKoZIhvcNAQELBQADgYEASLZHEndTBzZEk9fqiPD1T7C0UgY27HvfgMwqMfqz
+tMkOSmywgwqJLVgl8u4PYJMBWdsKbZOBreohz+7RqbTCuHeMv50feDw1wi0YESUC
+HycQv2bDyF7gYizw4RisbkkPIyUJJPCdDMsgsqzjzc/cW23eZvdLu42vXz6Ck07
+iEs=
 -----END CERTIFICATE-----
--- a/test/ssl/client.csr
+++ b/test/ssl/client.csr
@ -1,12 +0,0 @@
-----BEGIN CERTIFICATE REQUEST-----
-MIIBuDCCASECAQAweDELMAkGA1UEBhMCR0IxGDAWBgNVBAgMD05vdHRpbmdoYW1z
-aGlyZTETMBEGA1UEBwwKTm90dGluZ2hhbTEPMA0GA1UECgwGU2VydmVyMRMwEQYD
-VQQLDApQcm9kdWN0aW9uMRQwEgYDVQQDDAt0ZXN0IGNsaWVudDCBnzANBgkqhkiG
-9w0BAQEFAAOBjQAwgYkCgYEAmvC+cVdROE4a3jUdPDdmatZadxd9+WZVL8W4FwQ8
-WeaPqq4WucFkoaA7ygztNekqhem2NmXWrmJx0YkU5joYwQsoyHfIJuL8+VF2biFw
-QihOMoCcXqZYJrJsQLmvlyPB/kvBf7YF0o71kDTMCijtMddxW9xtL/9Da3gaxW9C
-Ax8CAwEAAaAAMA0GCSqGSIb3DQEBBQUAA4GBAH5l2eVGP+//MBFAT+ne3/KQvoRQ
-yF4xlDjvKUlK3LHjT+js/fxGQJWmXqea5jRmEZjAxNnjDcjf828jaFkaQGsoajym
-ebNL5RvrPykwaXjdhHgavDiM/LCRR6bDCUYzS5akjZx2ENQ1TM7BVThOJQ2W+KPn
-xdxeRH8KxKGJ3wp0
-----END CERTIFICATE REQUEST-----
--- a/test/ssl/client.key
+++ b/test/ssl/client.key
@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQCa8L5xV1E4ThreNR08N2Zq1lp3F335ZlUvxbgXBDxZ5o+qrha5
-wWShoDvKDO016SqF6bY2ZdauYnHRiRTmOhjBCyjId8gm4vz5UXZuIXBCKE4ygJxe
-plgmsmxAua+XI8H+S8F/tgXSjvWQNMwKKO0x13Fb3G0v/0NreBrFb0IDHwIDAQAB
-AoGAH3DpBHD2n1liJGNc2mJXmyiCVRZkTt7QPJB/ydPnN0sNLlKDdBBljlLIrziu
-TjlRkrkZa7KAvQRnGmEZ55o0eW8bMRkY7vrje+dr3btPet7driZbmkOJDmzPZucV
-5IObA5j4sUAd7MOkvLfrK2wtn14PEwEznzZQeZO5NiSp9fECQQDOiCUEjg4/xwG4
-OBKcT7G0zZnYlaqgus8JffC7NBp4nUi4Ol42Zkf3I6j83cUU7RwvhmpmX2IWzmjX
-jGDN8EV5AkEAwA0uz7hy6+Nj+boST35r8oUF/j/wgFzqNZwuGv6zIp2EAkjG+LMZ
-6hU7MRR+L1V3FYkYr7uZyAv8mSYyn0bfVwJAagcw4ea/3/QdqOJ4g3DSbVzD55Hm
-d/+PfHMAXEsCb/tnMtUcOtdFiNXw0mhT3ktgFfHuu8GqDMVIw6fYpsD8GQJAVYTJ
-RogM7ItqFmbMBof2C50+iPPx5Ub6p/qu8Shfnldj1BySNWaTcJAZtoY4ll1JVNai
-noY8OT9VMOE4g4JsqwJAdZhegiH2/UGh2+81xQZNh8R0dBuK8SVu+FvMvK7np36Q
-OEuaW2NZMujP+j/GnNJ2OfzIWIv1LNAP8JhApyCCDg==
+MIICXwIBAAKBgQDPopQut4Sf7GeGzmpxdWqdmqNpK4OOqCMFUbyrmB4BvAYDJr00
+7FIVp0tFpWL0PMGV/nsHFvcDrpoZS6K5SYBdY4uoy9Tthp3acU8Vb8UNxoHLrVd1
+fNkuZaeGpI+EcA3FOlNs2imjHbKsS6CGf/MWLo2Z3UQwK4GJ4655uNeu6QIDAQAB
+AoGBAMwdfSK30i8MzXEedlF3JgotPLtkxX12GIdgJONjNQxrdFWgvZvLPZ5/yWV8
+Al0rZPs5ImSD1OzPtjlru1n+wapHp8zE2xtl3druicErs1A0hF73yx5lJx9rO5V4
+c7FoTFDDs3LJVy9P9gsV/+1iWwgJvvxDs01DWhhi35zFZmoBAkEA5wuDEScxYXbx
+KY5irMhsPACwNgzx/c3GBwZ56nx0hGVrqDmghw03sf6leTceKRhLE6xzyk56Z4kD
+6/QtpTZMyQJBAOYPxg80W5uZPC7R56jlAzo8fnpwEidTjJlctbS4sDSnITe9yugs
+x7SzLhqxzuEuJiLOfzCs/X5TL1UdN1azASECQQCgF6763MBvu34BgILJHJs6vHNd
+EH1BkyrrRUaG/zOxZaFCUKP10GfOMxevtUx1xzqGaFFXViekxCDuhyR1vPlZAkEA
+h+GBJbHS+ZAED9NCdGrvARKB0WcoEbozLNGpMNh0mmSsJfQfSApK2duKu5GRk0Zi
+l+RHE0TZZCdVqXvcF4UagQJBAK3Jdi/F/n6+BYIU6IcFtsHCcm8Nr+Lz3iSt4CT5
+gIZstvNrIy/fJoN/NrrfVUh8JD0UZpEUt1lNclNLxCh/wec=
 -----END RSA PRIVATE KEY-----
--- a/test/ssl/crl.pem
+++ b/test/ssl/crl.pem
@ -1,10 +1,10 @@
 -----BEGIN X509 CRL-----
-MIIBVTCBvwIBATANBgkqhkiG9w0BAQUFADBlMQswCQYDVQQGEwJHQjETMBEGA1UE
+MIIBVTCBvwIBATANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjETMBEGA1UE
 CAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNV
-BAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EXDTEzMDgzMDIyMDMzNVoY
-DzIwOTUxMDE5MjIwMzM1WjAUMBICAQQXDTEzMDgzMDIyMDMzNVqgDjAMMAoGA1Ud
-FAQDAgEBMA0GCSqGSIb3DQEBBQUAA4GBAHq0ebJDiawBBbMDohyfoFlmtCvJDUuS
-79x239ublxRGg8vB9eALiru16YGL2/x3AUYDjr9Xh4cm4BvA5+F6vdebzVcSH/Xe
-qxa1YZTvmuZko2Fp7kHMs1bn5diFoGCSXD4OqGFJJwtIOHLXXwtcGaAaGSLtWT8M
-2+/Fn+oFhax/
+BAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EXDTE4MDkxODEwNDk1OVoY
+DzIxMDAxMTA3MTA0OTU5WjAUMBICAQQXDTE4MDkxODEwNDk1OVqgDjAMMAoGA1Ud
+FAQDAgEBMA0GCSqGSIb3DQEBCwUAA4GBABMwUjGo9PMd1kqWqrfqTO3eaesPATX9
+xm6OQyoPEJ0CIwhm9jjWrvKMoJth8W7qnS91AK5vt0avGlUFIC+VG4aNc8MLFzmk
+2g425K4d8dQ92OBCc3d6U8cUmpfB2bpK5kPxDliWtH+iBnuWkjTIsaXsfdmnnXhz
+3PAFwU9beIef
 -----END X509 CRL-----
--- a/test/ssl/rootCA/index.txt
+++ b/test/ssl/rootCA/index.txt
@ -1,2 +0,0 @@
-V	180829220318Z		01	unknown	/C=GB/ST=Derbyshire/O=Mosquitto Project/OU=Testing/CN=Signing CA
-V	180829220327Z		02	unknown	/C=GB/ST=Derbyshire/O=Mosquitto Project/OU=Testing/CN=Alternative Signing CA
--- a/test/ssl/server.crt
+++ b/test/ssl/server.crt
@ -2,25 +2,25 @@ Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
-    Signature Algorithm: sha1WithRSAEncryption
+    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA
        Validity
-            Not Before: Aug 30 22:03:29 2013 GMT
-            Not After : Aug 29 22:03:29 2018 GMT
+            Not Before: Sep 18 10:49:54 2018 GMT
+            Not After : Sep 17 10:49:54 2023 GMT
        Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production, CN=localhost
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
-                    00:ab:8d:98:97:5f:97:fa:82:fa:56:01:6d:f1:6e:
-                    ab:ef:47:a6:24:6c:1f:f1:9a:e5:80:0d:58:71:2f:
-                    be:08:25:87:81:12:0b:a2:aa:ea:19:ee:75:8c:66:
-                    88:5b:35:ac:79:a6:ff:e4:e0:1b:97:19:da:8d:28:
-                    50:57:71:c1:ff:44:bb:be:4f:e7:e8:e7:54:bf:14:
-                    cf:12:91:b1:0d:24:9b:24:1c:84:36:a8:99:9e:1e:
-                    87:18:19:f1:83:c8:ae:fd:a2:af:5e:29:ba:ac:ac:
-                    5b:56:1c:1c:0d:64:c3:80:d1:4c:c5:21:a8:6e:b8:
-                    b2:f3:03:7a:1b:35:e3:9f:0f
+                    00:cc:a0:1e:6a:7c:20:f0:3f:b2:48:2d:61:8d:b9:
+                    db:a8:a5:65:6b:13:88:37:c7:12:d7:32:dc:b6:fd:
+                    89:4c:fd:2e:bf:e6:34:f5:ac:9d:db:82:54:b1:9c:
+                    84:7b:a7:af:3a:7e:89:fd:7e:fe:f1:3d:6f:46:1b:
+                    28:f2:d9:65:76:0d:11:4a:10:8b:a9:eb:bd:11:2c:
+                    a8:5d:0a:30:65:c7:99:1f:96:88:2e:f1:a5:15:62:
+                    a9:4a:2b:50:9e:70:04:0c:3d:24:55:4b:c3:d2:86:
+                    57:4f:76:91:6b:2b:35:40:10:b2:f0:c2:17:3f:da:
+                    dd:d1:00:a7:32:64:37:24:b5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
@ -28,33 +28,33 @@ Certificate:
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
-                07:C5:AF:95:28:37:45:F4:2C:F5:BA:6A:60:79:DC:0F:A2:46:99:72
+                F9:F6:14:B3:4E:D1:D5:35:9F:15:D4:74:10:0E:85:F5:FF:8C:D2:C9
            X509v3 Authority Key Identifier: 
-                keyid:40:43:50:14:D1:63:7E:0B:7C:97:14:20:63:E5:8A:95:96:9F:D4:AB
+                keyid:EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52

-    Signature Algorithm: sha1WithRSAEncryption
-         90:dd:85:cb:9f:4a:89:78:2b:26:c4:82:b9:34:ea:39:5a:8b:
-         d9:3b:56:5c:78:df:69:ab:4a:f7:c6:10:8a:a3:9a:1a:5d:c5:
-         be:55:a1:36:df:36:d6:ea:3a:ec:be:99:38:9f:34:19:50:c4:
-         30:6a:18:2a:42:9f:45:a0:d2:57:bf:37:47:b7:2c:b0:1e:f4:
-         2e:95:1a:9a:90:2d:41:95:00:e8:23:3c:c1:99:ea:39:56:b1:
-         ea:8f:2d:db:e9:2c:ea:c8:5b:e7:90:8e:98:2e:ff:13:aa:73:
-         c2:da:fa:af:ee:aa:86:b6:1d:dc:91:4e:24:df:19:4d:aa:3f:
-         1b:d7
+    Signature Algorithm: sha256WithRSAEncryption
+         94:f9:64:c6:99:00:68:03:bb:58:e8:cd:71:65:82:02:30:ff:
+         cf:87:c3:5f:98:51:c8:96:93:c2:92:c0:f5:d4:78:5b:a2:0b:
+         ee:1a:77:6c:1e:bb:f8:d9:d9:93:b5:d2:9e:84:1b:bd:e3:0d:
+         43:91:5b:a3:87:b3:a5:87:6b:ed:a3:93:e2:5a:7c:1e:09:f0:
+         2a:27:97:39:3b:c4:a0:23:b4:84:50:c1:a2:1c:4d:0b:dc:66:
+         16:d4:ef:1b:3b:bf:ef:69:a2:de:e1:01:b8:ca:e3:d3:be:f0:
+         e2:87:e1:1f:b5:92:93:25:32:e9:12:19:cb:78:dc:16:56:48:
+         ea:7c
 -----BEGIN CERTIFICATE-----
-MIICzDCCAjWgAwIBAgIBATANBgkqhkiG9w0BAQUFADBlMQswCQYDVQQGEwJHQjET
+MIICzDCCAjWgAwIBAgIBATANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET
 MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx
-EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTMwODMw
-MjIwMzI5WhcNMTgwODI5MjIwMzI5WjB2MQswCQYDVQQGEwJHQjEYMBYGA1UECAwP
+EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTgwOTE4
+MTA0OTU0WhcNMjMwOTE3MTA0OTU0WjB2MQswCQYDVQQGEwJHQjEYMBYGA1UECAwP
 Tm90dGluZ2hhbXNoaXJlMRMwEQYDVQQHDApOb3R0aW5naGFtMQ8wDQYDVQQKDAZT
 ZXJ2ZXIxEzARBgNVBAsMClByb2R1Y3Rpb24xEjAQBgNVBAMMCWxvY2FsaG9zdDCB
-nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAq42Yl1+X+oL6VgFt8W6r70emJGwf
-8ZrlgA1YcS++CCWHgRILoqrqGe51jGaIWzWseab/5OAblxnajShQV3HB/0S7vk/n
-6OdUvxTPEpGxDSSbJByENqiZnh6HGBnxg8iu/aKvXim6rKxbVhwcDWTDgNFMxSGo
-briy8wN6GzXjnw8CAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYd
-T3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFAfFr5UoN0X0
-LPW6amB53A+iRplyMB8GA1UdIwQYMBaAFEBDUBTRY34LfJcUIGPlipWWn9SrMA0G
-CSqGSIb3DQEBBQUAA4GBAJDdhcufSol4KybEgrk06jlai9k7Vlx432mrSvfGEIqj
-mhpdxb5VoTbfNtbqOuy+mTifNBlQxDBqGCpCn0Wg0le/N0e3LLAe9C6VGpqQLUGV
-AOgjPMGZ6jlWseqPLdvpLOrIW+eQjpgu/xOqc8La+q/uqoa2HdyRTiTfGU2qPxvX
+nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzKAeanwg8D+ySC1hjbnbqKVlaxOI
+N8cS1zLctv2JTP0uv+Y09ayd24JUsZyEe6evOn6J/X7+8T1vRhso8tlldg0RShCL
+qeu9ESyoXQowZceZH5aILvGlFWKpSitQnnAEDD0kVUvD0oZXT3aRays1QBCy8MIX
+P9rd0QCnMmQ3JLUCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYd
+T3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFPn2FLNO0dU1
+nxXUdBAOhfX/jNLJMB8GA1UdIwQYMBaAFO5gu8cXX9NyrDPujoTMLdsazIpSMA0G
+CSqGSIb3DQEBCwUAA4GBAJT5ZMaZAGgDu1jozXFlggIw/8+Hw1+YUciWk8KSwPXU
+eFuiC+4ad2weu/jZ2ZO10p6EG73jDUORW6OHs6WHa+2jk+JafB4J8Conlzk7xKAj
+tIRQwaIcTQvcZhbU7xs7v+9pot7hAbjK49O+8OKH4R+1kpMlMukSGct43BZWSOp8
 -----END CERTIFICATE-----
--- a/test/ssl/server.csr
+++ b/test/ssl/server.csr
@ -1,12 +0,0 @@
-----BEGIN CERTIFICATE REQUEST-----
-MIIBtjCCAR8CAQAwdjELMAkGA1UEBhMCR0IxGDAWBgNVBAgMD05vdHRpbmdoYW1z
-aGlyZTETMBEGA1UEBwwKTm90dGluZ2hhbTEPMA0GA1UECgwGU2VydmVyMRMwEQYD
-VQQLDApQcm9kdWN0aW9uMRIwEAYDVQQDDAlsb2NhbGhvc3QwgZ8wDQYJKoZIhvcN
-AQEBBQADgY0AMIGJAoGBAKuNmJdfl/qC+lYBbfFuq+9HpiRsH/Ga5YANWHEvvggl
-h4ESC6Kq6hnudYxmiFs1rHmm/+TgG5cZ2o0oUFdxwf9Eu75P5+jnVL8UzxKRsQ0k
-myQchDaomZ4ehxgZ8YPIrv2ir14puqysW1YcHA1kw4DRTMUhqG64svMDehs1458P
-AgMBAAGgADANBgkqhkiG9w0BAQUFAAOBgQBKfRvwCj6N1SlwGLwJ7NWrasIYE4qP
-L1+K5l0xnchICmB4r2kGMN7uoYZGf+rbufQXV6R4DrnsNQVLZGB0OIs0qH1dOIr4
-dr9+VZwSKkig+EGSkefKCsqaS9IzlosT+tsOc2AAl4xpradpVbt7Ln6GlpNfNP+x
-ry3A9QBKB3zdMw==
-----END CERTIFICATE REQUEST-----
--- a/test/ssl/server.key
+++ b/test/ssl/server.key
@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCrjZiXX5f6gvpWAW3xbqvvR6YkbB/xmuWADVhxL74IJYeBEgui
-quoZ7nWMZohbNax5pv/k4BuXGdqNKFBXccH/RLu+T+fo51S/FM8SkbENJJskHIQ2
-qJmeHocYGfGDyK79oq9eKbqsrFtWHBwNZMOA0UzFIahuuLLzA3obNeOfDwIDAQAB
-AoGAIbMdCI9kwXc9SevZ9xVwfP6sKnd7BvEQqEj22LUyNVN5/ObYlknQ1us6+Cuk
-GZa/nN4rYoCLqvEPN691qNfV7cbiIJcGEMXkBnjaM/ISh6Iv0eGNsX+D7PZOchLK
-dlVg7wdzRsuOlbGkWAOPpCLL8JazHKp89+RjiPajB1IEQaECQQDaI/ZZVbiDvTBY
-ZI57XJR7eSrn5WcN+LGhOv8G+3HXNDh7hcTAlvfQkZxXHIcc/SgWnkfKBEaC7P5W
-T4ImQHqZAkEAyVO+tq/w6rcCK8x0LHjyQ2lmMCKCL/oJ/oWjQCEeZPyII1anZKhk
-9Lkbzf432FZn8s2aOS9D5x6TjfJxgkNX5wJAK2CLVChfkJLGUk1sp8s5G3R0u7g6
-TeTuLYl1vQWzFYAk2ys2fLWIgcjytb/Ofk0484Z18A35l39Y9ADLeJ/JwQJAZf02
-r/WRZlYvk2CPubfLgrryOZBBw2w3g+jPOr2MWDxV+xD629My0Ya0vzX5tG6RWj8t
-0apQC9VBirc3KXZUIQJBAJ+y07xmUN5a2wpDu3UzmeZn3HdzJO7fBAPi4h8xnLZQ
-N5Qu629DQq+X/TzVv2GjBWQHePjezL0NPfch9VzKrMM=
+MIICXAIBAAKBgQDMoB5qfCDwP7JILWGNuduopWVrE4g3xxLXMty2/YlM/S6/5jT1
+rJ3bglSxnIR7p686fon9fv7xPW9GGyjy2WV2DRFKEIup670RLKhdCjBlx5kflogu
+8aUVYqlKK1CecAQMPSRVS8PShldPdpFrKzVAELLwwhc/2t3RAKcyZDcktQIDAQAB
+AoGBAKS4MEPf8FP1snpPrbv85Un4+o8bhggAhLYfB3V22tPS65MmqXMqpVhSrgLb
+z/oKnhAkVMhvNqLTpYN10ZzMS9MvaUK2G7TeNAFVuZcs4bit0YJchf/s947SOuZp
+lSjIqbjiAkHsediyqsSZxMMwP2SxpevlmgPcdJfvwFeL6siBAkEA5vf1XPLF/etj
+bcGim24wo5rbfq2pgszbKRbhr3syeRSv7NFsC2adRswQ7ZL3pIP0KezlEXCuoY0Z
+fxs6QcFB/QJBAOLNSoihg26Z1omRR9LGS6iXrsLkznB/O6wGZl2dPMUO6fhXjOx0
+jXvubvrsuaZlavPc3U1bz9Q0r8xt++sXbxkCQHgEqzxUbyvmEDGtaBjKZn3tb1dh
+WG8+kjfEyxuLsguXA1/U5wb5mIp8aeN59jNH2i2bCuFII4aRMomJFXmrueUCQGdX
+r4yOO7sbsdvBLP7nh/XsF5+Kbl5oOyJpUB971ALehtG34uijOwyrWjpPv1AIijFQ
+BC6JlStWTnxR6SX36ZECQGtidHZtfChaaeGi5rgORalVSngj+b5qjeR/x6KbDw6y
+XmRC0C20CEyTgVwVsQVSAUoDiJSi4ol3/k5Yo5R9Lc0=
 -----END RSA PRIVATE KEY-----
--- a/test/ssl/signingCA/index.txt
+++ b/test/ssl/signingCA/index.txt
@ -1,5 +0,0 @@
-V	180829220329Z		01	unknown	/C=GB/ST=Nottinghamshire/L=Nottingham/O=Server/OU=Production/CN=localhost
-V	180829220331Z		02	unknown	/C=GB/ST=Nottinghamshire/L=Nottingham/O=Server/OU=Production/CN=test client
-V	120821000000Z		03	unknown	/C=GB/ST=Nottinghamshire/L=Nottingham/O=Server/OU=Production/CN=test client expired
-R	180829220334Z	130830220335Z	04	unknown	/C=GB/ST=Nottinghamshire/L=Nottingham/O=Server/OU=Production/CN=test client revoked
-V	190525125049Z		05	unknown	/CN=test client encrypted
--- a/test/ssl/test-alt-ca.crt
+++ b/test/ssl/test-alt-ca.crt
@ -2,57 +2,57 @@ Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2 (0x2)
-    Signature Algorithm: sha1WithRSAEncryption
+    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=Derbyshire, L=Derby, O=Mosquitto Project, OU=Testing, CN=Root CA
        Validity
-            Not Before: Aug 30 22:03:27 2013 GMT
-            Not After : Aug 29 22:03:27 2018 GMT
+            Not Before: Sep 18 10:49:53 2018 GMT
+            Not After : Sep 17 10:49:53 2023 GMT
        Subject: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Alternative Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
-                    00:d4:04:e6:69:13:5c:2d:56:c5:0e:10:f3:5b:34:
-                    b8:f0:db:00:4f:e4:c4:e3:2d:a4:32:0b:d6:ab:53:
-                    a1:a8:31:e9:e8:3d:6f:fb:8d:d4:f7:09:ad:54:5c:
-                    47:b3:27:4a:c8:d1:95:1e:43:2a:c9:4b:b6:c2:81:
-                    8a:4b:84:56:f2:88:43:b9:53:5a:e2:f8:91:6b:2f:
-                    26:1e:87:62:73:eb:c1:45:9e:7a:97:3f:f8:db:d2:
-                    bf:d6:44:20:a7:84:fb:11:eb:e9:cb:83:5f:74:39:
-                    a7:95:85:4c:0f:07:c0:01:50:01:ff:34:b4:2c:8f:
-                    50:d8:ee:61:cd:35:40:2c:05
+                    00:d9:91:e8:a7:67:b4:bf:8e:c9:6a:23:ee:00:14:
+                    6b:1f:b9:73:4d:af:ab:d3:96:5f:76:e5:0d:59:d4:
+                    0b:35:d4:48:5d:9b:9f:fc:e0:c2:29:b2:32:a9:e7:
+                    5b:81:bf:9c:55:e5:7f:e1:64:c5:c7:bc:10:3f:6e:
+                    05:16:82:47:e9:ae:86:97:75:2f:93:56:b2:4b:df:
+                    80:e1:a3:75:22:03:e0:de:93:5d:2d:98:ae:a9:c7:
+                    53:7d:a2:1a:c9:5d:83:0e:e2:60:52:a5:a8:82:fe:
+                    04:ae:be:1d:c4:c6:5c:ae:08:41:33:7a:88:4d:82:
+                    e8:da:93:b8:01:ad:c6:1b:75
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
-                9A:86:EB:20:AE:18:31:4F:8D:E2:0D:B9:FA:63:31:EA:DF:A4:8C:35
+                EC:E8:0A:3E:42:B9:F1:5D:F9:74:6E:07:8D:39:3F:63:53:7A:2C:17
            X509v3 Authority Key Identifier: 
-                keyid:28:8D:BF:F8:DE:D1:F5:BB:26:37:A4:4D:27:FD:37:91:EC:6B:0C:DD
+                keyid:DA:20:AB:E0:98:22:39:28:E0:70:D6:74:65:53:26:E0:6B:4C:96:39

            X509v3 Basic Constraints: 
                CA:TRUE
-    Signature Algorithm: sha1WithRSAEncryption
-         af:8e:86:a9:b0:74:70:1b:46:4f:85:3c:7d:4e:6d:a0:de:f4:
-         45:e2:34:d8:3f:a1:c6:18:35:ed:1b:f2:19:88:79:b5:da:a5:
-         df:e8:82:a1:e8:72:c0:da:68:3c:3b:83:fa:23:2d:85:d6:97:
-         b0:70:02:22:39:10:40:de:e6:45:86:a8:ee:85:a9:04:f2:51:
-         99:82:a2:e3:8f:b6:fd:8a:29:e8:3a:47:92:56:a6:98:cf:b7:
-         39:5c:4f:83:80:a9:9f:89:f6:a6:33:95:d1:f3:5d:65:30:aa:
-         ad:89:40:c0:fd:d1:24:6a:f5:b2:c8:50:71:9b:01:c6:cc:8c:
-         af:35
+    Signature Algorithm: sha256WithRSAEncryption
+         0a:14:f7:e7:54:44:59:39:14:b0:aa:d3:0e:bd:94:e2:0a:b3:
+         e9:65:31:c7:8c:0b:af:55:b9:c0:96:bb:2f:12:40:6a:4e:3e:
+         13:c8:7e:cc:02:06:83:41:ad:22:2b:15:ea:fe:c4:09:25:2d:
+         e7:d4:f4:91:59:4e:6b:c9:8c:c5:a3:e0:f7:d2:56:1a:ea:82:
+         a6:06:15:d8:25:03:2f:71:c4:78:5c:ba:ce:8c:a4:80:67:58:
+         33:12:86:df:ae:da:bd:d2:ff:e5:71:d0:8a:1f:ad:b4:0a:70:
+         52:d7:04:0f:f8:2c:b9:1c:8e:1b:5b:c2:df:f8:ca:c9:97:4e:
+         1a:0c
 -----BEGIN CERTIFICATE-----
-MIICqTCCAhKgAwIBAgIBAjANBgkqhkiG9w0BAQUFADByMQswCQYDVQQGEwJHQjET
+MIICqTCCAhKgAwIBAgIBAjANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJHQjET
 MBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkxGjAYBgNVBAoMEU1v
 c3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAwDgYDVQQDDAdSb290
-IENBMB4XDTEzMDgzMDIyMDMyN1oXDTE4MDgyOTIyMDMyN1owcTELMAkGA1UEBhMC
+IENBMB4XDTE4MDkxODEwNDk1M1oXDTIzMDkxNzEwNDk1M1owcTELMAkGA1UEBhMC
 R0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxGjAYBgNVBAoMEU1vc3F1aXR0byBQcm9q
 ZWN0MRAwDgYDVQQLDAdUZXN0aW5nMR8wHQYDVQQDDBZBbHRlcm5hdGl2ZSBTaWdu
-aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDUBOZpE1wtVsUOEPNb
-NLjw2wBP5MTjLaQyC9arU6GoMenoPW/7jdT3Ca1UXEezJ0rI0ZUeQyrJS7bCgYpL
-hFbyiEO5U1ri+JFrLyYeh2Jz68FFnnqXP/jb0r/WRCCnhPsR6+nLg190OaeVhUwP
-B8ABUAH/NLQsj1DY7mHNNUAsBQIDAQABo1AwTjAdBgNVHQ4EFgQUmobrIK4YMU+N
-4g25+mMx6t+kjDUwHwYDVR0jBBgwFoAUKI2/+N7R9bsmN6RNJ/03kexrDN0wDAYD
-VR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQCvjoapsHRwG0ZPhTx9Tm2g3vRF
-4jTYP6HGGDXtG/IZiHm12qXf6IKh6HLA2mg8O4P6Iy2F1pewcAIiORBA3uZFhqju
-hakE8lGZgqLjj7b9iinoOkeSVqaYz7c5XE+DgKmfifamM5XR811lMKqtiUDA/dEk
-avWyyFBxmwHGzIyvNQ==
+aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZkeinZ7S/jslqI+4A
+FGsfuXNNr6vTll925Q1Z1As11Ehdm5/84MIpsjKp51uBv5xV5X/hZMXHvBA/bgUW
+gkfproaXdS+TVrJL34Dho3UiA+Dek10tmK6px1N9ohrJXYMO4mBSpaiC/gSuvh3E
+xlyuCEEzeohNgujak7gBrcYbdQIDAQABo1AwTjAdBgNVHQ4EFgQU7OgKPkK58V35
+dG4HjTk/Y1N6LBcwHwYDVR0jBBgwFoAU2iCr4JgiOSjgcNZ0ZVMm4GtMljkwDAYD
+VR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQAKFPfnVERZORSwqtMOvZTiCrPp
+ZTHHjAuvVbnAlrsvEkBqTj4TyH7MAgaDQa0iKxXq/sQJJS3n1PSRWU5ryYzFo+D3
+0lYa6oKmBhXYJQMvccR4XLrOjKSAZ1gzEobfrtq90v/lcdCKH620CnBS1wQP+Cy5
+HI4bW8Lf+MrJl04aDA==
 -----END CERTIFICATE-----
--- a/test/ssl/test-alt-ca.key
+++ b/test/ssl/test-alt-ca.key
@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDUBOZpE1wtVsUOEPNbNLjw2wBP5MTjLaQyC9arU6GoMenoPW/7
-jdT3Ca1UXEezJ0rI0ZUeQyrJS7bCgYpLhFbyiEO5U1ri+JFrLyYeh2Jz68FFnnqX
-P/jb0r/WRCCnhPsR6+nLg190OaeVhUwPB8ABUAH/NLQsj1DY7mHNNUAsBQIDAQAB
-AoGACeLwm5W7hqG1LqK7tlUPCqwrp44TYESQk4TZzcNoll89eQbkYeaLN7nLy1NC
-RKhgZFzhhze6lwhgzVEdEchqBW9qtznz/D2rxKfuRrlKylG7WzOIPHjIWFpkuRcm
-7rTJnqMTBndH8zfGd8c+q7YVRxgA4r4UG8NMq9Mqrp0LmgECQQD7eisZIbsbgVpW
-cM3zusTYcud+eky0TJhHuZWRFoIrvNk9iHEcI47J+0t4bTlXxuU9oarL3bvMmNBb
-HMceWwnpAkEA19UP2MgM6yKioYJ+2pCYlNdWLR3HHAX4QY1VJk4C2+V5Sw7Ld3NP
-WBOH5XYK5tfWmmt+C8g2ga1iY9BEb9cjvQJAIAGDfLZbTvvemIPQ4oVRyk6Ngf5k
-xsm809wd2hJoTNLDP16fLrqj0Lcn+tLD6pUI1hg+WaYF4dtNIVt/SDDECQJBAIpi
-TbrM6ZuJpYSwyu0QcQRd3R8oTJWnLjm5iLL6qdKcG10Iq2R3RpROUX/KY8sG8M4p
-xbOAN5KFvOQKkRa0dnECQQDkz6bXTDHQlerNZ5B0MFFL5VrOC/n4qyVvtJ4jasK9
-3GF3X27zr4XyMfKgL+WPLJMG5nmv62MV1vhUtbvM+GqN
+MIICXQIBAAKBgQDZkeinZ7S/jslqI+4AFGsfuXNNr6vTll925Q1Z1As11Ehdm5/8
+4MIpsjKp51uBv5xV5X/hZMXHvBA/bgUWgkfproaXdS+TVrJL34Dho3UiA+Dek10t
+mK6px1N9ohrJXYMO4mBSpaiC/gSuvh3ExlyuCEEzeohNgujak7gBrcYbdQIDAQAB
+AoGBAKh2ovekhD7i17AYu/tR1BSPaulXQaumvqp39tt8JWX7xkC89KdAfPb+JN6L
+5r3TWMDl4BvtBHuAcfA7RzNDk1u/DZUT25ZnkbnL9iuQhBweRLETGSbBcrJ/VvGi
+BXBB9bQfAbtUqF4MiPVIjgBSZn/Jtgz0A9PAKYpnhqvpIVStAkEA8kBBNAOA0ZI7
+r3DPEiL9QEMad0tDBIkM8hcFYVwPqi0O5mRt4YXDev0OzyvTVYX5Z1BaF5uJvUSH
+y1lvDdpYkwJBAOXrDhnmW0K6xCYIqLVfdXG4LIx/exCQuYr78QGVV1rE4UCuIDZl
+zOlRmmLzFsP1T8bArYGSxWqtU1ZYgv8uaNcCQQDlT1VpOvexaU7+Hzaj4GMBdYOT
+8LYbkO+kKY56Pn7Fg6lbBS3OEKSdwvVFviJqDkurNDBTsHONqVUxdBLfdhPpAkB8
+9ZLVasig7OcckMo4wWgQZXv45HRbXX0qV6H2LVer4qNWRw0E47FKAer56oqt+E7i
+g+gJK18Wiptnq3WPAYdDAkAdaJWEoOWkQROPvlKWlD51hAqCReb9ElxAeJOcte/Y
+k1xir4zsMLo8cjqr/GLWVMhYv4zw9ZoKMNR7tfmYLZUC
 -----END RSA PRIVATE KEY-----
--- a/test/ssl/test-bad-root-ca.crt
+++ b/test/ssl/test-bad-root-ca.crt
@ -1,17 +1,17 @@
 -----BEGIN CERTIFICATE-----
-MIICujCCAiOgAwIBAgIJANMI717jaH+OMA0GCSqGSIb3DQEBBQUAMHYxCzAJBgNV
+MIICujCCAiOgAwIBAgIJAOk0UydITfTbMA0GCSqGSIb3DQEBCwUAMHYxCzAJBgNV
 BAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYDVQQHDAVEZXJieTEaMBgG
 A1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsMB1Rlc3RpbmcxFDASBgNV
-BAMMC0JhZCBSb290IENBMB4XDTEzMDgzMDIyMDMxN1oXDTIzMDgyODIyMDMxN1ow
+BAMMC0JhZCBSb290IENBMB4XDTE4MDkxODEwNDk0N1oXDTI4MDkxNTEwNDk0N1ow
 djELMAkGA1UEBhMCR0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxDjAMBgNVBAcMBURl
 cmJ5MRowGAYDVQQKDBFNb3NxdWl0dG8gUHJvamVjdDEQMA4GA1UECwwHVGVzdGlu
 ZzEUMBIGA1UEAwwLQmFkIFJvb3QgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANgcLofeUGl23VLK8ZMgoc8/shrVQFRgBAk4/0S6+HHNZg15Nm3ECl9voC4q
-fZY0g0ZCGvWA9QPim1lR7RjzWk4GCjyyJrGAPaQ96Dr1t6xq9eO3l0QyAgyuV3UX
-IYhWhuf3q+HtHmZJfof1RSLjNf5JFRCxWoYKGmOP+nDVchCnAgMBAAGjUDBOMB0G
-A1UdDgQWBBTeznI4RKjkyJl7N+BvRGCBZAIO2jAfBgNVHSMEGDAWgBTeznI4RKjk
-yJl7N+BvRGCBZAIO2jAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAKnY
-Fco0xDWuqeJsGJzMiHqWVy6NAfZyMt1UJAojry+jDQXgW+zPscpwAd+24xQLPPOR
-R+Cp666oAr1oksaU93Lo5hUmc+1dkaFQZspZ4H29ItZ701OptgSABNTmj2nvdQEG
-t8HBAF1tzN8Vxrvy4Mtzs51E6M0oVIV+TegQgXSJ
+AoGBANuiMnQx8FL6FD2kGa3xG0Tv4iH1yECdJ8hzcdxESC/ecmaXMwGPiEmUyymU
+/xRyQysHafhchc1lJvDmeFL13z4vgNPpJDhVCdji2QAq2IAKasLSZ3rhCYFhjvIO
+wPHZxLtWeOgVqYRxWC58eF5H8wnBMOcfRBy5R/N9PYA2sZjdAgMBAAGjUDBOMB0G
+A1UdDgQWBBTi2KR5GQHHN6hKI+Tfhqy4mLDMUTAfBgNVHSMEGDAWgBTi2KR5GQHH
+N6hKI+Tfhqy4mLDMUTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GBAIr6
+ie8HXzJYNZagjLVV/BkYKKe65FpmVk+3DdPqTtDhKGr8MpqkQlbBH8Ovocm3+eeN
+om2qrwfymji5FGh9SV6kI7UCiIZ4r3VCo+npmwh8QKTv5yP5nCiUGrDEFUkg4VOt
+HZTDW6L52WTHDJc/5Dh/MRhT07wox7BesgNWv21w
 -----END CERTIFICATE-----
--- a/test/ssl/test-bad-root-ca.key
+++ b/test/ssl/test-bad-root-ca.key
@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQDYHC6H3lBpdt1SyvGTIKHPP7Ia1UBUYAQJOP9EuvhxzWYNeTZt
-xApfb6AuKn2WNINGQhr1gPUD4ptZUe0Y81pOBgo8siaxgD2kPeg69besavXjt5dE
-MgIMrld1FyGIVobn96vh7R5mSX6H9UUi4zX+SRUQsVqGChpjj/pw1XIQpwIDAQAB
-AoGAMo+dX1JnE9WogGdUz6xRzzBC1j5QV61DJHk+V/E6kT2SA9L5JgM4vg1at5Jf
-YZYVpIlwz0GFkYwh9mrRgwXkeXB4LfA31VTOw5l3NzRGyHERiFlhnf5W5pEJOaWm
-gaOm7/5M5MBrQqgdNHGNhr1hgggXnSXbrhoOu8LmItcGxrECQQD5HBsQSlE+AJg7
-ayAfugbmRD+P9OyCDPx19GHL3D0FWc9xGLn5XQ9qFyGgY8vKkRUUsAn4TyDLjyBa
-zWsX0chvAkEA3hZpfDtZuEtdhA2H5xq8WCH3DU4a2Qf/isB+r1PMV1xZ+FfmqmBE
-d6g83NpjyWreZG9bafERCLO8mAjhQdknSQJAVref/DXCvlC6rcSG9ERv7mzHq7dZ
-NZSLtgwSl0LdwyUWf4paAyKQISBYRls3MBb9PaxibBwvkG0MmE91/l665QJAfwGk
-K6apZYq8HTO7v797bI9oAJTlJ666RjhVeqDaoC8xSKPERzUskp2EyOyf2mUib597
-ULfK/QYE2ZFieMzd+QJAIYYxEYBb1LJ4PPDsV5JQRmaMb6r5ElOMl0sJs878o0L+
-oOOeyn/8cbKHTtJLfm21YfNUO1TsRJZ3bOlhAPrT/g==
+MIICXgIBAAKBgQDbojJ0MfBS+hQ9pBmt8RtE7+Ih9chAnSfIc3HcREgv3nJmlzMB
+j4hJlMsplP8UckMrB2n4XIXNZSbw5nhS9d8+L4DT6SQ4VQnY4tkAKtiACmrC0md6
+4QmBYY7yDsDx2cS7VnjoFamEcVgufHheR/MJwTDnH0QcuUfzfT2ANrGY3QIDAQAB
+AoGBANXsSIpGbdbUP8y+Pkjes3nU0IPVWmQc7jfewgMR+uGtH+5uzL5zaAKLS8rH
+lh/7HxMVGJFQxP6GzIQNZxse4n1oXVstqa9xCoXQhUHpq6a/HdzbtMvg25SK6BXy
+0F5d3y+MZAkat2JBIIRhpEm9A42Zy2z+uD5t/tJoF8hGw5g9AkEA8K1hUZYlf77p
+hsHK79bAa9LTCqA+GX18Dbwixq1m01Mf1+JUJVURfuZOPlHldmUR30ELu6ojo84f
+2TCLnenPawJBAOmd13FummA+UZNqK7GjXE0gYXqR99Q1zV8ZL5fgE3femiUIPIor
+WpjzxNOcDqgGaHmXsh7s4HBJsAAKuWJUstcCQQDhE7PkYb815WttK8TGYRZYf7P/
+xvXsTq76BUyccsOrs5we/7ljpFeVTnozy9EE1OZO2/zGBwoHgZfFPKIFDwh7AkBM
+jQdCyS5W6TTL7Fdi/xfIwhqPEnO2GucwCU26I5fdiJjUF63WzLwEMKTHfnSjBG6J
+oXahgZdN1CeS6/CxUvXDAkEA48RD37aRhPBhE7s4Z0oODABYst+dKLOfbvnM8KY1
+XXYblkJPmmBfWb4bG+huYIaDYkfjZ6KJfJtk3tG8E3TWbA==
 -----END RSA PRIVATE KEY-----
--- a/test/ssl/test-fake-root-ca.crt
+++ b/test/ssl/test-fake-root-ca.crt
@ -1,17 +1,17 @@
 -----BEGIN CERTIFICATE-----
-MIICsjCCAhugAwIBAgIJAOOjGsO7TBrTMA0GCSqGSIb3DQEBBQUAMHIxCzAJBgNV
+MIICsjCCAhugAwIBAgIJANlFsLqxEDJbMA0GCSqGSIb3DQEBCwUAMHIxCzAJBgNV
 BAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYDVQQHDAVEZXJieTEaMBgG
 A1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsMB1Rlc3RpbmcxEDAOBgNV
-BAMMB1Jvb3QgQ0EwHhcNMTMwODMwMjIwMzE3WhcNMjMwODI4MjIwMzE3WjByMQsw
+BAMMB1Jvb3QgQ0EwHhcNMTgwOTE4MTA0OTQ3WhcNMjgwOTE1MTA0OTQ3WjByMQsw
 CQYDVQQGEwJHQjETMBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkx
 GjAYBgNVBAoMEU1vc3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAw
-DgYDVQQDDAdSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCih0Ux
-pn7wdxufnDagJtW/mf4at3n1TKGVNirCIh8hoU+EdIqLarNt9ayWnJc3h8cHvG9F
-21ic2zbM+I5L9Iavqkpb9hChLm3Ft+HIxKliXnB48Fr5r1J/rt3jIHHwE02HcPm1
-TqLKejHpjngZuMjRV/A5CVJ/iAQZy9ABRjEnRQIDAQABo1AwTjAdBgNVHQ4EFgQU
-8YIrNiwFO8c97RWwfMUGokdbxU0wHwYDVR0jBBgwFoAU8YIrNiwFO8c97RWwfMUG
-okdbxU0wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQCI9QpvF3fdWO1g
-W+zOZzBPspqIXqoRou8P135lNTLWHTixFAscWNdPOZn19zzmPGRKMMmtzOqoRMAx
-XDORn9n7ZhyIn2kjw5nTfwrO21TsgYaUOGQSCay5GPFryAEX+1kWkqOoVbJ3F99Q
-wU8uq/pogwQ/VTSQJqgUCEvN1aiyLw==
+DgYDVQQDDAdSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDX3o3H
+JPVGSfB/MdMNIBw+goqXmJdeAm4Ied0pkvC+KqIIp3xn0tiIdn+cKzn2hRk9UnW1
+IxAxKwVYRrASIRkFSFieRzhCTbZ1DxoI+DxLiE9RNH6b9M4u8nhlb9qApRgfpQsL
+6gM5mG7QbXADyKPS9ToHU0YM3MpOiLOEDDbV/QIDAQABo1AwTjAdBgNVHQ4EFgQU
+tQbx/zTi/+cZAQS63KiVZy+KaHAwHwYDVR0jBBgwFoAUtQbx/zTi/+cZAQS63KiV
+Zy+KaHAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBLHJkJGaeAZoMq
+d+wHJ+W/QJuU2xPACbCb7b5nA3WXnCj7A81IoFOJzdvlaHf9re7FvuVjK5kdhbVR
+jz79e/RWHu2Q1vb8ftFqx8XISy3+wQR07NPmrFRmT0cfV06yiYjL0obQFyiXQ1y+
+xXVWHQ/2EkTGVBFKyuRBBmqWbzFj7w==
 -----END CERTIFICATE-----
--- a/test/ssl/test-fake-root-ca.key
+++ b/test/ssl/test-fake-root-ca.key
@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXgIBAAKBgQCih0Uxpn7wdxufnDagJtW/mf4at3n1TKGVNirCIh8hoU+EdIqL
-arNt9ayWnJc3h8cHvG9F21ic2zbM+I5L9Iavqkpb9hChLm3Ft+HIxKliXnB48Fr5
-r1J/rt3jIHHwE02HcPm1TqLKejHpjngZuMjRV/A5CVJ/iAQZy9ABRjEnRQIDAQAB
-AoGBAJiL7l4Tr8FzifHdZUgcKzOTDfV1kHq0WlT6alecPywJg+EGoaMJmy/yDvOu
-NiBgyGZybt5aammPN3hbMvQHpwFqswU6H09YjNYGHgA1sqvZhgczLL6l0PM8dwTl
-LDL72SQL5sxM8podBaKVqbXgbGHugvV4cG3l/YzqIednfk0BAkEA1f9L3Fx9nN6B
-jUeS9QY80wk7CjAuARHxvlarmTMX08UZgmo4DgwFK0yP5mLiz+X+2xyyClOHOnU+
-8Gcw/pBAeQJBAMJt0o0VOBQW2L8lFnc6mJedTwpohAVJAb957UO4VcR+RmyARd5G
-gIYQzQp7pXikOBb97X7BSFDW/dnIbbCD4i0CQQC9MAWOHIrEq4XXNCa8zjXp0KhM
-eonBUm7o+lCckSoIg6DoxiUmbgQH4pj5cgTZDZmBdt4D+RJ9YPgyqtgKxdbpAkEA
-hOJ6nWJ7SX+z9DBtAmBSGo2xj/OPB+21/CBhQX+jXwDPMSkal6in/vlMqnWHysSy
-cURsJc4ElvvZ1BdgoNwCoQJAFceaHLS/G6PKZ+ASdjSUthYIPfXXh8eg4K082uUp
-TLN1/csizBLn5Z74T0gGBDD/w1K9/xZ2cUNO+wLkNT9JJg==
+MIICXQIBAAKBgQDX3o3HJPVGSfB/MdMNIBw+goqXmJdeAm4Ied0pkvC+KqIIp3xn
+0tiIdn+cKzn2hRk9UnW1IxAxKwVYRrASIRkFSFieRzhCTbZ1DxoI+DxLiE9RNH6b
+9M4u8nhlb9qApRgfpQsL6gM5mG7QbXADyKPS9ToHU0YM3MpOiLOEDDbV/QIDAQAB
+AoGAKzBjvUwvpnh0nX4ic6XRANCtWdc1saFa0mdPUFoNwH5XHNQll8Afgm3y6hPb
+7O6ENjihRDRXsP6iex7pazckAgQ9zvIhXwyfAxHJ8T8+xJrb2ohMNbl/mdWkZzJS
+HmfLwmTl8n2FTnUWOCRZ4DWZmxoqK04VcxFK2/ZvY9neZCECQQD88xjgt8zfk9k0
+UAKRQyqnoWbpthMDecLGwL3jjfGDts79TvSv7iwtq10uSQycFApMQlKysz7a4wsV
+IMir+Z2XAkEA2nj7o7kiN/lhREcTf865mjo6Lol4vk6UDcNGQ8zHeoYiQMwIyhiR
+MnFYzMeZT/tjD6O5JuJwyO74dCHqhYaDiwJBAIlhVp+l88VyPUOmON7ARghpJsXE
+N6tplBnyUK+oRgWtYdo96bMrfh8HtUIQNqMGV1l3pAaeR4MGUNyWw6Zzmd0CQQDB
+6E+w6Ujt1XH3X/52mc0yjivF0k5Q2v2dmYxr8P28SgFs8at7dIKq+t+OIjp5Ou6Z
+mv9i++iO70umB9RX3yQxAkBY1E0dLGusSZ8BWugiminaZ8E0QdAwENIl02NleerY
+ANdCQvvt3/KtfqiAhwakyGv4sdxa7Uo5KUaDKhqZ++0N
 -----END RSA PRIVATE KEY-----
--- a/test/ssl/test-root-ca.crt
+++ b/test/ssl/test-root-ca.crt
@ -1,17 +1,17 @@
 -----BEGIN CERTIFICATE-----
-MIICsjCCAhugAwIBAgIJAPTHt3psLAUTMA0GCSqGSIb3DQEBBQUAMHIxCzAJBgNV
+MIICsjCCAhugAwIBAgIJAOcAUKw/VPlMMA0GCSqGSIb3DQEBCwUAMHIxCzAJBgNV
 BAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYDVQQHDAVEZXJieTEaMBgG
 A1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsMB1Rlc3RpbmcxEDAOBgNV
-BAMMB1Jvb3QgQ0EwHhcNMTMwODMwMjIwMzE2WhcNMjMwODI4MjIwMzE2WjByMQsw
+BAMMB1Jvb3QgQ0EwHhcNMTgwOTE4MTA0OTQ3WhcNMjgwOTE1MTA0OTQ3WjByMQsw
 CQYDVQQGEwJHQjETMBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkx
 GjAYBgNVBAoMEU1vc3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAw
-DgYDVQQDDAdSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDB3KGu
-pkiSYbDAaH0ewiCb44CLsAdV5PdYgZHH0jlH8oXkNH0MU3qs7Se2UWrnPQb1VbdI
-K2DpSTk+3XuWO0BOqQ+/JuRFN/omwrucyKcRNm4MQP1aY2Tm04zsP0Muy4aSyMIk
-F6jxQzAmIgj8VgkQ/y/knS5tbQ2kkoWKRn1RCQIDAQABo1AwTjAdBgNVHQ4EFgQU
-KI2/+N7R9bsmN6RNJ/03kexrDN0wHwYDVR0jBBgwFoAUKI2/+N7R9bsmN6RNJ/03
-kexrDN0wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQCn2WxbxDd5ar2U
-UvttJW4I+/V1h3iAQCXVDAegOGzsYp3cfIdd2oZY++Q9FhzHh8nP18D+CeC9MMu2
-H2iLULUV08cGSaDLlpo1eq2oJc5ygLOEt/XK7/aIMRwrlP/CoSrI2GPkeA8rka96
-G0WtyGRkzqBKHpt6CnseA2evP5NVcQ==
+DgYDVQQDDAdSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCeTh1y
+KRZ1NIeLVvhBxSQC3Cvfe9L3IC8415CVbgipLgZKe7Nl1JBqFYDxXKBn2eVQ6EwL
+sCz+U2oa2oCql8r5eYEKpmWFiIcKdrL8aSXNvMKEOu0AJlsIXBe2sDFPxuuw143n
+W/odqBiWedciVd5pmJWZZ93neWdkkjnPZZMN4wIDAQABo1AwTjAdBgNVHQ4EFgQU
+2iCr4JgiOSjgcNZ0ZVMm4GtMljkwHwYDVR0jBBgwFoAU2iCr4JgiOSjgcNZ0ZVMm
+4GtMljkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBIs2GY/GQL76rz
+0qSWZvQ7l+HovHdp7C49auI+hiSRAzv3p2y7y3DmZrpmYJlTZJWlaA8eg769sLg
+Cyfkt6AIsZPadJiTTUayh8oCF5aMH+OetC+63USFBNYXJN6AOXp9vu/K3TdM8ao6
+WsAf26+DKYAPmvu+oU7ScpCrCSdC+Q==
 -----END CERTIFICATE-----
--- a/test/ssl/test-root-ca.key
+++ b/test/ssl/test-root-ca.key
@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDB3KGupkiSYbDAaH0ewiCb44CLsAdV5PdYgZHH0jlH8oXkNH0M
-U3qs7Se2UWrnPQb1VbdIK2DpSTk+3XuWO0BOqQ+/JuRFN/omwrucyKcRNm4MQP1a
-Y2Tm04zsP0Muy4aSyMIkF6jxQzAmIgj8VgkQ/y/knS5tbQ2kkoWKRn1RCQIDAQAB
-AoGAJJUM0ZdBVJYos3ZEPhyl6KTaqgFysOu/HS1+I/XwpzoFuBWLj1rlaGJsPwRI
-JxCmEn+1UWIWLI+LxOgonSXbMWg+G+un/UxgsPGIPeskDuqPXe97tdnd5c1HDwNf
-Sy6fzzd0PyyFHrUnxCDl5Y6oJ3O9ZJ1vfELIVyXDoXyCKi0CQQD3U1SM7YhgczaO
-9EwHJI8DBeab09DZ3gUT/4zeNVeHGjRtYhZuxJWeINsj0gUJtG/yY6+CaHm3TGPj
-WOToqq0/AkEAyKlD6uIJ0YuBozmSTkBUJpEaQ1xkDszgUPlxS+73IGz+LZjstbML
-l1irYV5OyWMDdg/JUmnXl+8gOV+1UtFHtwJAfmDGQ3zcwuwcZM/QSZYUvaa2P8ns
-XmdkkON0R9dZ8l8hiwMkE1XAXhzL3XHjwSHCUkk91ZUtHMyb/f/eeEU+YQJBAJxD
-3QVlBFpwNwPDCOHxjNb/9yDwKWexOxs0Nnv42/EfkA44YlbZ2TQCtGw+QkLo3cAq
-aRDKJkBG06R6mT2mhx8CQEhJ5VEhTuM88SQ9mEUup4XDc9wSPK5VK7HLR0Ip22fU
-Lh1L/oAsWDIFo3zBQ9aSpiTWzAS/D7gyZPZz17dsJZk=
+MIICXAIBAAKBgQCeTh1yKRZ1NIeLVvhBxSQC3Cvfe9L3IC8415CVbgipLgZKe7Nl
+1JBqFYDxXKBn2eVQ6EwLsCz+U2oa2oCql8r5eYEKpmWFiIcKdrL8aSXNvMKEOu0A
+JlsIXBe2sDFPxuuw143nW/odqBiWedciVd5pmJWZZ93neWdkkjnPZZMN4wIDAQAB
+AoGAYXzLh20kJmOGAVo6og4sohJCdmtDvOo2CnQ91rgfX0g3mZDaJqCjmqDJelnH
+cozuOkgD5MLGwoxN8GGVEPlPhiCzPIAp4ZIKcdpHxlAPmVRAhkLDgJuMD66OksPn
+FxE5AqCUfZG+jpGy5KzlU2fyXyXt3zu9G6+Y9dbghXpnDekCQQDOxaGk50S2vJrJ
+y5U+DaiSjr9+Qt6bDgdg2Q2ZE8oF3T6jI0QG/c9S3NbIRWe5HydrZ4YRn7GNmKQz
+Moy/43lAkEAw/6EwrUAfrJJ8TVeRsHLYs8H68Nswo0RQPqXSeLcqJc5AwqVfWpe
+dJWSFpoHtelWfC7MMGrH26dwzt3YGUuwJwJBAIFqqyimY5ioZY1mMcv8CoVoeSyS
+t/d+iVmxoNQt0aVn+7tp6DskAu6PMJN69VelyytrSTugoyXH4wZwckYHM40CQGYD
+1JaEH/3STyp93NR3iqWjnTvaPIIHazOnO5f5vWEDVWl/2M+uzftg3ulkwx6slZeN
+xDpvWhe6z7zdO93ux4ECQCXOCNFRha+Rs5Leyd4us6/6yo9o0rgHowNY8HIHBH9F
+sEgq1pJxpSO3L7S5LpnhYkecIAHRzeGs1ikIDzIU/k4=
 -----END RSA PRIVATE KEY-----
--- a/test/ssl/test-signing-ca.crt
+++ b/test/ssl/test-signing-ca.crt
@ -2,57 +2,57 @@ Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
-    Signature Algorithm: sha1WithRSAEncryption
+    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=GB, ST=Derbyshire, L=Derby, O=Mosquitto Project, OU=Testing, CN=Root CA
        Validity
-            Not Before: Aug 30 22:03:18 2013 GMT
-            Not After : Aug 29 22:03:18 2018 GMT
+            Not Before: Sep 18 10:49:47 2018 GMT
+            Not After : Sep 17 10:49:47 2023 GMT
        Subject: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
-                    00:a4:b5:b9:31:d8:b4:d6:de:49:c0:cc:15:3f:b8:
-                    50:8b:be:4a:f4:d3:94:a9:dd:53:2a:e9:df:aa:0d:
-                    3c:08:7b:a7:51:6d:b9:44:98:b7:8d:03:ab:67:9e:
-                    e1:c4:23:4d:33:8d:0a:90:9f:c6:de:82:14:4c:f6:
-                    75:5d:a4:e1:a3:ea:fc:9b:79:dd:cb:36:20:87:a3:
-                    9d:eb:e6:5b:0c:53:34:73:cb:dd:a8:e4:0e:7f:f0:
-                    5f:8a:3c:d8:8f:01:ff:66:31:16:41:1b:e3:7a:61:
-                    2c:3d:44:a5:a9:dd:1d:42:e5:5a:a1:df:29:35:dc:
-                    91:5e:9d:82:60:0d:7a:08:db
+                    00:b7:32:f2:08:04:4c:77:03:70:3e:10:88:84:cd:
+                    cd:f2:87:2f:3c:67:8f:78:01:5e:d5:51:f1:11:68:
+                    4d:a7:e2:73:b0:69:b5:67:07:59:88:cc:b8:7f:ce:
+                    97:52:bc:fb:73:7b:60:95:a2:7b:c2:9a:f1:4d:5a:
+                    c4:42:55:c4:6e:02:50:a1:71:41:68:d1:6c:96:e0:
+                    3d:af:10:3f:7b:64:c1:3a:3a:c3:a9:39:71:08:29:
+                    45:c8:cc:da:33:65:b4:70:fb:36:bc:15:0d:a7:31:
+                    ef:d5:ec:59:ac:75:2b:77:35:0b:f0:db:3d:14:f5:
+                    9a:41:e6:a0:b7:b7:62:2b:e7
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
-                40:43:50:14:D1:63:7E:0B:7C:97:14:20:63:E5:8A:95:96:9F:D4:AB
+                EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52
            X509v3 Authority Key Identifier: 
-                keyid:28:8D:BF:F8:DE:D1:F5:BB:26:37:A4:4D:27:FD:37:91:EC:6B:0C:DD
+                keyid:DA:20:AB:E0:98:22:39:28:E0:70:D6:74:65:53:26:E0:6B:4C:96:39

            X509v3 Basic Constraints: 
                CA:TRUE
-    Signature Algorithm: sha1WithRSAEncryption
-         8a:b1:49:b4:53:eb:bb:9d:5e:20:f4:d7:8d:b8:24:a1:28:95:
-         56:72:03:ed:15:ef:f0:ff:65:b5:6e:34:cf:27:83:7b:57:40:
-         a7:93:61:f0:93:ff:02:b4:74:e0:43:dc:65:0c:e8:a6:20:f9:
-         8c:88:82:8f:0e:8d:33:4d:ba:bb:28:ff:29:5f:a8:96:60:31:
-         f5:13:15:19:60:a4:00:0e:fc:a7:79:b6:10:95:0b:7b:88:75:
-         03:ec:7d:94:63:9e:67:2e:2e:9c:fe:79:89:61:93:75:52:f2:
-         36:48:a6:2d:c0:b2:a7:36:c2:36:50:53:b3:cd:e7:07:1d:e5:
-         6a:1d
+    Signature Algorithm: sha256WithRSAEncryption
+         8a:98:17:cd:e1:dc:2b:1b:5b:16:40:99:21:c4:d4:db:3f:5c:
+         6a:ed:7b:a2:b6:df:aa:7c:d8:6a:3f:11:39:da:4c:ce:3f:e5:
+         99:6a:a4:b8:82:1e:53:7a:5d:f1:52:be:df:f1:3b:59:9a:a8:
+         bb:7e:f1:30:33:4b:7c:c3:ab:85:1e:c4:0e:ac:d1:7e:2b:cb:
+         9d:19:5b:df:94:b4:89:e1:da:5d:31:19:85:34:d5:33:55:f8:
+         af:92:ea:9a:17:c9:da:68:00:df:10:e9:e4:33:35:cd:15:57:
+         80:56:1a:58:94:37:d7:f2:02:de:9b:0b:d3:02:64:c5:8e:6f:
+         25:31
 -----BEGIN CERTIFICATE-----
-MIICnTCCAgagAwIBAgIBATANBgkqhkiG9w0BAQUFADByMQswCQYDVQQGEwJHQjET
+MIICnTCCAgagAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJHQjET
 MBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkxGjAYBgNVBAoMEU1v
 c3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAwDgYDVQQDDAdSb290
-IENBMB4XDTEzMDgzMDIyMDMxOFoXDTE4MDgyOTIyMDMxOFowZTELMAkGA1UEBhMC
+IENBMB4XDTE4MDkxODEwNDk0N1oXDTIzMDkxNzEwNDk0N1owZTELMAkGA1UEBhMC
 R0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxGjAYBgNVBAoMEU1vc3F1aXR0byBQcm9q
 ZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRMwEQYDVQQDDApTaWduaW5nIENBMIGfMA0G
-CSqGSIb3DQEBAQUAA4GNADCBiQKBgQCktbkx2LTW3knAzBU/uFCLvkr005Sp3VMq
-6d+qDTwIe6dRbblEmLeNA6tnnuHEI00zjQqQn8beghRM9nVdpOGj6vybed3LNiCH
-o53r5lsMUzRzy92o5A5/8F+KPNiPAf9mMRZBG+N6YSw9RKWp3R1C5Vqh3yk13JFe
-nYJgDXoI2wIDAQABo1AwTjAdBgNVHQ4EFgQUQENQFNFjfgt8lxQgY+WKlZaf1Ksw
-HwYDVR0jBBgwFoAUKI2/+N7R9bsmN6RNJ/03kexrDN0wDAYDVR0TBAUwAwEB/zAN
-BgkqhkiG9w0BAQUFAAOBgQCKsUm0U+u7nV4g9NeNuCShKJVWcgPtFe/w/2W1bjTP
-J4N7V0Cnk2Hwk/8CtHTgQ9xlDOimIPmMiIKPDo0zTbq7KP8pX6iWYDH1ExUZYKQA
-DvynebYQlQt7iHUD7H2UY55nLi6c/nmJYZN1UvI2SKYtwLKnNsI2UFOzzecHHeVq
-HQ==
+CSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3MvIIBEx3A3A+EIiEzc3yhy88Z494AV7V
+UfERaE2n4nOwabVnB1mIzLh/zpdSvPtze2CVonvCmvFNWsRCVcRuAlChcUFo0WyW
+4D2vED97ZME6OsOpOXEIKUXIzNozZbRw+za8FQ2nMe/V7FmsdSt3NQvw2z0U9ZpB
+5qC3t2Ir5wIDAQABo1AwTjAdBgNVHQ4EFgQU7mC7xxdf03KsM+6OhMwt2xrMilIw
+HwYDVR0jBBgwFoAU2iCr4JgiOSjgcNZ0ZVMm4GtMljkwDAYDVR0TBAUwAwEB/zAN
+BgkqhkiG9w0BAQsFAAOBgQCKmBfN4dwrG1sWQJkhxNTbP1xq7Xuitt+qfNhqPxE5
+2kzOP+WZaqS4gh5Tel3xUr7f8TtZmqi7fvEwM0t8w6uFHsQOrNF+K8udGVvflLSJ
+4dpdMRmFNNUzVfivkuqaF8naaADfEOnkMzXNFVeAVhpYlDfX8gLemwvTAmTFjm8l
+MQ==
 -----END CERTIFICATE-----
--- a/test/ssl/test-signing-ca.key
+++ b/test/ssl/test-signing-ca.key
@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCktbkx2LTW3knAzBU/uFCLvkr005Sp3VMq6d+qDTwIe6dRbblE
-mLeNA6tnnuHEI00zjQqQn8beghRM9nVdpOGj6vybed3LNiCHo53r5lsMUzRzy92o
-5A5/8F+KPNiPAf9mMRZBG+N6YSw9RKWp3R1C5Vqh3yk13JFenYJgDXoI2wIDAQAB
-AoGAHx3Jn9Ydy93wtwCXHxOV++B2TqxOEI0kch3+yCR56+xYXrTI5GGpg3VnA0tr
-wV8d7Zg+n7XfnxeZ+DQzVf6ZNc24mf7J7gM881GA1zmrUOyolpo5sgc9PW4mbyC1
-rvMsLyEGP+fP93MDJ0CYhQjxa4eGNsiLTXtHOsg9y4a1cgkCQQDXgy5ajpo4vzvK
-2zMPINIk2QdRQ6jIKwnKUtBmoNsCPcwIW1yhJUc6g1C3qGpi0p7edeLlOaAfugbm
-5m1M70L3AkEAw6dAg6fWTDNxt6IO6GtdJWoEJbzV7fWvRUuT6Zh/m14OwGMJvOQN
-vz4U0FFZK2EbUBL+Za5enzJRyj2AUOiMPQJBAMo3pukF4aPZnIstvu01CLnWgs03
-xUl9SMR1jGKgEKA7yBUXVQVH61v2F2kdOCXeJ3/p8arQtXTPouZJ1MlZv+UCQA80
-XzIcB+5SDSNNJ8VuGoX+0CWyoBlm/2DuN6dun3QOgiz3RVl1i4/yHiH2QGy7lijJ
-4RU70MSkX3DNCLzA5a0CQEb3xQSj+YJW7AHAQI8/9vSO5f2yYuyrtMy5aU8k7hKB
-Sopu/XLwoWt27pl596Gur0adYnBAZMYYueY8oCN5DNU=
+MIICXQIBAAKBgQC3MvIIBEx3A3A+EIiEzc3yhy88Z494AV7VUfERaE2n4nOwabVn
+B1mIzLh/zpdSvPtze2CVonvCmvFNWsRCVcRuAlChcUFo0WyW4D2vED97ZME6OsOp
+OXEIKUXIzNozZbRw+za8FQ2nMe/V7FmsdSt3NQvw2z0U9ZpB5qC3t2Ir5wIDAQAB
+AoGAU6dZybtcx0O0r0KRdEMd9c8xDJ4lbyEBEtu1/sLoIu9O8JF0mjVK9yK0ZPgL
+NWbCU3tVIT7u0HA8G5yE3d2YMfVCHTqkzrJ2pWlntgYcnYQSR2gjDnZl6iG/1VJ5
+aZh5+CjlwOstDiQLv+TKCfNVAa5Z4CC0jNt57tVuq/L0ieECQQDq4r+H5+DMUxaU
+sXQgLizqTubMlhumcRTa+edgBWGLMbgK00wVeDpQD+j6qZFbiklll2fB5fF/Qj/c
+D5RyByFZAkEAx6rEzYfIQLrJmy4RYcAlMFDMBvkpGTc1IGTDyjjsUmnOdF3ydnBx
+GUqQzuf6Iv9Af64r1WUwSzA+iy200brPPwJBAODsEyasZ/qhEf1/VElAjmgs+Bwv
+HfkrTiJGrkanwHmPOcK8BZ6Fi6mBIsNtvzDeYlxzOLtXWwNWyFoNXUQ4CbkCQQC8
+WhSjCibXIR1T/QY6nya1yFJfdaXWeqTsNQIZfs84A0XVslYqcnHOeO/Xry/g2cd/
+as9A097V3uHxKyG7Ay3DAkAtD9ifXcuCvtCeG5bsUlClOGmtzHX0Vw6ItYrI7WlX
+lKJux35Y2z5E3/x2nHHvw1tuQnuwldU6lbSs3/cy67+d
 -----END RSA PRIVATE KEY-----
--- a/travis-configure.sh
+++ b/travis-configure.sh
@ -1,5 +1,5 @@
 #!/bin/bash

 if [ "$TRAVIS_OS_NAME" == "osx" ]; then
-	cmake .
+	cmake -DOPENSSL_ROOT_DIR=/usr/local/opt/openssl .
 fi
--- a/www/conf.py
+++ b/www/conf.py
--- a/www/files/android-chrome-192x192.png
+++ b/www/files/android-chrome-192x192.png
--- a/www/files/android-chrome-512x512.png
+++ b/www/files/android-chrome-512x512.png
--- a/www/files/apple-touch-icon.png
+++ b/www/files/apple-touch-icon.png
--- a/www/files/blog/uploads/2010/06/powermeter-example-150x150.png
+++ b/www/files/blog/uploads/2010/06/powermeter-example-150x150.png
--- a/www/files/blog/uploads/2010/06/powermeter-example-300x138.png
+++ b/www/files/blog/uploads/2010/06/powermeter-example-300x138.png
--- a/www/files/blog/uploads/2010/06/powermeter-example.png
+++ b/www/files/blog/uploads/2010/06/powermeter-example.png
--- a/www/files/blog/uploads/2011/08/image-150x150.png
+++ b/www/files/blog/uploads/2011/08/image-150x150.png
--- a/www/files/blog/uploads/2011/08/image-300x225.png
+++ b/www/files/blog/uploads/2011/08/image-300x225.png
--- a/www/files/blog/uploads/2011/08/image.png
+++ b/www/files/blog/uploads/2011/08/image.png
--- a/www/files/blog/uploads/2012/08/IMAG0006-150x150.jpg
+++ b/www/files/blog/uploads/2012/08/IMAG0006-150x150.jpg
--- a/www/files/blog/uploads/2012/08/IMAG0006-300x199.jpg
+++ b/www/files/blog/uploads/2012/08/IMAG0006-300x199.jpg
--- a/www/files/blog/uploads/2012/08/IMAG0006.jpg
+++ b/www/files/blog/uploads/2012/08/IMAG0006.jpg
--- a/www/files/blog/uploads/2014/05/14098345978_c15d12f19a_z-150x150.jpg
+++ b/www/files/blog/uploads/2014/05/14098345978_c15d12f19a_z-150x150.jpg
--- a/www/files/blog/uploads/2014/05/14098345978_c15d12f19a_z-300x200.jpg
+++ b/www/files/blog/uploads/2014/05/14098345978_c15d12f19a_z-300x200.jpg
--- a/www/files/blog/uploads/2014/05/14098345978_c15d12f19a_z.jpg
+++ b/www/files/blog/uploads/2014/05/14098345978_c15d12f19a_z.jpg
--- a/www/files/blog/uploads/2016/05/stickers-150x150.jpg
+++ b/www/files/blog/uploads/2016/05/stickers-150x150.jpg
--- a/www/files/blog/uploads/2016/05/stickers-300x225.jpg
+++ b/www/files/blog/uploads/2016/05/stickers-300x225.jpg
--- a/www/files/blog/uploads/2016/05/stickers.jpg
+++ b/www/files/blog/uploads/2016/05/stickers.jpg
--- a/www/files/blog/uploads/2017/03/img_20170308_155049248_33196894011_o-1024x576.jpg
+++ b/www/files/blog/uploads/2017/03/img_20170308_155049248_33196894011_o-1024x576.jpg
--- a/Show More
+++ b/Show More