/// <summary>
		/// see https://www.openssl.org/docs/apps/ciphers.html
		/// for details about OpenSSL cipher string
		/// </summary>
		/// <returns>The string.</returns>
		/// <param name="sslProtocols">SSL protocols.</param>
		/// <param name="sslStrength">SSL strength.</param>
		public static string MakeString(SslProtocols sslProtocols, SslStrength sslStrength)
		{
			var parts = new List<string>();

			if (EnumExtensions.HasFlag(sslStrength, SslStrength.High))
			{
				parts.Add("HIGH");
			}

			if (EnumExtensions.HasFlag(sslStrength, SslStrength.Medium))
			{
				parts.Add("MEDIUM");
			}

			if (EnumExtensions.HasFlag(sslStrength, SslStrength.Low))
			{
				parts.Add("LOW");
			}

			if ((sslProtocols == SslProtocols.Default) ||
				(sslProtocols == SslProtocols.Tls) ||
				(sslProtocols == SslProtocols.Ssl3))
			{
				parts.Add("!SSLv2");
			}

			parts.Add("!ADH");
			parts.Add("!aNULL");
			parts.Add("!eNULL");
			parts.Add("@STRENGTH");

			return string.Join(":", parts.ToArray());
		}

#pragma warning restore 0618
        public void DisabledProtocols_SetSslProtocols_ThrowsException(SslProtocols disabledProtocols)
        {
            using (var handler = new HttpClientHandler())
            {
                Assert.Throws<NotSupportedException>(() => handler.SslProtocols = disabledProtocols);
            }
        }

 public virtual IAsyncResult BeginAuthenticateAsClient(string targetHost, X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, bool checkCertificateRevocation, AsyncCallback asyncCallback, object asyncState)
 {
     this._SslState.ValidateCreateContext(false, targetHost, enabledSslProtocols, null, clientCertificates, true, checkCertificateRevocation);
     LazyAsyncResult lazyResult = new LazyAsyncResult(this._SslState, asyncState, asyncCallback);
     this._SslState.ProcessAuthentication(lazyResult);
     return lazyResult;
 }

 /// <summary>
 /// Initializes a new instance of the <see cref="HttpListenerBase"/> class.
 /// </summary>
 /// <param name="address">IP Address to accept connections on</param>
 /// <param name="port">TCP Port to listen on, default HTTPS port is 443</param>
 /// <param name="factory">Factory used to create <see cref="IHttpClientContext"/>es.</param>
 /// <param name="certificate">Certificate to use</param>
 /// <param name="protocol">which HTTPS protocol to use, default is TLS.</param>
 protected HttpListenerBase(
     IPAddress address, int port, IHttpContextFactory factory, X509Certificate certificate,
     SslProtocols protocol)
     : this(address, port, factory, certificate)
 {
   _sslProtocol = protocol;
 }

        public SslServer(X509Certificate2 cert, bool certRequired, SslProtocols enabledProt, bool expectedExcep)
        {
            certificate = cert;
            clientCertificateRequired = certRequired;
            enabledSslProtocols = enabledProt;
            expectedException = expectedExcep;

            if (!certificate.HasPrivateKey)
            {
                Console.WriteLine("ERROR: The cerfiticate does not have a private key.");
                throw new Exception("No Private Key in the certificate file");
            }

            //Get the IPV4 address on this machine which is all that the MF devices support.
            foreach (IPAddress address in Dns.GetHostAddresses(Dns.GetHostName()))
            {
                if (address.AddressFamily == AddressFamily.InterNetwork)
                {
                    ipAddress = address;
                    break;
                }
            }

            if (ipAddress == null)
                throw new Exception("No IPV4 address found.");

            //Console.WriteLine("ipAddress is: " + ipAddress.ToString());
            //Console.WriteLine("port          is: " + port.ToString());
        }

        internal SecureChannel(string hostname, bool serverMode, SslProtocols sslProtocols, X509Certificate serverCertificate, X509CertificateCollection clientCertificates, bool remoteCertRequired, bool checkCertName,
                                                  bool checkCertRevocationStatus, EncryptionPolicy encryptionPolicy, LocalCertSelectionCallback certSelectionDelegate)
        {
            if (NetEventSource.IsEnabled)
            {
                NetEventSource.Enter(this, hostname, clientCertificates);
                NetEventSource.Log.SecureChannelCtor(this, hostname, clientCertificates, encryptionPolicy);
            }

            SslStreamPal.VerifyPackageInfo();

            _destination = hostname;

            if (hostname == null)
            {
                NetEventSource.Fail(this, "hostname == null");
            }
            _hostName = hostname;
            _serverMode = serverMode;

            _sslProtocols = sslProtocols;

            _serverCertificate = serverCertificate;
            _clientCertificates = clientCertificates;
            _remoteCertRequired = remoteCertRequired;
            _securityContext = null;
            _checkCertRevocation = checkCertRevocationStatus;
            _checkCertName = checkCertName;
            _certSelectionDelegate = certSelectionDelegate;
            _refreshCredentialNeeded = true;
            _encryptionPolicy = encryptionPolicy;
            
            if (NetEventSource.IsEnabled) NetEventSource.Exit(this);
        }

 /// <summary>
 /// Initializes a new instance of the <see cref="SecureHttpContext"/> class.
 /// </summary>
 /// <param name="protocols">SSL protocol to use.</param>
 /// <param name="socket">The socket.</param>
 /// <param name="context">The context.</param>
 /// <param name="certificate">Server certificate to use.</param>
 public SecureHttpContext(X509Certificate certificate, SslProtocols protocols, Socket socket,
                          MessageFactoryContext context)
     : base(socket, context)
 {
     _certificate = certificate;
     Protocol = protocols;
 }

        internal SecureChannel(string hostname, bool serverMode, SslProtocols sslProtocols, X509Certificate serverCertificate, X509CertificateCollection clientCertificates, bool remoteCertRequired, bool checkCertName,
                                                  bool checkCertRevocationStatus, EncryptionPolicy encryptionPolicy, LocalCertSelectionCallback certSelectionDelegate)
        {
            GlobalLog.Enter("SecureChannel#" + Logging.HashString(this) + "::.ctor", "hostname:" + hostname + " #clientCertificates=" + ((clientCertificates == null) ? "0" : clientCertificates.Count.ToString(NumberFormatInfo.InvariantInfo)));
            if (Logging.On)
            { 
                Logging.PrintInfo(Logging.Web, this, ".ctor", "hostname=" + hostname + ", #clientCertificates=" + ((clientCertificates == null) ? "0" : clientCertificates.Count.ToString(NumberFormatInfo.InvariantInfo)) + ", encryptionPolicy=" + encryptionPolicy);
            }
          
            SSPIWrapper.VerifyPackageInfo(GlobalSSPI.SSPISecureChannel);

            _destination = hostname;

            GlobalLog.Assert(hostname != null, "SecureChannel#{0}::.ctor()|hostname == null", Logging.HashString(this));
            _hostName = hostname;
            _serverMode = serverMode;

            _sslProtocols = sslProtocols;

            _serverCertificate = serverCertificate;
            _clientCertificates = clientCertificates;
            _remoteCertRequired = remoteCertRequired;
            _securityContext = null;
            _checkCertRevocation = checkCertRevocationStatus;
            _checkCertName = checkCertName;
            _certSelectionDelegate = certSelectionDelegate;
            _refreshCredentialNeeded = true;
            _encryptionPolicy = encryptionPolicy;
            GlobalLog.Leave("SecureChannel#" + Logging.HashString(this) + "::.ctor");
        }

 public async Task ClientAsyncAuthenticate_EachClientUnsupportedProtocol_Fail(SslProtocols protocol)
 {
     await Assert.ThrowsAsync<NotSupportedException>(() =>
     {
         return ClientAsyncSslHelper(protocol, SslProtocolSupport.SupportedSslProtocols);
     });
 }

 public SslTransportFactory(X509Certificate certificate, SslProtocols protocols, ILayerFactory next, bool clientCertificateRequired)
 {
     _certificate = certificate;
     _protocols = protocols;
     _clientCertificateRequired = clientCertificateRequired;
     _next = next;
 }

        public TTlsServerSocketTransport(
            int port,
            bool useBufferedSockets,
            X509Certificate2 certificate,
            RemoteCertificateValidationCallback clientCertValidator = null,
            LocalCertificateSelectionCallback localCertificateSelectionCallback = null,
            SslProtocols sslProtocols = SslProtocols.Tls12)
        {
            if (!certificate.HasPrivateKey)
            {
                throw new TTransportException(TTransportException.ExceptionType.Unknown,
                    "Your server-certificate needs to have a private key");
            }

            _port = port;
            _serverCertificate = certificate;
            _useBufferedSockets = useBufferedSockets;
            _clientCertValidator = clientCertValidator;
            _localCertificateSelectionCallback = localCertificateSelectionCallback;
            _sslProtocols = sslProtocols;

            try
            {
                // Create server socket
                _server = new TcpListener(IPAddress.Any, _port);
                _server.Server.NoDelay = true;
            }
            catch (Exception)
            {
                _server = null;
                throw new TTransportException($"Could not create ServerSocket on port {port}.");
            }
        }

 public static void ThrowOnNotAllowed(SslProtocols protocols, bool allowNone = true)
 {
     if ((!allowNone && (protocols == SslProtocols.None)) || ((protocols & ~AllowedSecurityProtocols) != 0))
     {
         throw new NotSupportedException(SR.net_securityprotocolnotsupported);
     }
 }

 public async Task ClientAsyncAuthenticate_MismatchProtocols_Fails(
     SslProtocols serverProtocol,
     SslProtocols clientProtocol,
     Type expectedException)
 {
     await Assert.ThrowsAsync(expectedException, () => ClientAsyncSslHelper(serverProtocol, clientProtocol));
 }

 public HttpsTestServer(X509Certificate serverCertificate, SslProtocols acceptedProtocols = SslProtocols.Tls)
 {
     _serverCertificate = serverCertificate;
     _protocols = acceptedProtocols;
     _log = VerboseTestLogging.GetInstance();
     AuxRecordDetected = false;
 }

 public AsyncStreamSocketSession(Socket client, SslProtocols security, IPool<BufferState> bufferStatePool, bool isReset)
     : base(client)
 {
     SecureProtocol = security;
     m_BufferStatePool = bufferStatePool;
     m_IsReset = isReset;
 }

        public SslStreamServer(
            Stream stream, 
            bool ownStream,
            X509Certificate serverCertificate,
            bool clientCertificateRequired,
            X509Chain caCerts,
            SslProtocols enabledSslProtocols,
            SslStrength sslStrength,
            bool checkCertificateRevocation,
            RemoteCertificateValidationHandler remote_callback)
            : base(stream, ownStream)
        {
            this.checkCertificateRevocationStatus = checkCertificateRevocation;
            this.remoteCertificateSelectionCallback = remote_callback;

            // Initialize the SslContext object
            InitializeServerContext(serverCertificate, clientCertificateRequired, caCerts, enabledSslProtocols, sslStrength, checkCertificateRevocation);
            
            ssl = new Ssl(sslContext);
            // Initialze the read/write bio
            read_bio = BIO.MemoryBuffer(false);
            write_bio = BIO.MemoryBuffer(false);
            // Set the read/write bio's into the the Ssl object
            ssl.SetBIO(read_bio, write_bio);
            read_bio.SetClose(BIO.CloseOption.Close);
            write_bio.SetClose(BIO.CloseOption.Close);
            // Set the Ssl object into server mode
            ssl.SetAcceptState();
        }

 public TcpTransportSecurity()
 {
     this.clientCredentialType = DefaultClientCredentialType;
     this.protectionLevel = DefaultProtectionLevel;
     this.extendedProtectionPolicy = ChannelBindingUtility.DefaultPolicy;
     this.sslProtocols = TransportDefaults.SslProtocols;
 }

        public SecureTcpServer(int listenPort, X509Certificate serverCertificate,
            SecureConnectionResultsCallback callback,
            RemoteCertificateValidationCallback certValidationCallback)
        {
            if (listenPort < 0 || listenPort > UInt16.MaxValue)
                throw new ArgumentOutOfRangeException("listenPort");

            if (serverCertificate == null)
                throw new ArgumentNullException("serverCertificate");

            if (callback == null)
                throw new ArgumentNullException("callback");

            onAcceptConnection = new AsyncCallback(OnAcceptConnection);
            onAuthenticateAsServer = new AsyncCallback(OnAuthenticateAsServer);

            this.serverCert = serverCertificate;
            this.certValidationCallback = certValidationCallback;
            this.connectionCallback = callback;
            this.listenPort = listenPort;
            this.disposed = 0;
            this.checkCertifcateRevocation = false;
            this.clientCertificateRequired = false;
            this.sslProtocols = SslProtocols.Default;
        }

        public SafeFreeCredentials(X509Certificate certificate, SslProtocols protocols, EncryptionPolicy policy)
            : base(IntPtr.Zero, true)
        {
            Debug.Assert(
                certificate == null || certificate is X509Certificate2,
                "Only X509Certificate2 certificates are supported at this time");

            X509Certificate2 cert = (X509Certificate2)certificate;

            if (cert != null)
            {
                Debug.Assert(cert.HasPrivateKey, "cert.HasPrivateKey");

                using (RSAOpenSsl rsa = (RSAOpenSsl)cert.GetRSAPrivateKey())
                {
                    if (rsa != null)
                    {
                        _certKeyHandle = rsa.DuplicateKeyHandle();
                        Interop.libcrypto.CheckValidOpenSslHandle(_certKeyHandle);
                    }
                }

                // TODO (3390): Add support for ECDSA.

                Debug.Assert(_certKeyHandle != null, "Failed to extract a private key handle");

                _certHandle = Interop.libcrypto.X509_dup(cert.Handle);
                Interop.libcrypto.CheckValidOpenSslHandle(_certHandle);
            }

            _protocols = protocols;
            _policy = policy;
        }

 /// <summary>
 /// Initializes a new instance of the <see cref="HttpListenerBase"/> class.
 /// </summary>
 /// <param name="address">IP Address to accept connections on</param>
 /// <param name="port">TCP Port to listen on, default HTTPS port is 443</param>
 /// <param name="factory">Factory used to create <see cref="IHttpClientContext"/>es.</param>
 /// <param name="certificate">Certificate to use</param>
 /// <param name="protocol">which HTTPS protocol to use, default is TLS.</param>
 /// <param name="requireClientCerts">True to require SSL client certificates</param>
 protected HttpListenerBase(IPAddress address, int port, IHttpContextFactory factory, X509Certificate certificate,
                            SslProtocols protocol, bool requireClientCerts)
     : this(address, port, factory)
 {
     _certificate = certificate;
     _requireClientCerts = requireClientCerts;
     _sslProtocol = protocol;
 }