diff --git a/mozilla/security/nss/cmd/tstclnt/tstclnt.c b/mozilla/security/nss/cmd/tstclnt/tstclnt.c
index 5fabe7da767..43d6af022ed 100644
--- a/mozilla/security/nss/cmd/tstclnt/tstclnt.c
+++ b/mozilla/security/nss/cmd/tstclnt/tstclnt.c
@@ -65,6 +65,7 @@
 #include "sslproto.h"
 #include "pk11func.h"
 #include "plgetopt.h"
+#include "plstr.h"
 
 #if defined(WIN32)
 #include <fcntl.h>
@@ -210,6 +211,7 @@ static void Usage(const char *progName)
     fprintf(stderr, "%-20s Disable SSL v2.\n", "-2");
     fprintf(stderr, "%-20s Disable SSL v3.\n", "-3");
     fprintf(stderr, "%-20s Disable TLS (SSL v3.1).\n", "-T");
+    fprintf(stderr, "%-20s Prints only payload data. Skips HTTP header.\n", "-S");
     fprintf(stderr, "%-20s Client speaks first. \n", "-f");
     fprintf(stderr, "%-20s Override bad server cert. Make it OK.\n", "-o");
     fprintf(stderr, "%-20s Disable SSL socket locking.\n", "-s");
@@ -397,6 +399,83 @@ printHostNameAndAddr(const char * host, const PRNetAddr * addr)
     }
 }
 
+/*
+ *  Prints output according to skipProtoHeader flag. If skipProtoHeader
+ *  is not set, prints without any changes, otherwise looking
+ *  for \n\r\n(empty line sequence: HTTP header separator) and
+ *  prints everything after it.
+ */
+static void
+separateReqHeader(const PRFileDesc* outFd, const char* buf, const int nb,
+                  PRBool *wrStarted, int *ptrnMatched) {
+
+    /* it is sufficient to look for only "\n\r\n". Hopping that
+     * HTTP response format satisfies the standard */
+    char *ptrnStr = "\n\r\n";
+    char *resPtr;
+
+    if (nb == 0) {
+        return;
+    }
+
+    if (*ptrnMatched > 0) {
+        /* Get here only if previous separateReqHeader call found
+         * only a fragment of "\n\r\n" in previous buffer. */
+        PORT_Assert(*ptrnMatched < 3);
+
+        /* the size of fragment of "\n\r\n" what we want to find in this
+         * buffer is equal to *ptrnMatched */
+        if (*ptrnMatched <= nb) {
+            /* move the pointer to the beginning of the fragment */
+            int strSize = *ptrnMatched;
+            char *tmpPtrn = ptrnStr + (3 - strSize);
+            if (PL_strncmp(buf, tmpPtrn, strSize) == 0) {
+                /* print the rest of the buffer(without the fragment) */
+                PR_Write((void*)outFd, buf + strSize, nb - strSize);
+                *wrStarted = PR_TRUE;
+                return;
+            }
+        } else {
+            /* we are here only when nb == 1 && *ptrnMatched == 2 */
+            if (*buf == '\r') {
+                *ptrnMatched = 1;
+            } else {
+                *ptrnMatched = 0;
+            }
+            return;
+        }
+    }
+    resPtr = PL_strnstr(buf, ptrnStr, nb);
+    if (resPtr != NULL) {
+        /* if "\n\r\n" was found in the buffer, calculate offset
+         * and print the rest of the buffer */
+        int newBn = nb - (resPtr - buf + 3); /* 3 is the length of "\n\r\n" */
+
+        PR_Write((void*)outFd, resPtr + 3, newBn);
+        *wrStarted = PR_TRUE;
+        return;
+    } else {
+        /* try to find a fragment of "\n\r\n" at the end of the buffer.
+         * if found, set *ptrnMatched to the number of chars left to find
+         * in the next buffer.*/
+        int i;
+        for(i = 1 ;i < 3;i++) {
+            char *bufPrt;
+            int strSize = 3 - i;
+            
+            if (strSize > nb) {
+                continue;
+            }
+            bufPrt = (char*)(buf + nb - strSize);
+            
+            if (PL_strncmp(bufPrt, ptrnStr, strSize) == 0) {
+                *ptrnMatched = i;
+                return;
+            }
+        }
+    }
+}
+
 #define SSOCK_FD 0
 #define STDIN_FD 1
 
@@ -441,6 +520,9 @@ int main(int argc, char **argv)
     PRBool             useCommandLinePassword = PR_FALSE;
     PRBool             pingServerFirst = PR_FALSE;
     PRBool             clientSpeaksFirst = PR_FALSE;
+    PRBool             wrStarted = PR_FALSE;
+    PRBool             skipProtoHeader = PR_FALSE;
+    int                headerSeparatorPtrnId = 0;
     int                error = 0;
     PLOptState *optstate;
     PLOptStatus optstatus;
@@ -459,7 +541,7 @@ int main(int argc, char **argv)
        }
     }
 
-    optstate = PL_CreateOptState(argc, argv, "23BTfc:h:p:d:m:n:oqsvw:x");
+    optstate = PL_CreateOptState(argc, argv, "23BTSfc:h:p:d:m:n:oqsvw:x");
     while ((optstatus = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
 	switch (optstate->option) {
 	  case '?':
@@ -473,6 +555,8 @@ int main(int argc, char **argv)
 
           case 'T': disableTLS  = 1; 			break;
 
+          case 'S': skipProtoHeader = PR_TRUE;                 break;
+
           case 'c': cipherString = strdup(optstate->value); break;
 
           case 'h': host = strdup(optstate->value);	break;
@@ -940,7 +1024,12 @@ int main(int argc, char **argv)
 		/* EOF from socket... stop polling socket for read */
 		pollset[SSOCK_FD].in_flags = 0;
 	    } else {
-		PR_Write(std_out, buf, nb);
+		if (skipProtoHeader != PR_TRUE || wrStarted == PR_TRUE) {
+		    PR_Write(std_out, buf, nb);
+		} else {
+		    separateReqHeader(std_out, buf, nb, &wrStarted,
+		                      &headerSeparatorPtrnId);
+		}
 		if (verbose)
 		    fputs("\n\n", stderr);
 	    }
diff --git a/mozilla/security/nss/tests/cert/cert.sh b/mozilla/security/nss/tests/cert/cert.sh
index 613cbb5cef5..be482c64d9a 100755
--- a/mozilla/security/nss/tests/cert/cert.sh
+++ b/mozilla/security/nss/tests/cert/cert.sh
@@ -74,6 +74,9 @@ cert_init()
       cd ../common
       . ./init.sh
   fi
+  if [ -z "${IOPR_CERT_SOURCED}" ]; then
+       . ../iopr/cert_iopr.sh
+  fi
   SCRIPTNAME="cert.sh"
   CRL_GRP_DATE=`date "+%Y%m%d%H%M%SZ"`
   if [ -n "$NSS_ENABLE_ECC" ] ; then
@@ -1307,6 +1310,7 @@ cert_fips
 cert_eccurves
 cert_extensions
 cert_crl_ssl
+cert_iopr_setup
 if [ -n "$DO_DIST_ST" -a "$DO_DIST_ST" = "TRUE" ] ; then
     cert_stresscerts 
     #following lines to be used when databases are to be reused
diff --git a/mozilla/security/nss/tests/common/init.sh b/mozilla/security/nss/tests/common/init.sh
index 7ad4caff0c9..d5d69df9d95 100644
--- a/mozilla/security/nss/tests/common/init.sh
+++ b/mozilla/security/nss/tests/common/init.sh
@@ -387,6 +387,10 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then
     EXT_SERVERDIR=${HOSTDIR}/ext_server
     EXT_CLIENTDIR=${HOSTDIR}/ext_client
 
+    IOPR_CADIR=${HOSTDIR}/CA_iopr
+    IOPR_SERVERDIR=${HOSTDIR}/server_iopr
+    IOPR_CLIENTDIR=${HOSTDIR}/client_iopr
+
     CERT_EXTENSIONS_DIR=${HOSTDIR}/cert_extensions
 
     PWFILE=${TMP}/tests.pw.$$
@@ -420,6 +424,9 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then
     R_CADIR=../CA
     R_SERVERDIR=../server
     R_CLIENTDIR=../client
+    R_IOPR_CADIR=../CA_iopr
+    R_IOPR_SERVERDIR=../server_iopr
+    R_IOPR_CLIENTDIR=../client_iopr
     R_ALICEDIR=../alicedir
     R_BOBDIR=../bobdir
     R_DAVEDIR=../dave
@@ -524,6 +531,20 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then
     
     RELOAD_CRL=1
 
+    #################################################
+    # Interoperability testing constatnts
+    #
+    # if suite is setup for testing, IOPR_HOSTADDR_LIST should have
+    # at least one host name(FQDN)
+    # Example   IOPR_HOSTADDR_LIST="goa1.SFBay.Sun.COM"
+
+    if [ -z "`echo ${IOPR_HOSTADDR_LIST} | grep '[A-Za-z]'`" ]; then
+        IOPR=0
+    else
+        IOPR=1
+    fi
+    #################################################
+
     SCRIPTNAME=$0
     INIT_SOURCED=TRUE   #whatever one does - NEVER export this one please
 fi
diff --git a/mozilla/security/nss/tests/iopr/cert_iopr.sh b/mozilla/security/nss/tests/iopr/cert_iopr.sh
new file mode 100644
index 00000000000..276fa43d4e8
--- /dev/null
+++ b/mozilla/security/nss/tests/iopr/cert_iopr.sh
@@ -0,0 +1,370 @@
+#! /bin/sh
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is the Netscape security libraries.
+#
+# The Initial Developer of the Original Code is
+# Netscape Communications Corporation.
+# Portions created by the Initial Developer are Copyright (C) 1994-2000
+# the Initial Developer. All Rights Reserved.
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either the GNU General Public License Version 2 or later (the "GPL"), or
+# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+########################################################################
+#
+# mozilla/security/nss/tests/iopr/cert_iopr.sh
+#
+# Certificate generating and handeling for NSS interoperability QA. This file
+# is included from cert.sh
+#
+# needs to work on all Unix and Windows platforms
+#
+# special strings
+# ---------------
+#   FIXME ... known problems, search for this string
+#   NOTE .... unexpected behavior
+#
+# FIXME - Netscape - NSS
+########################################################################
+
+IOPR_CERT_SOURCED=1
+
+########################################################################
+# function wraps calls to pk12util, also: writes action and options
+# to stdout. 
+# Params are the same as to pk12util.
+# Returns pk12util status
+#
+pk12u()
+{
+    echo "${CU_ACTION} --------------------------"
+
+    echo "pk12util $@"
+    pk12util $@
+    RET=$?
+
+    return $RET
+}
+
+########################################################################
+# Initializes nss db directory and files if they don't exists
+# Params:
+#      $1 - directory location
+#
+createDBDir() {
+    trgDir=$1
+
+    if [ -z "`ls $trgDir | grep db`" ]; then
+        CU_ACTION="Initializing DB at $dir"
+        certu -N -d "${trgDir}" -f "${R_PWFILE}" 2>&1
+        if [ "$RET" -ne 0 ]; then
+            return $RET
+        fi
+    fi
+}
+########################################################################
+# takes care of downloading config, cert and crl files from remote
+# location. 
+# Params:
+#      $1 - name of the host file will be downloaded from
+#      $2 - path to the file as it appeared in url
+#      $3 - target directory the file will be saved at.
+# Returns tstclnt status.
+#
+download_file() {
+    host=$1
+    filePath=$2
+    trgDir=$3
+
+    file=$trgDir/`basename $filePath`
+
+    createDBDir $trgDir || return $RET
+
+#    echo wget -O $file http://${host}${filePath}
+#    wget -O $file http://${host}${filePath}
+#    ret=$?
+
+    req=$file.$$
+    echo "GET $filePath HTTP/1.0" > $req
+    echo >> $req
+
+    tstclnt -d $trgDir -S -h $host -p $IOPR_DOWNLOAD_PORT \
+        -w ${R_PWFILE} -o < $req > $file
+    ret=$?
+    rm -f $_tmp;
+    return $ret
+}
+
+########################################################################
+# Uses pk12util, certutil of cerlutil to import files to an nss db located
+# at <dir>(the value of $1 parameter). Chooses a utility to use based on
+# a file extension. Initializing a db if it does not exists.
+# Params:
+#      $1 - db location directory
+#      $2 - file name to import
+#      $3 - nick name an object in the file will be associated with
+#      $4 - trust arguments 
+# Returns status of import
+#      
+importFile() {
+    dir=$1\
+    file=$2
+    certName=$3
+    certTrust=$4
+
+    [ ! -d $dir ] && mkdir -p $dir;
+
+    createDBDir $dir || return $RET
+            
+    case `basename $file | sed 's/^.*\.//'` in
+        p12)
+            CU_ACTION="Importing p12 $file to DB at $dir"
+            pk12u -d $dir -i $file -k ${R_PWFILE} -W iopr
+            [ $? -ne 0 ] && return 1
+            CU_ACTION="Modifying trust for cert $certName at $dir"
+            certu -M -n "$certName" -t "$certTrust" -f "${R_PWFILE}" -d "${dir}"
+            return $?
+            ;;
+        
+        crl) 
+            CU_ACTION="Importing crl $file to DB at $dir"
+            crlu -d ${dir} -I -n TestCA -i $file
+            return $?
+            ;;
+
+        crt | cert)
+            CU_ACTION="Importing cert $certName with trust $certTrust to $dir"
+            certu -A -n "$certName" -t "$certTrust" -f "${R_PWFILE}" -d "${dir}" \
+                -i "$file"
+            return $?
+            ;;
+
+        *)
+            echo "Unknown file extension: $file:"
+            return 1
+            ;;
+    esac
+}
+
+
+#########################################################################
+# Downloads and installs test certs and crl from a remote webserver.
+# Generates server cert for reverse testing if reverse test run is turned on.
+# Params:
+#      $1 - host name to download files from.
+#      $2 - directory at which CA cert will be installed and used for
+#           signing a server cert.
+#      $3 - path to a config file in webserver context.
+#      $4 - server db location
+#      $5 - client db location
+# Returns 0 upon success, otherwise, failed command error code.
+#
+download_install_certs() {
+    host=$1
+    caDir=$2
+    confPath=$3
+    serverDir=$4
+    clientDir=$5
+
+    [ ! -d "$caDir" ] && mkdir -p $caDir;
+
+    #=======================================================
+    # Getting config file
+    #
+    download_file $host "$confPath/iopr_server.cfg" $caDir
+    RET=$?
+    if [ $RET -ne 0 -o ! -f $caDir/iopr_server.cfg ]; then
+        html_failed "<TR><TD>Fail to download website config file(ws: $host)" 
+        return 1
+    fi
+
+    . $caDir/iopr_server.cfg
+    RET=$?
+    if [ $RET -ne 0 ]; then
+        html_failed "<TR><TD>Fail to source config file(ws: $host)" 
+        return $RET
+    fi
+
+    #=======================================================
+    # Getting CA file
+    #
+
+    #----------------- !!!WARNING!!! -----------------------
+    # Do NOT copy this scenario. CA should never accompany its
+    # cert with the private key when deliver cert to a customer.
+    #----------------- !!!WARNING!!! -----------------------
+
+    download_file $host $certDir/$caCertName.p12 $caDir
+    RET=$?
+    if [ $RET -ne 0 -o ! -f $caDir/$caCertName.p12 ]; then
+        html_failed "<TR><TD>Fail to download $caCertName cert(ws: $host)" 
+        return 1
+    fi
+    tmpFiles="$caDir/$caCertName.p12"
+
+    importFile $caDir $caDir/$caCertName.p12 $caCertName "TC,C,C"
+    RET=$?
+    if [ $RET -ne 0 ]; then
+        html_failed "<TR><TD>Fail to import $caCertName cert to CA DB(ws: $host)" 
+        return $RET
+    fi
+
+    CU_ACTION="Exporting Root CA cert(ws: $host)"
+    certu -L -n $caCertName -r -d ${caDir} -o $caDir/$caCertName.cert 
+    if [ "$RET" -ne 0 ]; then
+        Exit 7 "Fatal - failed to export $caCertName cert"
+    fi
+
+
+    if [ "$reverseRunCGIScript" ]; then
+        [ ! -d "$serverDir" ] && mkdir -p $serverDir;
+       #=======================================================
+       # Import CA cert to server DB
+       #
+        importFile $serverDir $caDir/$caCertName.cert server-client-CA "TC,C,C"
+        RET=$?
+        if [ $RET -ne 0 ]; then
+            html_failed "<TR><TD>Fail to import server-client-CA cert to server DB(ws: $host)" 
+            return $RET
+        fi
+
+        #=======================================================
+        # Creating server cert
+        #
+        CERTNAME=$HOSTADDR
+        
+        CU_ACTION="Generate Cert Request for $CERTNAME (ws: $host)"
+        CU_SUBJECT="CN=$CERTNAME, E=${CERTNAME}@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
+        certu -R -d "${serverDir}" -f "${R_PWFILE}" -z "${R_NOISE_FILE}" -o $serverDir/req 2>&1
+        tmpFiles="$tmpFiles $serverDir/req"
+        
+        
+        CU_ACTION="Sign ${CERTNAME}'s Request (ws: $host)"
+        certu -C -c "$caCertName" -m `date +"%s"` -v 60 -d "${caDir}" \
+            -i  ${serverDir}/req -o $caDir/${CERTNAME}.cert -f "${R_PWFILE}" 2>&1
+        
+        importFile $serverDir $caDir/$CERTNAME.cert $CERTNAME ",,"
+        RET=$?
+        if [ $RET -ne 0 ]; then
+            html_failed "<TR><TD>Fail to import $CERTNAME cert to server DB(ws: $host)" 
+            return $RET
+        fi
+        tmpFiles="$tmpFiles $caDir/$CERTNAME.cert"
+
+        #=======================================================
+        # Download and import CA crl to server DB
+        #
+        download_file $host "$certDir/$caCrlName.crl" $serverDir
+        RET=$?
+        if [ $? -ne 0 ]; then
+            html_failed "<TR><TD>Fail to download $caCertName crl(ws: $host)" 
+            return $RET
+        fi
+        tmpFiles="$tmpFiles $serverDir/$caCrlName.crl"
+        
+        importFile $serverDir $serverDir/TestCA.crl
+        RET=$?
+        if [ $RET -ne 0 ]; then
+            html_failed "<TR><TD>Fail to import TestCA crt to server DB(ws: $host)" 
+            return $RET
+        fi
+    fi # if [ "$reverseRunCGIScript" ]
+
+    [ ! -d "$clientDir" ] && mkdir -p $clientDir;
+    #=======================================================
+    # Import CA cert to client DB
+    #
+    importFile $clientDir $caDir/$caCertName.cert server-client-CA "TC,C,C"
+    RET=$?
+    if [ $RET -ne 0 ]; then
+        html_failed "<TR><TD>Fail to import server-client-CA cert to server DB(ws: $host)" 
+        return $RET
+    fi
+
+    #=======================================================
+    # Import client certs to client DB
+    #
+    for certName in $userCertNames; do
+        download_file $host "$certDir/$certName.p12" $clientDir
+        RET=$?
+        if [ $RET -ne 0 -o ! -f $clientDir/$certName.p12 ]; then
+            html_failed "<TR><TD>Fail to download $certName cert(ws: $host)" 
+            return $RET
+        fi
+        tmpFiles="$tmpFiles $clientDir/$certName.p12"
+        
+        importFile $clientDir $clientDir/$certName.p12 $certName ",,"
+        RET=$?
+        if [ $RET -ne 0 ]; then
+            html_failed "<TR><TD>Fail to import $certName cert to client DB(ws: $host)" 
+            return $RET
+        fi
+    done
+
+    rm -f $tmpFiles
+
+    return 0
+}
+
+
+#########################################################################
+# Initial point for downloading config, cert, crl files for multiple hosts
+# involved in interoperability testing. Called from nss/tests/cert/cert.sh
+# It will only proceed with downloading if environment variable 
+# IOPR_HOSTADDR_LIST is set and has a value of host names separated by space.
+#
+# Returns 1 if interoperability testing is off, 0 otherwise. 
+#
+cert_iopr_setup() {
+
+    if [ "$IOPR" -ne 1 ]; then
+        return 1
+    fi
+    num=1
+    IOPR_HOST_PARAM=`echo "${IOPR_HOSTADDR_LIST} " | cut -f 1 -d' '`
+    while [ "$IOPR_HOST_PARAM" ]; do
+        IOPR_HOSTADDR=`echo $IOPR_HOST_PARAM | cut -f 1 -d':'`
+        IOPR_DOWNLOAD_PORT=`echo "$IOPR_HOST_PARAM:" | cut -f 2 -d':'`
+        [ -z "$IOPR_DOWNLOAD_PORT" ] && IOPR_DOWNLOAD_PORT=443
+        IOPR_CONF_PATH=`echo "$IOPR_HOST_PARAM:" | cut -f 3 -d':'`
+        [ -z "$IOPR_CONF_PATH" ] && IOPR_CONF_PATH="/iopr"
+        
+        echo "Installing certs for $IOPR_HOSTADDR:$IOPR_DOWNLOAD_PORT:$IOPR_CONF_PATH"
+        
+        download_install_certs ${IOPR_HOSTADDR} ${IOPR_CADIR}_${IOPR_HOSTADDR} \
+            ${IOPR_CONF_PATH} ${IOPR_SERVERDIR}_${IOPR_HOSTADDR} \
+            ${IOPR_CLIENTDIR}_${IOPR_HOSTADDR}
+        if [ $? -ne 0 ]; then
+            echo "wsFlags=\"NOIOPR $wsParam\"" >> \
+                ${IOPR_CADIR}_${IOPR_HOSTADDR}/iopr_server.cfg
+        fi
+        num=`expr $num + 1`
+        IOPR_HOST_PARAM=`echo "${IOPR_HOSTADDR_LIST} " | cut -f $num -d' '`
+    done
+    
+    return 0
+}
diff --git a/mozilla/security/nss/tests/iopr/server_scr/apache_unix.cfg b/mozilla/security/nss/tests/iopr/server_scr/apache_unix.cfg
new file mode 100644
index 00000000000..b0f6c1b003f
--- /dev/null
+++ b/mozilla/security/nss/tests/iopr/server_scr/apache_unix.cfg
@@ -0,0 +1,43 @@
+#
+# Apache OPENSSL configuration file
+#
+
+#
+# Define what type of system this is.
+#
+$clientSys = "openssl";
+
+#
+# Cipher conversion table file
+#
+$cipherTableFile = "$certDir/cipher.list";
+
+#--------------------------------------------
+# Web server specific variables start here:
+#
+
+#
+# Location of installed openssl binary
+#
+$opensslb = "/usr/local/bin/openssl";
+
+
+#
+# General location of apache server
+#
+$apacheHttpd="/var/httpd-ssl";
+
+#
+# HTTP Request file
+#
+$reqFile = "$apacheHttpd/cgi-bin/sslreq.dat";
+
+#
+# OpenSSL certificate directory
+#
+$certDir = "$apacheHttpd/cert";
+
+#
+# CA certificate file
+#
+$caCertFile = "$certDir/serverCA.crt";
diff --git a/mozilla/security/nss/tests/iopr/server_scr/cert_gen.sh b/mozilla/security/nss/tests/iopr/server_scr/cert_gen.sh
new file mode 100644
index 00000000000..fa5f23e664f
--- /dev/null
+++ b/mozilla/security/nss/tests/iopr/server_scr/cert_gen.sh
@@ -0,0 +1,194 @@
+#!/bin/sh    
+
+######################################################################################
+# Server and client certs and crl generator functions. Generated files placed in a <dir>
+# directory to be accessible through http://<webserver>/iopr/TestCA.crt directory.
+# This functions is used for manual webserver configuration and it is not a part of
+# nss test run.
+# To create certs use the following command:
+#       sh cert_iopr.sh cert_gen <dir> <cert name> [cert req]
+# Where:
+#       dir - directory where to place created files
+#       cert name - name of created server cert(FQDN)
+#       cert req  - cert request to be used for cert generation.
+#
+repAndExec() {
+    echo
+    if [ "$1" = "certutil" -a "$2" = "-R" -o "$2" = "-S" ]; then
+        shift
+        echo certutil -s "$CU_SUBJECT" $@
+        certutil -s "$CU_SUBJECT" $@
+        RET=$?
+    else
+        echo $@
+        $@
+        RET=$?
+    fi
+
+    return $RET
+}
+
+signCert() {
+    dir=$1
+    crtDir=$2
+    crtName=$3
+    crtSN=$4
+    req=$5
+    cuAddParam=$6
+
+    repAndExec \
+        certutil $cuAddParam -C -c "TestCA" -m $crtSN -v 599 -d "${dir}" \
+             -i $req -o "$crtDir/${crtName}.crt" -f "${PW_FILE}" 2>&1
+    return $RET
+}
+
+createSignedCert() {
+    dir=$1
+    certName=$2
+    certSN=$3
+    certSubj=$4
+    keyType=$5
+    exportFile=$6
+
+    echo Creating cert $certName with SN=$certSN
+
+    CU_SUBJECT="$certSubj"
+    repAndExec \
+        certutil -R -d $dir -f "${PW_FILE}" -z "${NOISE_FILE}" \
+                  -k $keyType -o $dir/req  2>&1
+    [ "$RET" -ne 0 ] && return $RET
+
+    signCert $dir $dir $certName $certSN $dir/req
+    ret=$?
+    [ "$ret" -ne 0 ] && return $ret
+
+    rm -f $dir/req
+
+    repAndExec \
+        certutil -A -n ${certName}-${keyType} -t "u,u,u" -d "${dir}" -f "${PW_FILE}" \
+                    -i "$dir/${certName}.crt" 2>&1
+    [ "$RET" -ne 0 ] && return $RET
+
+    repAndExec \
+        pk12util -d $dir -o $exportFile -n ${certName}-${keyType} -k ${PW_FILE} -W iopr
+    [ "$RET" -ne 0 ] && return $RET
+    return 0
+}
+
+generateServerCerts() {
+    certDir=$1
+    serverName=$2
+    servCertReq=$3
+    
+    [ -z "$certDir" ] && echo "Cert directory should not be empty" && exit 1
+    [ -z "$serverName" ] && echo "Server name should not be empty" && exit 1
+
+    mkdir -p $certDir
+    [ $? -ne 0 ] && echo "Can not create dir: $certDir" && exit 1
+    
+
+    dir=/tmp/db.$$
+    if [ -d "$dir" ]; then
+        rm -f $dir
+    fi
+    mkdir -p $dir
+    [ $? -ne 0 ] && echo "Can not create dir: $dir" && exit 1
+
+    PW_FILE=$dir/nss.pwd
+    NOISE_FILE=$dir/nss.noise
+    echo nss > $PW_FILE
+
+    date >> ${NOISE_FILE} 2>&1
+
+    repAndExec \
+        certutil -d $dir -N -f $PW_FILE
+    [ "$RET" -ne 0 ] && return $RET
+    
+
+    certName=TestCA
+    CU_SUBJECT="CN=NSS IOPR Test CA $$, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
+    repAndExec \
+        certutil -S -n $certName -t "CTu,CTu,CTu" -v 600 -x -d ${dir} -1 -2 \
+                -f ${PW_FILE} -z ${NOISE_FILE} -m 10000 2>&1 <<EOF
+5
+6
+9
+n
+y
+-1
+n
+EOF
+
+    repAndExec \
+        certutil -L -n $certName -r -d ${dir} -o $certDir/$certName.crt 
+    [ "$RET" -ne 0 ] && return $RET
+
+    repAndExec \
+        pk12util -d $dir -o $certDir/$certName.p12 -n $certName -k ${PW_FILE} -W iopr
+    [ "$RET" -ne 0 ] && return $RET
+
+    if [ "$servCertReq" -a -f $servCertReq ]; then
+        grep REQUEST $servCertReq >/dev/null 2>&1
+        signCert $dir $certDir ${serverName}_ext 501 $servCertReq `test $? -eq 0 && echo -a`
+        ret=$?
+        [ "$ret" -ne 0 ] && return $ret
+    fi
+
+    certName=$serverName
+    certSubj="CN=$certName, E=${certName}-rsa@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
+    createSignedCert $dir $certName 500 "$certSubj" rsa $certDir/${certName}-rsa.p12
+    ret=$?
+    [ "$ret" -ne 0 ] && return $ret
+    certName=$serverName
+
+    certName=$serverName
+    certSubj="CN=$certName, E=${certName}-dsa@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
+    createSignedCert $dir $certName 501 "$certSubj" dsa $certDir/${certName}-dsa.p12
+    ret=$?
+    [ "$ret" -ne 0 ] && return $ret
+   
+    certName=TestUser510
+    certSubj="CN=$certName, E=${certName}@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
+    createSignedCert $dir $certName 510 "$certSubj" rsa $certDir/${certName}-rsa.p12
+    ret=$?
+    [ "$ret" -ne 0 ] && return $ret
+
+    certName=TestUser511
+    certSubj="CN=$certName, E=${certName}@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
+    createSignedCert $dir $certName 511 "$certSubj" dsa $certDir/${certName}-dsa.p12
+    ret=$?
+    [ "$ret" -ne 0 ] && return $ret
+
+    certName=TestUser512
+    certSubj="CN=$certName, E=${certName}@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
+    createSignedCert $dir $certName 512 "$certSubj" rsa $certDir/${certName}-rsa.p12
+    ret=$?
+    [ "$ret" -ne 0 ] && return $ret
+
+    certName=TestUser513
+    certSubj="CN=$certName, E=${certName}@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
+    createSignedCert $dir $certName 513 "$certSubj" dsa $certDir/${certName}-dsa.p12
+    ret=$?
+    [ "$ret" -ne 0 ] && return $ret
+
+    crlUpdate=`date +%Y%m%d%H%M%SZ`
+    crlNextUpdate=`echo $crlUpdate | sed 's/20/21/'`
+    repAndExec \
+        crlutil -d $dir -G -n "TestCA" -f ${PW_FILE} -o $certDir/TestCA.crl <<EOF_CRLINI
+update=$crlUpdate
+nextupdate=$crlNextUpdate
+addcert 509-511 $crlUpdate
+EOF_CRLINI
+    [ "$RET" -ne 0 ] && return $RET
+
+    rm -rf $dir
+    return 0
+}
+
+
+if [ -z "$1" -o -z "$2" ]; then
+    echo "$0 <dest dir> <cert name> [cert req]"
+    exit 1
+fi
+generateServerCerts $1 $2 $3
+exit $?
diff --git a/mozilla/security/nss/tests/iopr/server_scr/cipher.list b/mozilla/security/nss/tests/iopr/server_scr/cipher.list
new file mode 100644
index 00000000000..09ad0362b2b
--- /dev/null
+++ b/mozilla/security/nss/tests/iopr/server_scr/cipher.list
@@ -0,0 +1,131 @@
+nss                                      openssl                    iis 
+
+#
+# SSL v3.0 cipher suites.
+#
+SSL3_RSA_WITH_NULL_MD5                   NULL-MD5                   i
+SSL3_RSA_WITH_NULL_SHA                   NULL-SHA                   z
+SSL3_RSA_EXPORT_WITH_RC4_40_MD5          EXP-RC4-MD5                f
+SSL3_RSA_WITH_RC4_128_MD5                RC4-MD5                    c
+SSL3_RSA_WITH_RC4_128_SHA                RC4-SHA                    n
+SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5      EXP-RC2-CBC-MD5            g
+SSL3_RSA_WITH_IDEA_CBC_SHA               IDEA-CBC-SHA
+SSL3_RSA_EXPORT_WITH_DES40_CBC_SHA       EXP-DES-CBC-SHA            
+SSL3_RSA_WITH_DES_CBC_SHA                DES-CBC-SHA                e
+SSL3_RSA_WITH_3DES_EDE_CBC_SHA           DES-CBC3-SHA               d
+
+SSL3_DH_DSS_EXPORT_WITH_DES40_CBC_SHA    Not_implemented.
+SSL3_DH_DSS_WITH_DES_CBC_SHA             Not_implemented.
+SSL3_DH_DSS_WITH_3DES_EDE_CBC_SHA        Not_implemented.
+SSL3_DH_RSA_EXPORT_WITH_DES40_CBC_SHA    Not_implemented.
+SSL3_DH_RSA_WITH_DES_CBC_SHA             Not_implemented.
+SSL3_DH_RSA_WITH_3DES_EDE_CBC_SHA        Not_implemented.
+SSL3_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA   EXP-EDH-DSS-DES-CBC-SHA
+SSL3_DHE_DSS_WITH_DES_CBC_SHA            EDH-DSS-CBC-SHA            s
+SSL3_DHE_DSS_WITH_3DES_EDE_CBC_SHA       EDH-DSS-DES-CBC3-SHA       q
+SSL3_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA   EXP-EDH-RSA-DES-CBC-SHA
+SSL3_DHE_RSA_WITH_DES_CBC_SHA            EDH-RSA-DES-CBC-SHA
+SSL3_DHE_RSA_WITH_3DES_EDE_CBC_SHA       EDH-RSA-DES-CBC3-SHA
+
+SSL3_DH_anon_EXPORT_WITH_RC4_40_MD5      EXP-ADH-RC4-MD5
+SSL3_DH_anon_WITH_RC4_128_MD5            ADH-RC4-MD5
+SSL3_DH_anon_EXPORT_WITH_DES40_CBC_SHA   EXP-ADH-DES-CBC-SHA
+SSL3_DH_anon_WITH_DES_CBC_SHA            ADH-DES-CBC-SHA
+SSL3_DH_anon_WITH_3DES_EDE_CBC_SHA       ADH-DES-CBC3-SHA
+
+SSL3_FORTEZZA_KEA_WITH_NULL_SHA          Not_implemented.
+SSL3_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA  Not_implemented.
+SSL3_FORTEZZA_KEA_WITH_RC4_128_SHA       Not_implemented.
+
+#
+# Next four added to have ciphers below for SSL3 protocol
+#
+SSL3_RSA_WITH_AES_128_CBC_SHA            AES128-SHA
+SSL3_RSA_WITH_AES_256_CBC_SHA            AES256-SHA
+
+SSL3_RSA_EXPORT_WITH_DES_CBC_SHA         EXP1024-DES-CBC-SHA        l
+SSL3_RSA_EXPORT_WITH_RC4_56_SHA          EXP1024-RC4-SHA            m
+
+#
+#TLS v1.0 cipher suites.
+#
+TLS_RSA_WITH_NULL_MD5                   NULL-MD5
+TLS_RSA_WITH_NULL_SHA                   NULL-SHA
+TLS_RSA_EXPORT_WITH_RC4_40_MD5          EXP-RC4-MD5
+TLS_RSA_WITH_RC4_128_MD5                RC4-MD5
+TLS_RSA_WITH_RC4_128_SHA                RC4-SHA
+TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5      EXP-RC2-CBC-MD5
+TLS_RSA_WITH_IDEA_CBC_SHA               IDEA-CBC-SHA
+TLS_RSA_EXPORT_WITH_DES40_CBC_SHA       EXP-DES-CBC-SHA
+TLS_RSA_WITH_DES_CBC_SHA                DES-CBC-SHA
+TLS_RSA_WITH_3DES_EDE_CBC_SHA           DES-CBC3-SHA
+
+TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA    Not_implemented.
+TLS_DH_DSS_WITH_DES_CBC_SHA             Not_implemented.
+TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA        Not_implemented.
+TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA    Not_implemented.
+TLS_DH_RSA_WITH_DES_CBC_SHA             Not_implemented.
+TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA        Not_implemented.
+TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA   EXP-EDH-DSS-DES-CBC-SHA
+TLS_DHE_DSS_WITH_DES_CBC_SHA            EDH-DSS-CBC-SHA
+TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA       EDH-DSS-DES-CBC3-SHA
+TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA   EXP-EDH-RSA-DES-CBC-SHA
+TLS_DHE_RSA_WITH_DES_CBC_SHA            EDH-RSA-DES-CBC-SHA
+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA       EDH-RSA-DES-CBC3-SHA
+
+TLS_DH_anon_EXPORT_WITH_RC4_40_MD5      EXP-ADH-RC4-MD5
+TLS_DH_anon_WITH_RC4_128_MD5            ADH-RC4-MD5
+TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA   EXP-ADH-DES-CBC-SHA
+TLS_DH_anon_WITH_DES_CBC_SHA            ADH-DES-CBC-SHA
+TLS_DH_anon_WITH_3DES_EDE_CBC_SHA       ADH-DES-CBC3-SHA
+
+#
+#AES ciphersuites from RFC3268, extending TLS v1.0
+#
+
+TLS_RSA_WITH_AES_128_CBC_SHA            AES128-SHA
+TLS_RSA_WITH_AES_256_CBC_SHA            AES256-SHA
+
+TLS_DH_DSS_WITH_AES_128_CBC_SHA         DH-DSS-AES128-SHA
+TLS_DH_DSS_WITH_AES_256_CBC_SHA         DH-DSS-AES256-SHA
+TLS_DH_RSA_WITH_AES_128_CBC_SHA         DH-RSA-AES128-SHA
+TLS_DH_RSA_WITH_AES_256_CBC_SHA         DH-RSA-AES256-SHA
+
+TLS_DHE_DSS_WITH_AES_128_CBC_SHA        DHE-DSS-AES128-SHA
+TLS_DHE_DSS_WITH_AES_256_CBC_SHA        DHE-DSS-AES256-SHA
+TLS_DHE_RSA_WITH_AES_128_CBC_SHA        DHE-RSA-AES128-SHA
+TLS_DHE_RSA_WITH_AES_256_CBC_SHA        DHE-RSA-AES256-SHA
+
+TLS_DH_anon_WITH_AES_128_CBC_SHA        ADH-AES128-SHA
+TLS_DH_anon_WITH_AES_256_CBC_SHA        ADH-AES256-SHA
+
+#
+#Additional Export 1024 and other cipher suites
+#
+#Note: these ciphers can also be used in SSL v3.
+#
+TLS_RSA_EXPORT_WITH_DES_CBC_SHA         EXP1024-DES-CBC-SHA
+TLS_RSA_EXPORT_WITH_RC4_56_SHA          EXP1024-RC4-SHA
+TLS_DHE_DSS_EXPORT_WITH_DES_CBC_SHA     EXP1024-DHE-DSS-DES-CBC-SHA
+TLS_DHE_DSS_EXPORT_WITH_RC4_56_SHA      EXP1024-DHE-DSS-RC4-SHA
+TLS_DHE_DSS_WITH_RC4_128_SHA            DHE-DSS-RC4-SHA
+
+#
+#SSL v2.0 cipher suites.
+#
+SSL2_RC4_128_WITH_MD5                 RC4-MD5
+SSL2_RC4_128_EXPORT40_WITH_MD5        EXP-RC4-MD5
+SSL2_RC2_128_CBC_WITH_MD5             RC2-MD5
+SSL2_RC2_128_CBC_EXPORT40_WITH_MD5    EXP-RC2-MD5
+SSL2_IDEA_128_CBC_WITH_MD5            IDEA-CBC-MD5
+SSL2_DES_64_CBC_WITH_MD5              DES-CBC-MD5
+SSL2_DES_192_EDE3_CBC_WITH_MD5        DES-CBC3-MD5
+
+
+#
+# FIPS cipher list
+#        
+TLS_RSA_FIPS_WITH_3DES_EDE_CBC_SHA      Not_implemented
+TLS_RSA_FIPS_WITH_DES_CBC_SHA           Not_implemented
+SSL3_RSA_FIPS_WITH_3DES_EDE_CBC_SHA     Not_implemented
+SSL3_RSA_FIPS_WITH_DES_CBC_SHA          Not_implemented
diff --git a/mozilla/security/nss/tests/iopr/server_scr/client.cgi b/mozilla/security/nss/tests/iopr/server_scr/client.cgi
new file mode 100644
index 00000000000..5d711d52f13
--- /dev/null
+++ b/mozilla/security/nss/tests/iopr/server_scr/client.cgi
@@ -0,0 +1,522 @@
+#!/usr/bin/perl
+
+#--------------------------------------------------------------
+# cgi script that parses request argument to appropriate 
+# open ssl or tstclntw options and starts ssl client.
+#
+
+use CGI qw/:standard/;
+
+use subs qw(debug);
+
+#--------------------------------------------------------------
+# Prints out an error string and exits the script with an
+# exitStatus.
+# Param:
+#    str : an error string
+#    exitStat: an exit status of the program
+#
+sub svr_error {
+    my ($str, $exitStat) = @_;
+
+    if (!defined $str || $str eq "") {
+        $str = $ERR;
+    }
+    print "SERVER ERROR: $str\n";
+    if ($exitStat) {
+        print end_html if ($osDataArr{wservRun});
+        exit $exitStat;
+    }
+}
+
+#--------------------------------------------------------------
+# Prints out a debug message
+# Params:
+#     str: debug message
+#     inVal: additional value to print(optional)
+#
+sub debug {
+    my ($str, $inVal) = @_;
+    
+    print "-- DEBUG: $str ($inVal)\n" if ($DEBUG == 1);
+}
+
+
+#--------------------------------------------------------------
+# Initializes execution context depending on a webserver the
+# script is running under.
+#
+sub init {
+    %osDataArr = (
+                  loadSupportedCipthersFn => \&osSpecific,
+                  cipherIsSupportedFn => \&verifyCipherSupport,
+                  cipherListFn => \&convertCipher,
+                  buildCipherTableFn => \&buildCipherTable,
+                  execCmdFn => \&osSpecific,
+                  );
+
+    $scriptName = $ENV{'SCRIPT_NAME'};
+    if (!defined $scriptName) {
+        $DEBUG=1;
+        debug "Debug is ON";
+    }
+    $DEBUG=1;
+    
+    $svrSoft = $ENV{'SERVER_SOFTWARE'};
+    if (defined $svrSoft) {
+        $_ = $svrSoft;
+        /.*Microsoft.*/ && ($osDataArr{wserv} = "IIS");
+        /.*Apache.*/ && ($osDataArr{wserv} = "Apache");
+        $osDataArr{wservRun} = 1;
+    } else {
+        $osDataArr{wserv} = "Apache";
+        $osDataArr{wservRun} = 0;
+    }
+}
+
+#--------------------------------------------------------------
+# Function-spigot to handle errors is OS specific functions are
+# not implemented for a particular OS.
+# Returns:
+#   always returns 0(failure)
+#
+sub osSpecific {
+    $ERR = "This function should be swapped to os specific function.";
+    return 0;
+}
+
+#--------------------------------------------------------------
+# Sets os specific execution context values.
+# Returns:
+#    1 upon success, or 0 upon failure(if OS was not recognized)
+#
+sub setFunctRefs {
+    
+    debug("Entering setFunctRefs function", $osDataArr{wserv});
+
+    if ($osDataArr{wserv} eq "Apache") {
+        $osDataArr{osConfigFile} = "apache_unix.cfg";
+        $osDataArr{suppCiphersCmd} = '$opensslb ciphers ALL:NULL';
+        $osDataArr{clientRunCmd} = '$opensslb s_client -host $in_host -port $in_port -cert $certDir/$in_cert.crt -key $certDir/$in_cert.key -CAfile $caCertFile $proto $ciphers -ign_eof < $reqFile';
+        $osDataArr{loadSupportedCipthersFn} = \&getSupportedCipherList_Unix;
+        $osDataArr{execCmdFn} = \&execClientCmd_Unix;
+    } elsif ($osDataArr{wserv} eq "IIS") {
+        $osDataArr{osConfigFile} = "iis_windows.cfg";
+        $osDataArr{suppCiphersCmd} = '$tstclntwb';
+        $osDataArr{clientRunCmd} = '$tstclntwb -h $in_host -p $in_port -n $in_cert $proto $ciphers < $reqFile';
+        $osDataArr{loadSupportedCipthersFn} = \&getSupportedCipherList_Win;
+        $osDataArr{execCmdFn} = \&execClientCmd_Win;
+    } else {
+        $ERR = "Unknown Web Server  type.";
+        return 0;
+    }
+    return 1;
+}
+
+#--------------------------------------------------------------
+# Parses data from HTTP request. Will print a form if request
+# does not contain sufficient number of parameters.
+# Returns: 
+#     1 if request has sufficient number of parameters
+#     0 if not.
+sub getReqData {
+    my $debug = param('debug');
+    $in_host = param('host');
+    $in_port = param('port');
+    $in_cert = param('cert');
+    $in_cipher = param('cipher');
+
+    if (!$osDataArr{wservRun}) {
+        $in_host="goa1";
+        $in_port="443";
+        $in_cert="TestUser511";
+        $in_cipher = "SSL3_RSA_WITH_NULL_SHA";
+    }
+
+    debug("Entering getReqData function", "$in_port:$in_host:$in_cert:$in_cipher");
+
+    if (defined $debug && $debug == "debug on") {
+        $DEBUG = 1;
+    }
+
+    if (!defined $in_host || $in_host eq "" ||
+        !defined $in_port || $in_port eq "" ||
+        !defined $in_cert || $in_cert eq "") {
+        if ($osDataArr{wservRun}) {
+            print h1('Command description form:'),
+            start_form(-method=>"get"),
+            "Host: ",textfield('host'),p,
+            "Port: ",textfield('port'),p,
+            "Cert: ",textfield('cert'),p,
+            "Cipher: ",textfield('cipher'),p,
+            checkbox_group(-name=>'debug',
+                           -values=>['debug on  ']),
+            submit,
+            end_form,
+            hr;
+        } else {
+            print "Printing html form to get client arguments\n";
+        }
+        $ERR = "the following parameters are required: host, port, cert";
+        return 0;
+    } else {
+        print "<pre>" if ($osDataArr{wservRun});
+        return 1;
+    }
+}
+
+
+#--------------------------------------------------------------
+# Building cipher conversion table from file based on the OS.
+# Params:
+#     tfile: cipher conversion file.
+#     sysName: system name
+#     tblPrt: returned pointer to a table.
+sub buildCipherTable {
+    my ($tfile, $sysName, $tblPrt) = @_;
+    my @retArr = @$tblPrt;
+    my %table, %rtable;
+    my $strCount = 0;
+
+    debug("Entering getReqData function", "$tfile:$sysName:$tblPrt");
+
+    ($ERR = "No system name supplied" && return 0) if ($sysName =~ /^$/);
+    if (!open(TFILE, "$tfile")) {
+        $ERR = "Missing cipher conversion table file.";
+        return 0;
+    }
+    foreach (<TFILE>) {
+        chop;
+        /^#.*/ && next;
+        /^\s*$/ && next;
+        if ($strCount++ == 0) {
+            my @sysArr =  split /\s+/;
+            $colCount = 0;
+            for (;$colCount <= $#sysArr;$colCount++) {
+                last if ($sysArr[$colCount] =~ /(.*:|^)$sysName.*/);
+            }
+            next;
+        }
+        my @ciphArr =  split /\s+/, $_;
+        $table{$ciphArr[0]} = $ciphArr[$colCount];
+        $rtable{$ciphArr[$colCount]} = $ciphArr[0];
+    }
+    close(TFILE);
+    $cipherTablePtr[0] = \%table;
+    $cipherTablePtr[1] = \%rtable;
+    return 1
+}
+
+#--------------------------------------------------------------
+# Client configuration function. Loads client configuration file.
+# Initiates cipher table. Loads cipher list supported by ssl client.
+#
+sub configClient {
+
+    debug "Entering configClient function";
+
+    my $res = &setFunctRefs();
+    return $res if (!$res);
+
+    open(CFILE, $osDataArr{'osConfigFile'}) ||
+        ($ERR = "Missing configuration file." && return 0);
+    foreach (<CFILE>) {
+        /^#.*/ && next;
+        chop;
+        eval $_;
+    }
+    close(CFILE);
+   
+    local @cipherTablePtr = ();
+    $osDataArr{'buildCipherTableFn'}->($cipherTableFile, $clientSys) || return 0;
+    $osDataArr{cipherTable} = $cipherTablePtr[0];
+    $osDataArr{rcipherTable} = $cipherTablePtr[1];
+    
+    local $suppCiphersTablePrt;
+    &{$osDataArr{'loadSupportedCipthersFn'}} || return 0;
+    $osDataArr{suppCiphersTable} = $suppCiphersTablePrt;
+}
+
+#--------------------------------------------------------------
+# Verifies that a particular cipher is supported.
+# Params:
+#    checkCipher: cipher name
+# Returns:
+#    1 - cipher is supported(also echos the cipher).
+#    0 - not supported.
+#
+sub verifyCipherSupport {
+    my ($checkCipher) = @_;
+    my @suppCiphersTable = @{$osDataArr{suppCiphersTable}};
+
+    debug("Entering verifyCipherSupport", $checkCipher);
+    foreach (@suppCiphersTable) {
+        return 1 if ($checkCipher eq $_);
+    }
+    $ERR = "cipher is not supported.";
+    return 0;
+}
+
+#--------------------------------------------------------------
+# Converts long(?name of the type?) cipher name to 
+# openssl/tstclntw cipher name.
+# Returns:
+#   0 if cipher was not listed. 1 upon success.
+#
+sub convertCipher {
+    my ($cipher) = @_;
+    my @retList;
+    my $resStr;
+    my %cipherTable = %{$osDataArr{cipherTable}};
+
+    debug("Entering convertCipher", $cipher);
+    if (defined $cipher) {
+        my $cphr = $cipherTable{$cipher};
+        if (!defined $cphr) {
+            $ERR = "cipher is not listed.";
+            return 0;
+        }        
+        &{$osDataArr{'cipherIsSupportedFn'}}($cphr) || return 0;
+        $ciphers = "$cphr";
+        return 1;
+    }
+    return 0;
+}
+
+#################################################################
+#  UNIX Apache Specific functions
+#----------------------------------------------------------------
+
+#--------------------------------------------------------------
+# Executes ssl client command to get a list of ciphers supported
+# by client.
+#
+sub getSupportedCipherList_Unix {
+    my @arr, @suppCiphersTable;
+
+    debug "Entering getSupportedCipherList_Unix function";
+
+    eval '$sLisrCmd = "'.$osDataArr{'suppCiphersCmd'}.'"';
+    if (!open (OUT, "$sLisrCmd|")) {
+        $ERR="Can not run command to verify supported cipher list.";
+        return 0;
+    }
+    @arr = <OUT>;
+    chop $arr[0];
+    @suppCiphersTable = split /:/, $arr[0];
+    debug("Supported ciphers", $arr[0]);
+    $suppCiphersTablePrt = \@suppCiphersTable;
+    close(OUT);
+    return 1;
+}
+
+#--------------------------------------------------------------
+# Lunches ssl client command in response to a request.
+#
+#
+sub execClientCmd_Unix {
+    my $proto;
+    local $ciphers;
+
+    debug "Entering execClientCmd_Unix";
+    if (defined $in_cipher && $in_cipher ne "") {
+        my @arr = split /_/, $in_cipher, 2;
+        $proto = "-".$arr[0];
+        $proto =~ tr /SLT/slt/;
+        $proto = "-tls1" if ($proto eq "-tls");
+        return 0 if (!&{$osDataArr{'cipherListFn'}}($in_cipher));
+        $ciphers = "-cipher $ciphers";
+        debug("Return from cipher conversion", "$ciphers");
+    }
+
+    eval '$command = "'.$osDataArr{'clientRunCmd'}.'"';
+    debug("Executing command", $command);
+    if (!open CMD_OUT, "$command 2>&1 |") {
+       $ERR = "can not launch client";
+       return 0;
+    }
+
+    my @cmdOutArr = <CMD_OUT>;
+    
+    foreach (@cmdOutArr) {
+        print $_;
+    }
+
+    my $haveVerify = 0;
+    my $haveErrors = 0;
+    foreach (@cmdOutArr) {
+        chop;
+        if (/unknown option/) {
+            $haveErrors++;
+            svr_error "unknown option\n";
+            next;
+        }
+        if (/:no ciphers available/) {
+            $haveErrors++;
+            svr_error "no cipthers available\n";
+            next;
+        }
+        if (/verify error:/) {
+            $haveErrors++;
+            svr_error "unable to do verification\n";
+            next;
+        }
+        if (/alert certificate revoked:/) {
+            $haveErrors++;
+            svr_error "attempt to connect with revoked sertificate\n";
+            next;
+        }
+        if (/(error|ERROR)/) {
+            $haveErrors++;
+            svr_error "found errors in server log\n";
+            next;
+        }
+        /verify return:1/ && ($haveVerify = 1);
+    }
+     if ($haveVerify == 0) {
+         svr_error "no 'verify return:1' found in server log\n";
+         $haveErrors++;
+     }
+
+    if ($haveErrors > 0) {
+        $ERR = "Have $haveErrors server errors";
+        debug "Exiting execClientCmd_Unix";
+        return 0;
+    }
+    debug "Exiting execClientCmd_Unix";
+    return 1;
+}
+
+#################################################################
+#  Windows IIS Specific functions
+#----------------------------------------------------------------
+
+#--------------------------------------------------------------
+# Executes ssl client command to get a list of ciphers supported
+# by client.
+#
+sub getSupportedCipherList_Win {
+    my @arr, @suppCiphersTable;
+
+    debug "Entering getSupportedCipherList_Win function";
+
+    eval '$sLisrCmd = "'.$osDataArr{'suppCiphersCmd'}.'"';
+    if (!open (OUT, "$sLisrCmd|")) {
+        $ERR="Can not run command to verify supported cipher list.";
+        return 0;
+    }
+    my $startCipherList = 0;
+    foreach (<OUT>) {
+        chop;
+        if ($startCipherList) {
+            /^([a-zA-Z])\s+/ && push @suppCiphersTable, $1;
+            next;
+        }
+        /.*from list below.*/ && ($startCipherList = 1);
+    }
+    debug("Supported ciphers", join ':', @suppCiphersTable);
+    $suppCiphersTablePrt = \@suppCiphersTable;
+    close(OUT);
+    return 1;
+}
+
+#--------------------------------------------------------------
+# Lunches ssl client command in response to a request.
+#
+#
+sub execClientCmd_Win {
+    my $proto;
+    local $ciphers;
+
+    debug "Entering execClientCmd_Win";
+    if (defined $in_cipher && $in_cipher ne "") {
+        my @arr = split /_/, $in_cipher, 2;
+        $proto = "-2 -3 -T";
+
+        $proto =~ s/-T// if ($arr[0] eq "TLS");
+        $proto =~ s/-3// if ($arr[0] eq "SSL3");
+        $proto =~ s/-2// if ($arr[0] eq "SSL2");
+	return 0 if (!&{$osDataArr{'cipherListFn'}}($in_cipher));
+        $ciphers = "-c $ciphers";
+        debug("Return from cipher conversion", $ciphers);
+    }
+
+    eval '$command = "'.$osDataArr{'clientRunCmd'}.'"';
+    debug("Executing command", $command);
+    if (!open CMD_OUT, "$command 2>&1 |") {
+        $ERR = "can not launch client";
+        return 0;
+    }
+
+    my @cmdOutArr = <CMD_OUT>;
+    
+    foreach (@cmdOutArr) {
+        print $_;
+    }
+
+    my $haveVerify = 0;
+    my $haveErrors = 0;
+    foreach (@cmdOutArr) {
+        chop;
+        if (/unknown option/) {
+            $haveErrors++;
+            svr_error "unknown option\n";
+            next;
+        }
+        if (/Error performing handshake/) {
+            $haveErrors++;
+            svr_error "Error performing handshake\n";
+            next;
+        }
+        if (/Error creating credentials/) {
+            $haveErrors++;
+            svr_error "Error creating credentials\n";
+            next;
+        }
+        if (/Error .* authenticating server credentials!/) {
+            $haveErrors++;
+            svr_error "Error authenticating server credentials\n";
+            next;
+        }
+        if (/(error|ERROR|Error)/) {
+            $haveErrors++;
+            svr_error "found errors in server log\n";
+            next;
+        }
+    }
+
+    if ($haveErrors > 0) {
+        $ERR = "Have $haveErrors server errors";
+        debug "Exiting execClientCmd_Win";
+        return 0;
+    }
+    debug "Exiting execClientCmd_Win";
+    return 1;
+}
+
+#################################################################
+#  Main line of execution
+#----------------------------------------------------------------
+&init;
+
+if ($osDataArr{wservRun}) {
+    print header('text/html').
+        start_html('iopr client');
+}
+ 
+print "SCRIPT=OK\n";
+
+if (!&getReqData) { 
+    svr_error($ERR, 1);
+}
+
+if (!&configClient) { 
+    svr_error($ERR, 1);
+}
+
+&{$osDataArr{'execCmdFn'}} || svr_error;
+
+if ($osDataArr{wservRun}) {
+    print "</pre>";
+    print end_html;
+}
diff --git a/mozilla/security/nss/tests/iopr/server_scr/config b/mozilla/security/nss/tests/iopr/server_scr/config
new file mode 100644
index 00000000000..2adc0ed76c8
--- /dev/null
+++ b/mozilla/security/nss/tests/iopr/server_scr/config
@@ -0,0 +1,13 @@
+certDir=/iopr
+caCertName=TestCA
+caCrlName=TestCA
+userCertNames="TestUser510 TestUser511"
+userRevokedCertNames="TestUser510"
+reverseRunCGIScript="/cgi-bin/client.cgi"
+supportedTests="SslSingleHs"
+# SslSingleHs: ssl single handshake with out client cert auth
+SslSingleHsPort=443
+SslSingleHsUrl=/
+SslSingleHsParam=NOAUTH:NOCOV:NOCRL
+#ParamSslSingleHandshakeWithOutClientCertAuth="443 / NOAUTH:NOCOV:NOCRL"
+#ParamSslSingleHandshakeWithOutClientCertAuth="443 /"
diff --git a/mozilla/security/nss/tests/iopr/server_scr/iis_windows.cfg b/mozilla/security/nss/tests/iopr/server_scr/iis_windows.cfg
new file mode 100644
index 00000000000..e8444b47901
--- /dev/null
+++ b/mozilla/security/nss/tests/iopr/server_scr/iis_windows.cfg
@@ -0,0 +1,29 @@
+#
+# IIS windows configuration file
+#
+
+#
+# Define what type of system this is.
+#
+$clientSys = "iis";
+
+#
+# Cipher conversion table file
+#
+$cipherTableFile = "cipher.list";
+
+#--------------------------------------------
+# Web server specific variables start here:
+#
+
+#
+# Location of installed tstclntb binary
+#
+$tstclntwb = "./tstclntw.exe";
+
+#
+# HTTP Request file
+#
+$reqFile = "sslreq.dat";
+
+
diff --git a/mozilla/security/nss/tests/iopr/server_scr/sslreq.dat b/mozilla/security/nss/tests/iopr/server_scr/sslreq.dat
new file mode 100644
index 00000000000..2f7ad7736e8
--- /dev/null
+++ b/mozilla/security/nss/tests/iopr/server_scr/sslreq.dat
@@ -0,0 +1,2 @@
+GET / HTTP/1.0
+
diff --git a/mozilla/security/nss/tests/iopr/ssl_iopr.sh b/mozilla/security/nss/tests/iopr/ssl_iopr.sh
new file mode 100644
index 00000000000..006f66e5d22
--- /dev/null
+++ b/mozilla/security/nss/tests/iopr/ssl_iopr.sh
@@ -0,0 +1,670 @@
+#! /bin/sh
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is the Netscape security libraries.
+#
+# The Initial Developer of the Original Code is
+# Netscape Communications Corporation.
+# Portions created by the Initial Developer are Copyright (C) 1994-2000
+# the Initial Developer. All Rights Reserved.
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either the GNU General Public License Version 2 or later (the "GPL"), or
+# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+########################################################################
+#
+# mozilla/security/nss/tests/iopr/ssl_iopr.sh
+#
+# NSS SSL interoperability QA. This file is included from ssl.sh
+#
+# needs to work on all Unix and Windows platforms
+#
+# special strings
+# ---------------
+#   FIXME ... known problems, search for this string
+#   NOTE .... unexpected behavior
+#
+# FIXME - Netscape - NSS
+########################################################################
+IOPR_SSL_SOURCED=1
+
+########################################################################
+# The functions works with variables defined in interoperability 
+# configuration file that was downloaded from a webserver.
+# It tries to find unrevoked cert based on value of variable
+# "userRevokedCertNames" defined in the configuration file.
+# Params NONE.
+# Returns 0 if found, 1 otherwise.
+#
+setValidCert() {
+    testUser=
+    for user in $userCertNames; do
+        if [ "`echo $userRevokedCertNames | grep -v $user`" != "" ]; then
+            testUser=$user
+            return 0
+        fi
+    done
+    return 1
+}
+
+########################################################################
+# The funtions works with variables defined in interoperability 
+# configuration file that was downloaded from a webserver.
+# The function sets port, url, param and description test parameters
+# that was defind for a particular type of testing.
+# Params:
+#      $1 - supported types of testing. Currently have maximum
+#           of two: forward and reverse. But more can be defined. 
+# No return value
+#
+setTestParam() {
+    type=$1
+    sslPort=`eval 'echo $'${type}Port`
+    sslUrl=`eval 'echo $'${type}Url`
+    testParam=`eval 'echo $'${type}Param`
+    testDescription=`eval 'echo $'${type}Descr`
+    [ -z "$sslPort" ] && sslPort=443
+    [ -z "$sslUrl" ] && sslUrl="/iopr_test/test_pg.html"
+    [ "$sslUrl" = "/" ] && sslUrl="/test_pg.html"
+}
+
+
+#######################################################################
+# local shell function to perform SSL Cipher Suite Coverage tests
+# in interoperability mode. Tests run against web server by using nss
+# test client
+# Params:
+#      $1 - supported type of testing.
+#      $2 - testing host
+#      $3 - nss db location
+# No return value
+#  
+ssl_iopr_cov_ext_server()
+{
+  testType=$1
+  host=$2
+  dbDir=$3
+
+  setTestParam $testType
+  if [ "`echo $testParam | grep NOCOV`" != "" ]; then
+      echo "SSL Cipher Coverage of WebServ($IOPR_HOSTADDR) excluded from " \
+           "run by server configuration"
+      return 0
+  fi
+
+  html_head "SSL Cipher Coverage of WebServ($IOPR_HOSTADDR" \
+      "$BYPASS_STRING $NORM_EXT): $testDescription"
+
+  setValidCert; ret=$?
+  if [ $ret -ne 0 ]; then
+      html_failed "<TR><TD>Fail to find valid test cert(ws: $host)" 
+      return $ret
+  fi
+
+  SSL_REQ_FILE=${TMP}/sslreq.dat.$$
+  echo "GET $sslUrl HTTP/1.0" > $SSL_REQ_FILE
+  echo >> $SSL_REQ_FILE
+  
+  while read ecc tls param testname therest; do
+      [ -z "$ecc" -o "$ecc" = "#" -o "`echo $testname | grep FIPS`" -o \
+          "$ecc" = "ECC" ] && continue; 
+      
+      echo "$SCRIPTNAME: running $testname ----------------------------"
+      TLS_FLAG=-T
+      if [ "$tls" = "TLS" ]; then
+          TLS_FLAG=""
+      fi
+      
+      resFile=${TMP}/$HOST.tmpRes.$$
+      rm $resFile 2>/dev/null
+      
+      echo "tstclnt -p ${sslPort} -h ${host} -c ${param} ${TLS_FLAG} \\"
+      echo "      -n $testUser -w nss ${CLIEN_OPTIONS} -f \\"
+      echo "      -d ${dbDir} < ${SSL_REQ_FILE} > $resFile"
+      
+      tstclnt -w nss -p ${sslPort} -h ${host} -c ${param} \
+          ${TLS_FLAG} ${CLIEN_OPTIONS} -f -n $testUser -w nss \
+          -d ${dbDir} < ${SSL_REQ_FILE} >$resFile  2>&1
+      ret=$?
+      grep "ACCESS=OK" $resFile
+      test $? -eq 0 -a $ret -eq 0
+      ret=$?
+      [ $ret -ne 0 ] && cat ${TMP}/$HOST.tmp.$$
+      rm -f $resFile 2>/dev/null
+      html_msg $ret 0 "${testname}"
+  done < ${SSLCOV}
+  rm -f $SSL_REQ_FILE 2>/dev/null
+
+  html "</TABLE><BR>"
+}
+
+#######################################################################
+# local shell function to perform SSL  Client Authentication tests
+# in interoperability mode. Tests run against web server by using nss
+# test client
+# Params:
+#      $1 - supported type of testing.
+#      $2 - testing host
+#      $3 - nss db location
+# No return value
+#  
+ssl_iopr_auth_ext_server()
+{
+  testType=$1
+  host=$2
+  dbDir=$3
+
+  setTestParam $testType
+  if [ "`echo $testParam | grep NOAUTH`" != "" ]; then
+      echo "SSL Client Authentication WebServ($IOPR_HOSTADDR) excluded from " \
+           "run by server configuration"
+      return 0
+  fi
+
+  html_head "SSL Client Authentication WebServ($IOPR_HOSTADDR $BYPASS_STRING $NORM_EXT):
+             $testDescription"
+
+  setValidCert;ret=$?
+  if [ $ret -ne 0 ]; then
+      html_failed "<TR><TD>Fail to find valid test cert(ws: $host)" 
+      return $ret
+  fi
+
+  SSL_REQ_FILE=${TMP}/sslreq.dat.$$
+  echo "GET $sslUrl HTTP/1.0" > $SSL_REQ_FILE
+  echo >> $SSL_REQ_FILE
+  
+  SSLAUTH_TMP=${TMP}/authin.tl.tmp
+  grep -v "^#" ${SSLAUTH} | grep -- "-r_-r_-r_-r" > ${SSLAUTH_TMP}
+
+  while read ecc value sparam cparam testname; do
+      [ -z "$ecc" -o "$ecc" = "#" -o "$ecc" = "ECC" ] && continue;
+
+      cparam=`echo $cparam | sed -e 's;_; ;g' -e "s/TestUser/$testUser/g" `
+      
+      echo "tstclnt -p ${sslPort} -h ${host} ${CLIEN_OPTIONS} -f ${cparam} \\"
+      echo "         -d ${dbDir} < ${SSL_REQ_FILE}"
+      
+      resFile=${TMP}/$HOST.tmp.$$
+      rm $rsFile 2>/dev/null
+
+      tstclnt -p ${sslPort} -h ${host} ${CLIEN_OPTIONS} -f ${cparam} \
+          -d ${dbDir} < ${SSL_REQ_FILE} >$resFile  2>&1
+      ret=$?
+      grep "ACCESS=OK" $resFile
+      test $? -eq 0 -a $ret -eq 0
+      ret=$?
+      [ $ret -ne 0 ] && cat $resFile
+      rm $resFile 2>/dev/null
+      
+      html_msg $ret $value "${testname}. Client params: $cparam"\
+          "produced a returncode of $ret, expected is $value"
+  done < ${SSLAUTH_TMP}
+  rm -f ${SSLAUTH_TMP} ${SSL_REQ_FILE}
+
+  html "</TABLE><BR>"
+}
+
+########################################################################
+# local shell function to perform SSL interoperability test with/out
+# revoked certs tests. Tests run against web server by using nss
+# test client
+# Params:
+#      $1 - supported type of testing.
+#      $2 - testing host
+#      $3 - nss db location
+# No return value
+#  
+ssl_iopr_crl_ext_server()
+{
+  testType=$1
+  host=$2
+  dbDir=$3
+
+  setTestParam $testType
+  if [ "`echo $testParam | grep NOCRL`" != "" ]; then
+      echo "CRL SSL Client Tests of WebServerv($IOPR_HOSTADDR) excluded from " \
+           "run by server configuration"
+      return 0
+  fi
+
+  html_head "CRL SSL Client Tests of WebServer($IOPR_HOSTADDR $BYPASS_STRING $NORM_EXT): $testDescription"
+  
+  setValidCert; ret=$?
+  if [ $ret -ne 0 ]; then
+      html_failed "<TR><TD>Fail to find valid test cert(ws: $host)" 
+      return $ret
+  fi
+
+  SSL_REQ_FILE=${TMP}/sslreq.dat.$$
+  echo "GET $sslUrl HTTP/1.0" > $SSL_REQ_FILE
+  echo >> $SSL_REQ_FILE
+  
+  SSLAUTH_TMP=${TMP}/authin.tl.tmp
+  grep -v "^#" ${SSLAUTH} | grep -- "-r_-r_-r_-r" | grep -v bogus | \
+      grep -v none > ${SSLAUTH_TMP}
+
+  while read ecc value sparam _cparam testname; do
+      [ -z "$ecc" -o "$ecc" = "#" -o "$ecc" = "ECC" ] && continue;
+
+      rev_modvalue=254
+      for testUser in $userCertNames; do
+          cparam=`echo $_cparam | sed -e 's;_; ;g' -e "s/TestUser/$testUser/g" `
+	  
+          echo "tstclnt -p ${sslPort} -h ${host} ${CLIEN_OPTIONS} \\"
+          echo "        -f -d ${dbDir} ${cparam}  < ${SSL_REQ_FILE}"
+          resFile=${TMP}/$HOST.tmp.$$
+          rm -f $resFile 2>/dev/null
+          tstclnt -p ${sslPort} -h ${host} ${CLIEN_OPTIONS} -f ${cparam} \
+              -d ${dbDir} < ${SSL_REQ_FILE} \
+              > $resFile  2>&1
+          ret=$?
+          grep "ACCESS=OK" $resFile
+          test $? -eq 0 -a $ret -eq 0
+          ret=$?
+          [ $ret -ne 0 ] && ret=$rev_modvalue;
+          [ $ret -ne 0 ] && cat $resFile
+          rm -f $resFile 2>/dev/null
+
+          if [ "`echo $userRevokedCertNames | grep $testUser`" != "" ]; then
+              modvalue=$rev_modvalue
+              testAddMsg="revoked"
+          else
+              testAddMsg="not revoked"
+              modvalue=$value
+          fi
+          html_msg $ret $modvalue "${testname} (cert ${testUser} - $testAddMsg)" \
+              "produced a returncode of $ret, expected is $modvalue"
+      done
+  done < ${SSLAUTH_TMP}
+  rm -f ${SSLAUTH_TMP} ${SSL_REQ_FILE}
+  
+  html "</TABLE><BR>"
+}
+
+
+########################################################################
+# local shell function to perform SSL Cipher Coverage tests of nss server
+# by invoking remote test client on web server side.
+# Invoked only if reverse testing is supported by web server.
+# Params:
+#      $1 - remote web server host
+#      $2 - open port to connect to invoke CGI script
+#      $3 - host where selfserv is running(name of the host nss tests
+#           are running)
+#      $4 - port where selfserv is running
+#      $5 - selfserv nss db location
+# No return value
+#  
+ssl_iopr_cov_ext_client()
+{
+  host=$1
+  port=$2
+  sslHost=$3
+  sslPort=$4
+  serDbDir=$5
+
+  html_head "SSL Cipher Coverage of SelfServ $IOPR_HOSTADDR. $BYPASS_STRING $NORM_EXT"
+
+  setValidCert
+  ret=$?
+  if [ $res -ne 0 ]; then
+      html_failed "<TR><TD>Fail to find valid test cert(ws: $host)" 
+      return $ret
+  fi
+
+  # P_R_SERVERDIR switch require for selfserv to work.
+  # Will be restored after test
+  OR_P_R_SERVERDIR=$P_R_SERVERDIR
+  P_R_SERVERDIR=$serDbDir
+  OR_P_R_CLIENTDIR=$P_R_CLIENTDIR
+  P_R_CLIENTDIR=$serDbDir
+  testname=""
+  sparam="-vvvc ABCDEFcdefgijklmnvyz"
+  # Launch the server
+  start_selfserv 
+  
+  while read ecc tls param cipher therest; do
+      [ -z "$ecc" -o "$ecc" = "#" -o "$ecc" = "ECC" ] && continue;
+      echo "============= Beginning of the test ===================="
+      echo
+      
+      is_selfserv_alive
+      
+      TEST_IN=${TMP}/${HOST}_IN.tmp.$$
+      TEST_OUT=${TMP}/$HOST.tmp.$$
+      rm -f $TEST_IN $TEST_OUT 2>/dev/null
+      
+      echo "GET $reverseRunCGIScript?host=$sslHost&port=$sslPort&cert=$testUser&cipher=$cipher HTTP/1.0" > $TEST_IN
+      echo >> $TEST_IN
+      
+      echo "------- Request ----------------------"
+      cat $TEST_IN
+      echo "------- Command ----------------------"
+      echo tstclnt -d $serDbDir -w ${R_PWFILE} -o -p $port \
+          -h $host \< $TEST_IN \>\> $TEST_OUT
+
+      tstclnt -d $serDbDir -w ${R_PWFILE} -o -p $port \
+          -h $host <$TEST_IN > $TEST_OUT 
+
+      echo "------- Server output Begin ----------"
+      cat $TEST_OUT
+      echo "------- Server output End   ----------"
+      
+      echo "Checking for errors in log file..."
+      grep "SCRIPT=OK" $TEST_OUT 2>&1 >/dev/null
+      if [ $? -eq 0 ]; then
+          grep "cipher is not supported" $TEST_OUT 2>&1 >/dev/null
+          if [ $? -eq 0 ]; then
+              echo "Skiping test: no support for the cipher $cipher on server side"
+              continue
+          fi
+          
+          grep -i "SERVER ERROR:" $TEST_OUT
+          ret=$?
+          if [ $ret -eq 0 ]; then
+              echo "Found problems. Reseting exit code to failure."
+              
+              ret=1
+          else
+              ret=0
+          fi
+      else
+          echo "Script was not executed. Reseting exit code to failure."
+          ret=11
+      fi
+      
+      html_msg $ret 0 "Test ${cipher}. Server params: $sparam " \
+          " produced a returncode of $ret, expected is 0"
+      rm -f $TEST_OUT $TEST_IN 2>&1 > /dev/null
+  done < ${SSLCOV}
+  kill_selfserv
+  
+  P_R_SERVERDIR=$OR_P_R_SERVERDIR
+  
+  rm -f ${TEST_IN} ${TEST_OUT}
+  html "</TABLE><BR>"
+}
+
+########################################################################
+# local shell function to perform SSL Authentication tests of nss server
+# by invoking remove test client on web server side
+# Invoked only if reverse testing is supported by web server.
+# Params:
+#      $1 - remote web server host
+#      $2 - open port to connect to invoke CGI script
+#      $3 - host where selfserv is running(name of the host nss tests
+#           are running)
+#      $4 - port where selfserv is running
+#      $5 - selfserv nss db location
+# No return value
+#  
+ssl_iopr_auth_ext_client()
+{
+  host=$1
+  port=$2
+  sslHost=$3
+  sslPort=$4
+  serDbDir=$5
+
+  html_head "SSL Client Authentication with Selfserv from $IOPR_HOSTADDR. $BYPASS_STRING $NORM_EXT"
+
+  setValidCert
+  ret=$?
+  if [ $res -ne 0 ]; then
+      html_failed "<TR><TD>Fail to find valid test cert(ws: $host)" 
+      return $ret
+  fi
+
+  OR_P_R_SERVERDIR=$P_R_SERVERDIR
+  P_R_SERVERDIR=${serDbDir}
+  OR_P_R_CLIENTDIR=$P_R_CLIENTDIR
+  P_R_CLIENTDIR=$serDbDir
+
+  SSLAUTH_TMP=${TMP}/authin.tl.tmp
+
+  grep -v "^#" $SSLAUTH | grep "\s*0\s*" > ${SSLAUTH_TMP}
+
+  while read ecc value sparam cparam testname; do
+      [ -z "$ecc" -o "$ecc" = "#" -o "$ecc" = "ECC" ] && continue;
+
+      echo "Server params: $sparam"
+      sparam=$sparam" -vvvc ABCDEFcdefgijklmnvyz"
+      start_selfserv
+      
+      TEST_IN=${TMP}/$HOST_IN.tmp.$$
+      TEST_OUT=${TMP}/$HOST.tmp.$$
+      rm -f $TEST_IN $TEST_OUT 2>/dev/null
+
+      echo "GET $reverseRunCGIScript?host=$sslHost&port=$sslPort&cert=$testUser HTTP/1.0" > $TEST_IN
+      echo >> $TEST_IN
+      
+      echo "------- Request ----------------------"
+      cat $TEST_IN
+      echo "------- Command ----------------------"
+      echo tstclnt -d $serDbDir -w ${R_PWFILE} -o -p $port \
+          -h $host \< $TEST_IN \>\> $TEST_OUT
+      
+      tstclnt -d $serDbDir -w ${R_PWFILE} -o -p $port \
+          -h $host <$TEST_IN > $TEST_OUT 
+      
+      echo "------- Server output Begin ----------"
+      cat $TEST_OUT
+      echo "------- Server output End   ----------"
+
+      echo "Checking for errors in log file..."
+      grep "SCRIPT=OK" $TEST_OUT 2>&1 >/dev/null
+      if [ $? -eq 0 ]; then
+          echo "Checking for error in log file..."
+          grep -i "SERVER ERROR:" $TEST_OUT
+          ret=$?
+          if [ $ret -eq 0 ]; then
+              echo "Found problems. Reseting exit code to failure."
+              ret=1
+          else
+              ret=0
+          fi
+      else
+          echo "Script was not executed. Reseting exit code to failure."
+          ret=11
+      fi
+      
+      html_msg $ret $value "${testname}. Server params: $sparam"\
+          "produced a returncode of $ret, expected is $value"
+      kill_selfserv
+      rm -f $TEST_OUT $TEST_IN 2>&1 > /dev/null
+  done < ${SSLAUTH_TMP}
+  P_R_SERVERDIR=$OR_P_R_SERVERDIR
+
+  rm -f ${SSLAUTH_TMP} ${TEST_IN} ${TEST_OUT}
+  html "</TABLE><BR>"
+}
+
+#########################################################################
+# local shell function to perform SSL CRL testing of nss server
+# by invoking remote test client on web server side
+# Invoked only if reverse testing is supported by web server.
+# Params:
+#      $1 - remote web server host
+#      $2 - open port to connect to invoke CGI script
+#      $3 - host where selfserv is running(name of the host nss tests
+#           are running)
+#      $4 - port where selfserv is running
+#      $5 - selfserv nss db location
+# No return value
+#  
+ssl_iopr_crl_ext_client()
+{
+  host=$1
+  port=$2
+  sslHost=$3
+  sslPort=$4
+  serDbDir=$5
+
+  html_head "CRL SSL Selfserv Tests from $IOPR_HOSTADDR. $BYPASS_STRING $NORM_EXT"
+  
+  OR_P_R_SERVERDIR=$P_R_SERVERDIR
+  P_R_SERVERDIR=${serDbDir}
+  OR_P_R_CLIENTDIR=$P_R_CLIENTDIR
+  P_R_CLIENTDIR=$serDbDir
+
+  SSLAUTH_TMP=${TMP}/authin.tl.tmp
+  grep -v "^#" $SSLAUTH | grep "\s*0\s*" > ${SSLAUTH_TMP}
+
+  while read ecc value sparam _cparam testname; do
+      [ -z "$ecc" -o "$ecc" = "#" -o "$ecc" = "ECC" ] && continue;
+      sparam="$sparam  -vvvc ABCDEFcdefgijklmnvyz"
+      start_selfserv
+
+      for testUser in $userCertNames; do
+	  
+          is_selfserv_alive
+          
+          TEST_IN=${TMP}/${HOST}_IN.tmp.$$
+          TEST_OUT=${TMP}/$HOST.tmp.$$
+          rm -f $TEST_IN $TEST_OUT 2>/dev/null
+
+          echo "GET $reverseRunCGIScript?host=$sslHost&port=$sslPort&cert=$testUser HTTP/1.0" > $TEST_IN
+          echo >> $TEST_IN
+          
+          echo "------- Request ----------------------"
+          cat $TEST_IN
+          echo "------- Command ----------------------"
+          echo tstclnt -d $serDbDir -w ${R_PWFILE} -o -p $port \
+              -h ${host} \< $TEST_IN \>\> $TEST_OUT
+            
+          tstclnt -d $serDbDir -w ${R_PWFILE} -o -p $port \
+              -h ${host} <$TEST_IN > $TEST_OUT 
+          echo "------- Request ----------------------"
+          cat $TEST_IN
+          echo "------- Server output Begin ----------"
+          cat $TEST_OUT
+          echo "------- Server output End   ----------"
+          
+          echo "Checking for errors in log file..."
+          grep "SCRIPT=OK" $TEST_OUT 2>&1 >/dev/null
+          if [ $? -eq 0 ]; then
+              grep -i "SERVER ERROR:" $TEST_OUT
+              ret=$?
+              if [ $ret -eq 0 ]; then
+                  echo "Found problems. Reseting exit code to failure."
+                  ret=1
+              else
+                  ret=0
+              fi
+          else
+              echo "Script was not executed. Reseting exit code to failure."
+              ret=11
+          fi
+          
+          if [ "`echo $userRevokedCertNames | grep $testUser`" != "" ]; then
+              modvalue=1
+              testAddMsg="revoked"
+          else
+              testAddMsg="not revoked"
+              modvalue=0
+          fi
+          
+          html_msg $ret $modvalue "${testname} (cert ${testUser} - $testAddMsg)" \
+		"produced a returncode of $ret, expected is $modvalue(selfserv args: $sparam)"
+          rm -f $TEST_OUT $TEST_IN 2>&1 > /dev/null
+      done
+      kill_selfserv
+  done < ${SSLAUTH_TMP}
+  P_R_SERVERDIR=$OR_P_R_SERVERDIR
+
+  rm -f ${SSLAUTH_TMP}
+  html "</TABLE><BR>"
+}
+
+#####################################################################
+# Initial point for running ssl test againt multiple hosts involved in
+# interoperability testing. Called from nss/tests/ssl/ssl.sh
+# It will only proceed with test run for a specific host if environment variable 
+# IOPR_HOSTADDR_LIST was set, had the host name in the list
+# and all needed file were successfully downloaded and installed for the host.
+#
+# Returns 1 if interoperability testing is off, 0 otherwise. 
+#
+ssl_iopr_run() {
+    NO_ECC_CERTS=1 # disable ECC for interoperability tests
+
+    if [ "$IOPR" -ne 1 ]; then
+        return 1
+    fi
+    cd ${CLIENTDIR}
+
+    num=1
+    IOPR_HOST_PARAM=`echo "${IOPR_HOSTADDR_LIST} " | cut -f $num -d' '`
+    while [ "$IOPR_HOST_PARAM" ]; do
+        IOPR_HOSTADDR=`echo $IOPR_HOST_PARAM | cut -f 1 -d':'`
+        IOPR_OPEN_PORT=`echo "$IOPR_HOST_PARAM:" | cut -f 2 -d':'`
+        [ -z "$IOPR_OPEN_PORT" ] && IOPR_OPEN_PORT=443
+        
+        . ${IOPR_CADIR}_${IOPR_HOSTADDR}/iopr_server.cfg
+        RES=$?
+        
+        if [ $RES -ne 0 -o X`echo "$wsFlags" | grep NOIOPR` != X ]; then
+            num=`expr $num + 1`
+            IOPR_HOST_PARAM=`echo "${IOPR_HOSTADDR_LIST} " | cut -f $num -d' '`
+            continue
+        fi
+        
+
+        # Testing directories defined by webserver.
+        echo "Testing ssl interoperability.
+                Client: local(tstclnt).
+                Server: remote($IOPR_HOSTADDR:$IOPR_OPEN_PORT)"
+        
+        for sslTestType in $supportedTests; do
+            ssl_iopr_cov_ext_server $sslTestType ${IOPR_HOSTADDR} \
+                ${IOPR_CLIENTDIR}_${IOPR_HOSTADDR}
+            ssl_iopr_auth_ext_server $sslTestType ${IOPR_HOSTADDR} \
+                ${IOPR_CLIENTDIR}_${IOPR_HOSTADDR}
+            ssl_iopr_crl_ext_server $sslTestType ${IOPR_HOSTADDR} \
+                ${IOPR_CLIENTDIR}_${IOPR_HOSTADDR}
+        done
+        
+        
+        # Testing selfserv with client located at the webserver.
+        echo "Testing ssl interoperability.
+                Client: remote($IOPR_HOSTADDR:$PORT)
+                Server: local(selfserv)"
+        ssl_iopr_cov_ext_client ${IOPR_HOSTADDR} ${IOPR_OPEN_PORT} \
+            ${HOSTADDR} ${PORT} ${R_IOPR_SERVERDIR}_${IOPR_HOSTADDR}
+        ssl_iopr_auth_ext_client ${IOPR_HOSTADDR} ${IOPR_OPEN_PORT} \
+            ${HOSTADDR} ${PORT} ${R_IOPR_SERVERDIR}_${IOPR_HOSTADDR}
+        ssl_iopr_crl_ext_client ${IOPR_HOSTADDR} ${IOPR_OPEN_PORT} \
+            ${HOSTADDR} ${PORT} ${R_IOPR_SERVERDIR}_${IOPR_HOSTADDR}
+        echo "================================================"
+        echo "Done testing interoperability with $IOPR_HOSTADDR"
+        num=`expr $num + 1`
+        IOPR_HOST_PARAM=`echo "${IOPR_HOSTADDR_LIST} " | cut -f $num -d' '`
+    done
+    NO_ECC_CERTS=0 #disable ECC for interoperability 
+    return 0
+}
+
diff --git a/mozilla/security/nss/tests/ssl/ssl.sh b/mozilla/security/nss/tests/ssl/ssl.sh
index eeebe39f053..de9a8b044bf 100755
--- a/mozilla/security/nss/tests/ssl/ssl.sh
+++ b/mozilla/security/nss/tests/ssl/ssl.sh
@@ -67,6 +67,9 @@ ssl_init()
       cd ../common
       . ./init.sh
   fi
+  if [ -z "${IOPR_SSL_SOURCED}" ]; then
+      . ../iopr/ssl_iopr.sh
+  fi
   if [ ! -r $CERT_LOG_FILE ]; then  # we need certificates here
       cd ../cert
       . ./cert.sh
@@ -211,7 +214,8 @@ start_selfserv()
       echo "$SCRIPTNAME: $testname ----"
   fi
   sparam=`echo $sparam | sed -e 's;_; ;g'`
-  if [ -n "$NSS_ENABLE_ECC" ] ; then
+  if [ -n "$NSS_ENABLE_ECC" ] && \
+     [ -z "$NO_ECC_CERTS" -o "$NO_ECC_CERTS" != "1"  ] ; then
       ECC_OPTIONS="-e ${HOSTADDR}-ec"
   else
       ECC_OPTIONS=""
@@ -275,7 +279,7 @@ ssl_cov()
 
   while read ectype tls param testname
   do
-      p=`echo "$testname" | sed -e "s/ .*//"`   #sonmi, only run extended test on SSL3 and TLS
+      p=`echo "$testname" | sed -e "s/_.*//"`   #sonmi, only run extended test on SSL3 and TLS
       
       if [ "$p" = "SSL2" -a "$NORM_EXT" = "Extended Test" ] ; then
           echo "$SCRIPTNAME: skipping  $testname for $NORM_EXT"
@@ -795,5 +799,6 @@ if [ -z  "$DO_REM_ST" -a -z  "$DO_DIST_ST" ] ; then
     BYPASS_STRING="Server Bypass"
     ssl_run
 
+    ssl_iopr_run
     ssl_cleanup
 fi
diff --git a/mozilla/security/nss/tests/ssl/sslcov.txt b/mozilla/security/nss/tests/ssl/sslcov.txt
index 7399886456f..1a8144564a1 100644
--- a/mozilla/security/nss/tests/ssl/sslcov.txt
+++ b/mozilla/security/nss/tests/ssl/sslcov.txt
@@ -7,88 +7,88 @@
 # Enable Enable Cipher Test Name 
 #  EC     TLS
 #
-  noECC  noTLS   A    SSL2 RC4 128 WITH MD5
-  noECC   TLS    B    SSL2 RC4 128 EXPORT40 WITH MD5
-  noECC   TLS    C    SSL2 RC2 128 CBC WITH MD5
-  noECC  noTLS   D    SSL2 RC2 128 CBC EXPORT40 WITH MD5
-  noECC   TLS    E    SSL2 DES 64 CBC WITH MD5
-  noECC  noTLS   F    SSL2 DES 192 EDE3 CBC WITH MD5
+  noECC  noTLS   A    SSL2_RC4_128_WITH_MD5
+  noECC   TLS    B    SSL2_RC4_128_EXPORT40_WITH_MD5
+  noECC   TLS    C    SSL2_RC2_128_CBC_WITH_MD5
+  noECC  noTLS   D    SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
+  noECC   TLS    E    SSL2_DES_64_CBC_WITH_MD5
+  noECC  noTLS   F    SSL2_DES_192_EDE3_CBC_WITH_MD5
 #
-# noECC  noTLS   a    SSL3 FORTEZZA DMS WITH FORTEZZA CBC SHA
-# noECC  noTLS   b    SSL3 FORTEZZA DMS WITH RC4 128 SHA
-  noECC  noTLS   c    SSL3 RSA WITH RC4 128 MD5
-  noECC  noTLS   d    SSL3 RSA WITH 3DES EDE CBC SHA
-  noECC  noTLS   e    SSL3 RSA WITH DES CBC SHA
-  noECC  noTLS   f    SSL3 RSA EXPORT WITH RC4 40 MD5
-  noECC  noTLS   g    SSL3 RSA EXPORT WITH RC2 CBC 40 MD5
-# noECC  noTLS   h    SSL3 FORTEZZA DMS WITH NULL SHA
-  noECC  noTLS   i    SSL3 RSA WITH NULL MD5
-  noECC  noTLS   j    SSL3 RSA FIPS WITH 3DES EDE CBC SHA
-  noECC  noTLS   k    SSL3 RSA FIPS WITH DES CBC SHA
-  noECC  noTLS   l    SSL3 RSA EXPORT WITH DES CBC SHA   (new)
-  noECC  noTLS   m    SSL3 RSA EXPORT WITH RC4 56 SHA    (new)
-  noECC  noTLS   n    SSL3 RSA WITH RC4 128 SHA
-  noECC  noTLS   v    SSL3 RSA WITH AES 128 CBC SHA
-  noECC  noTLS   y    SSL3 RSA WITH AES 256 CBC SHA
-  noECC  noTLS   z    SSL3 RSA WITH NULL SHA
+# noECC  noTLS   a    SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA
+# noECC  noTLS   b    SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA
+  noECC  noTLS   c    SSL3_RSA_WITH_RC4_128_MD5
+  noECC  noTLS   d    SSL3_RSA_WITH_3DES_EDE_CBC_SHA
+  noECC  noTLS   e    SSL3_RSA_WITH_DES_CBC_SHA
+  noECC  noTLS   f    SSL3_RSA_EXPORT_WITH_RC4_40_MD5
+  noECC  noTLS   g    SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5
+# noECC  noTLS   h    SSL3_FORTEZZA_DMS_WITH_NULL_SHA
+  noECC  noTLS   i    SSL3_RSA_WITH_NULL_MD5
+  noECC  noTLS   j    SSL3_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
+  noECC  noTLS   k    SSL3_RSA_FIPS_WITH_DES_CBC_SHA
+  noECC  noTLS   l    SSL3_RSA_EXPORT_WITH_DES_CBC_SHA   (new)
+  noECC  noTLS   m    SSL3_RSA_EXPORT_WITH_RC4_56_SHA    (new)
+  noECC  noTLS   n    SSL3_RSA_WITH_RC4_128_SHA
+  noECC  noTLS   v    SSL3_RSA_WITH_AES_128_CBC_SHA
+  noECC  noTLS   y    SSL3_RSA_WITH_AES_256_CBC_SHA
+  noECC  noTLS   z    SSL3_RSA_WITH_NULL_SHA
 #
-  noECC   TLS    c    TLS RSA WITH RC4 128 MD5
-  noECC   TLS    d    TLS RSA WITH 3DES EDE CBC SHA
-  noECC   TLS    e    TLS RSA WITH DES CBC SHA
-  noECC   TLS    f    TLS RSA EXPORT WITH RC4 40 MD5
-  noECC   TLS    g    TLS RSA EXPORT WITH RC2 CBC 40 MD5
-  noECC   TLS    i    TLS RSA WITH NULL MD5
-  noECC   TLS    j    TLS RSA FIPS WITH 3DES EDE CBC SHA
-  noECC   TLS    k    TLS RSA FIPS WITH DES CBC SHA
-  noECC   TLS    l    TLS RSA EXPORT WITH DES CBC SHA   (new)
-  noECC   TLS    m    TLS RSA EXPORT WITH RC4 56 SHA    (new)
-  noECC   TLS    n    TLS RSA WITH RC4 128 SHA
-  noECC   TLS    v    TLS RSA WITH AES 128 CBC SHA
-  noECC   TLS    y    TLS RSA WITH AES 256 CBC SHA
-  noECC   TLS    z    TLS RSA WITH NULL SHA
+  noECC   TLS    c    TLS_RSA_WITH_RC4_128_MD5
+  noECC   TLS    d    TLS_RSA_WITH_3DES_EDE_CBC_SHA
+  noECC   TLS    e    TLS_RSA_WITH_DES_CBC_SHA
+  noECC   TLS    f    TLS_RSA_EXPORT_WITH_RC4_40_MD5
+  noECC   TLS    g    TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
+  noECC   TLS    i    TLS_RSA_WITH_NULL_MD5
+  noECC   TLS    j    TLS_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
+  noECC   TLS    k    TLS_RSA_FIPS_WITH_DES_CBC_SHA
+  noECC   TLS    l    TLS_RSA_EXPORT_WITH_DES_CBC_SHA   (new)
+  noECC   TLS    m    TLS_RSA_EXPORT_WITH_RC4_56_SHA    (new)
+  noECC   TLS    n    TLS_RSA_WITH_RC4_128_SHA
+  noECC   TLS    v    TLS_RSA_WITH_AES_128_CBC_SHA
+  noECC   TLS    y    TLS_RSA_WITH_AES_256_CBC_SHA
+  noECC   TLS    z    TLS_RSA_WITH_NULL_SHA
 #
 # ECC ciphers (SSL3)
 #
-   ECC   noTLS  :C001 SSL3 ECDH ECDSA WITH NULL SHA
-   ECC   noTLS  :C002 SSL3 ECDH ECDSA WITH RC4 128 SHA
-   ECC   noTLS  :C003 SSL3 ECDH ECDSA WITH 3DES EDE CBC SHA
-   ECC   noTLS  :C004 SSL3 ECDH ECDSA WITH AES 128 CBC SHA
-   ECC   noTLS  :C005 SSL3 ECDH ECDSA WITH AES 256 CBC SHA
-   ECC   noTLS  :C006 SSL3 ECDHE ECDSA WITH NULL SHA
-   ECC   noTLS  :C007 SSL3 ECDHE ECDSA WITH RC4 128 SHA
-   ECC   noTLS  :C008 SSL3 ECDHE ECDSA WITH 3DES EDE CBC SHA
-   ECC   noTLS  :C009 SSL3 ECDHE ECDSA WITH AES 128 CBC SHA
-   ECC   noTLS  :C00A SSL3 ECDHE ECDSA WITH AES 256 CBC SHA
-   ECC   noTLS  :C00B SSL3 ECDH RSA WITH NULL SHA
-   ECC   noTLS  :C00C SSL3 ECDH RSA WITH RC4 128 SHA
-   ECC   noTLS  :C00D SSL3 ECDH RSA WITH 3DES EDE CBC SHA
-   ECC   noTLS  :C00E SSL3 ECDH RSA WITH AES 128 CBC SHA
-   ECC   noTLS  :C00F SSL3 ECDH RSA WITH AES 256 CBC SHA
-   ECC   noTLS  :C010 SSL3 ECDHE RSA WITH NULL SHA
-   ECC   noTLS  :C011 SSL3 ECDHE RSA WITH RC4 128 SHA
-   ECC   noTLS  :C012 SSL3 ECDHE RSA WITH 3DES EDE CBC SHA
-   ECC   noTLS  :C013 SSL3 ECDHE RSA WITH AES 128 CBC SHA
-   ECC   noTLS  :C014 SSL3 ECDHE RSA WITH AES 256 CBC SHA
+   ECC   noTLS  :C001 SSL3_ECDH_ECDSA_WITH_NULL_SHA
+   ECC   noTLS  :C002 SSL3_ECDH_ECDSA_WITH_RC4_128_SHA
+   ECC   noTLS  :C003 SSL3_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
+   ECC   noTLS  :C004 SSL3_ECDH_ECDSA_WITH_AES_128_CBC_SHA
+   ECC   noTLS  :C005 SSL3_ECDH_ECDSA_WITH_AES_256_CBC_SHA
+   ECC   noTLS  :C006 SSL3_ECDHE_ECDSA_WITH_NULL_SHA
+   ECC   noTLS  :C007 SSL3_ECDHE_ECDSA_WITH_RC4_128_SHA
+   ECC   noTLS  :C008 SSL3_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
+   ECC   noTLS  :C009 SSL3_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
+   ECC   noTLS  :C00A SSL3_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
+   ECC   noTLS  :C00B SSL3_ECDH_RSA_WITH_NULL_SHA
+   ECC   noTLS  :C00C SSL3_ECDH_RSA_WITH_RC4_128_SHA
+   ECC   noTLS  :C00D SSL3_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
+   ECC   noTLS  :C00E SSL3_ECDH_RSA_WITH_AES_128_CBC_SHA
+   ECC   noTLS  :C00F SSL3_ECDH_RSA_WITH_AES_256_CBC_SHA
+   ECC   noTLS  :C010 SSL3_ECDHE_RSA_WITH_NULL_SHA
+   ECC   noTLS  :C011 SSL3_ECDHE_RSA_WITH_RC4_128_SHA
+   ECC   noTLS  :C012 SSL3_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
+   ECC   noTLS  :C013 SSL3_ECDHE_RSA_WITH_AES_128_CBC_SHA
+   ECC   noTLS  :C014 SSL3_ECDHE_RSA_WITH_AES_256_CBC_SHA
 #
 # ECC ciphers (TLS)
 #
-   ECC    TLS   :C001 TLS ECDH ECDSA WITH NULL SHA
-   ECC    TLS   :C002 TLS ECDH ECDSA WITH RC4 128 SHA
-   ECC    TLS   :C003 TLS ECDH ECDSA WITH 3DES EDE CBC SHA
-   ECC    TLS   :C004 TLS ECDH ECDSA WITH AES 128 CBC SHA
-   ECC    TLS   :C005 TLS ECDH ECDSA WITH AES 256 CBC SHA
-   ECC    TLS   :C006 TLS ECDHE ECDSA WITH NULL SHA
-   ECC    TLS   :C007 TLS ECDHE ECDSA WITH RC4 128 SHA
-   ECC    TLS   :C008 TLS ECDHE ECDSA WITH 3DES EDE CBC SHA
-   ECC    TLS   :C009 TLS ECDHE ECDSA WITH AES 128 CBC SHA
-   ECC    TLS   :C00A TLS ECDHE ECDSA WITH AES 256 CBC SHA
-   ECC    TLS   :C00B TLS ECDH RSA WITH NULL SHA
-   ECC    TLS   :C00C TLS ECDH RSA WITH RC4 128 SHA
-   ECC    TLS   :C00D TLS ECDH RSA WITH 3DES EDE CBC SHA
-   ECC    TLS   :C00E TLS ECDH RSA WITH AES 128 CBC SHA
-   ECC    TLS   :C00F TLS ECDH RSA WITH AES 256 CBC SHA
-   ECC    TLS   :C010 TLS ECDHE RSA WITH NULL SHA
-   ECC    TLS   :C011 TLS ECDHE RSA WITH RC4 128 SHA
-   ECC    TLS   :C012 TLS ECDHE RSA WITH 3DES EDE CBC SHA
-   ECC    TLS   :C013 TLS ECDHE RSA WITH AES 128 CBC SHA
-   ECC    TLS   :C014 TLS ECDHE RSA WITH AES 256 CBC SHA
+   ECC    TLS   :C001 TLS_ECDH_ECDSA_WITH_NULL_SHA
+   ECC    TLS   :C002 TLS_ECDH_ECDSA_WITH_RC4_128_SHA
+   ECC    TLS   :C003 TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
+   ECC    TLS   :C004 TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
+   ECC    TLS   :C005 TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
+   ECC    TLS   :C006 TLS_ECDHE_ECDSA_WITH_NULL_SHA
+   ECC    TLS   :C007 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
+   ECC    TLS   :C008 TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
+   ECC    TLS   :C009 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
+   ECC    TLS   :C00A TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
+   ECC    TLS   :C00B TLS_ECDH_RSA_WITH_NULL_SHA
+   ECC    TLS   :C00C TLS_ECDH_RSA_WITH_RC4_128_SHA
+   ECC    TLS   :C00D TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
+   ECC    TLS   :C00E TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
+   ECC    TLS   :C00F TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
+   ECC    TLS   :C010 TLS_ECDHE_RSA_WITH_NULL_SHA
+   ECC    TLS   :C011 TLS_ECDHE_RSA_WITH_RC4_128_SHA
+   ECC    TLS   :C012 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
+   ECC    TLS   :C013 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
+   ECC    TLS   :C014 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA