diff --git a/tests/Makefile.am b/tests/Makefile.am
index 6dc63758d..e0d86abfd 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -36,7 +36,13 @@ EXTRA_DIST = suppressions.valgrind eagain-common.h test-chains.h \
 	certs/cert-rsa-2432.pem certs/ecc384.pem certs/ecc.pem \
 	certs/ca-ecc.pem certs/cert-ecc384.pem certs/cert-ecc.pem certs/ecc256.pem \
 	certs/ecc521.pem certs/rsa-2432.pem x509cert-dir/ca.pem \
-	cert-common.h pkcs11/softhsm.h pkcs11/pkcs11-pubkey-import.c
+	cert-common.h pkcs11/softhsm.h pkcs11/pkcs11-pubkey-import.c \
+	testpkcs11.pkcs15 testpkcs11.softhsm testpkcs11.sc-hsm \
+	testpkcs11-certs/ca.crt testpkcs11-certs/ca-tmpl \
+	testpkcs11-certs/client.key testpkcs11-certs/server.crt \
+	testpkcs11-certs/server-tmpl testpkcs11-certs/ca.key \
+	testpkcs11-certs/client.crt testpkcs11-certs/client-tmpl \
+	testpkcs11-certs/server.key
 
 AM_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS)
 AM_CPPFLAGS = \
@@ -160,6 +166,9 @@ dist_check_SCRIPTS = rfc2253-escape-test
 
 if !WINDOWS
 dist_check_SCRIPTS += sni-hostname.sh
+if ENABLE_PKCS11
+dist_check_SCRIPTS += testpkcs11.sh
+endif
 endif
 
 TESTS = $(ctests) $(dist_check_SCRIPTS)
diff --git a/tests/scripts/common.sh b/tests/scripts/common.sh
index 9c9c3fb3a..4615770f6 100644
--- a/tests/scripts/common.sh
+++ b/tests/scripts/common.sh
@@ -19,11 +19,61 @@
 # along with this file; if not, write to the Free Software Foundation,
 # Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 
-# due to the use of $RANDOM, this script requires bash
+export TZ="UTC"
+
+# Check for a utility to list ports.  Both ss and netstat will list
+# ports for normal users, and have similar semantics, so put the
+# command in the caller's PFCMD, or exit, indicating an unsupported
+# test.  Prefer ss from iproute2 over the older netstat.
+have_port_finder() {
+	for file in $(which ss 2> /dev/null) /*bin/ss /usr/*bin/ss /usr/local/*bin/ss;do
+		if test -x "$file";then
+			PFCMD="$file";return 0
+		fi
+	done
+
+	if test -z "$PFCMD";then
+	for file in $(which netstat 2> /dev/null) /bin/netstat /usr/bin/netstat /usr/local/bin/netstat;do
+		if test -x "$file";then
+			PFCMD="$file";return 0
+		fi
+	done
+	fi
+
+	if test -z "$PFCMD";then
+		echo "neither ss nor netstat found"
+		exit 1
+	fi
+}
+
+check_if_port_in_use() {
+	local PORT="$1"
+	local PFCMD; have_port_finder
+	$PFCMD -an|grep "[\:\.]$PORT" >/dev/null 2>&1
+}
+
+check_if_port_listening() {
+	local PORT="$1"
+	local PFCMD; have_port_finder
+	$PFCMD -anl|grep "[\:\.]$PORT"|grep LISTEN >/dev/null 2>&1
+}
 
-GETPORT='rc=0;while test $rc = 0;do PORT="$(((($$<<15)|RANDOM) % 63001 + 2000))";
-	netstat -anl|grep "[\:\.]$PORT" >/dev/null 2>&1;
-	rc=$?;done;'
+# Find a port number not currently in use.
+GETPORT='rc=0; myrandom=$(date +%N | sed s/^0*//)
+    while test $rc = 0;do
+	PORT="$(((($$<<15)|$myrandom) % 63001 + 2000))"
+	check_if_port_in_use $PORT;rc=$?
+    done
+'
+
+check_for_datefudge() {
+	TSTAMP=`datefudge -s "2006-09-23" date -u +%s || true`
+	if test "$TSTAMP" != "1158969600" || test "$WINDOWS" = 1; then
+	echo $TSTAMP
+		echo "You need datefudge to run this test"
+		exit 77
+	fi
+}
 
 fail() {
    PID="$1"
@@ -33,6 +83,30 @@ fail() {
    exit 1
 }
 
+exit_if_non_x86()
+{
+which lscpu >/dev/null 2>&1
+if test $? = 0;then
+        $(which lscpu)|grep Architecture|grep x86
+        if test $? != 0;then
+                echo "non-x86 CPU detected"
+                exit 0
+        fi
+fi
+}
+
+exit_if_non_padlock()
+{
+which lscpu >/dev/null 2>&1
+if test $? = 0;then
+        $(which lscpu)|grep Flags|grep phe
+        if test $? != 0;then
+                echo "non-Via padlock CPU detected"
+                exit 0
+        fi
+fi
+}
+
 wait_for_port()
 {
 	local ret
@@ -40,10 +114,10 @@ wait_for_port()
 	sleep 4
 
 	for i in 1 2 3 4 5 6;do
-		netstat -anl|grep "[\:\.]$PORT"|grep LISTEN >/dev/null 2>&1
+		check_if_port_listening ${PORT}
 		ret=$?
 		if test $ret != 0;then
-		netstat -anl|grep "[\:\.]$PORT"
+		check_if_port_in_use ${PORT}
 			echo try $i
 			sleep 2
 		else
@@ -59,7 +133,7 @@ wait_for_free_port()
 	local PORT="$1"
 
 	for i in 1 2 3 4 5 6;do
-		netstat -anl|grep "[\:\.]$PORT" >/dev/null 2>&1
+		check_if_port_in_use ${PORT}
 		ret=$?
 		if test $ret != 0;then
 			break
@@ -75,7 +149,7 @@ launch_server() {
 	shift
 
 	wait_for_free_port ${PORT}
-	${SERV} ${DEBUG} -p "${PORT}" $* >/dev/null 2>&1 &
+	${SERV} ${DEBUG} -p "${PORT}" $* >/dev/null &
 }
 
 launch_pkcs11_server() {
@@ -94,7 +168,7 @@ launch_bare_server() {
 	shift
 
 	wait_for_free_port ${PORT}
-	${SERV} $* >/dev/null 2>&1 &
+	${SERV} $* >/dev/null &
 }
 
 wait_server() {
@@ -114,3 +188,10 @@ wait_udp_server() {
 	sleep 4
 }
 
+if test -x /usr/bin/lockfile-create;then
+LOCKFILE="lockfile-create global"
+UNLOCKFILE="lockfile-remove global"
+else
+LOCKFILE="lockfile global.lock"
+UNLOCKFILE="rm -f global.lock"
+fi
diff --git a/tests/suite/Makefile.am b/tests/suite/Makefile.am
index 794a4bace..dae42a7ef 100644
--- a/tests/suite/Makefile.am
+++ b/tests/suite/Makefile.am
@@ -86,11 +86,10 @@ nodist_libecore_la_SOURCES = ecore/src/lib/ecore_anim.c			\
 
 
 nodist_check_SCRIPTS = eagain testsrn testcompat chain invalid-cert testrandom \
-	testpkcs11 testpkcs11.pkcs15 testpkcs11.softhsm testpkcs11.sc-hsm \
 	testrng test-ciphersuite-names
 
 TESTS = test-ciphersuite-names eagain testsrn testcompat chain invalid-cert \
-	testpkcs11 testrng test-ciphersuite-names
+	testrng test-ciphersuite-names
 
 if ENABLE_PKCS11
 TESTS += crl-test
diff --git a/tests/testpkcs11-certs/ca-tmpl b/tests/testpkcs11-certs/ca-tmpl
new file mode 100644
index 000000000..5bf462d1e
--- /dev/null
+++ b/tests/testpkcs11-certs/ca-tmpl
@@ -0,0 +1,67 @@
+# X.509 Certificate options
+#
+# DN options
+
+dn = "cn=CA,C=CZ"
+
+# The serial number of the certificate
+serial = 1
+
+# In how many days, counting from today, this certificate will expire.
+expiration_days = 2590
+
+# X.509 v3 extensions
+
+# A dnsname in case of a WWW server.
+#dns_name = "localhost"
+#dns_name = "www.morethanone.org"
+
+# An IP address in case of a server.
+#ip_address = "192.168.1.1"
+
+#dns_name = "www.evenmorethanone.org"
+
+# An email in case of a person
+email = "none@none.org"
+
+# An URL that has CRLs (certificate revocation lists)
+# available. Needed in CA certificates.
+crl_dist_points = "http://www.getcrl.crl/getcrl/"
+
+#email = "where@none.org"
+
+# Whether this is a CA certificate or not
+ca
+
+# Whether this certificate will be used for a TLS client
+#tls_www_client
+
+# Whether this certificate will be used for a TLS server
+#tls_www_server
+
+# Whether this certificate will be used to sign data (needed
+# in TLS DHE ciphersuites).
+signing_key
+
+# Whether this certificate will be used to encrypt data (needed
+# in TLS RSA ciphersuites). Note that it is preferred to use different
+# keys for encryption and signing.
+#encryption_key
+
+# Whether this key will be used to sign other certificates.
+cert_signing_key
+
+# Whether this key will be used to sign CRLs.
+crl_signing_key
+
+# Whether this key will be used to sign code.
+#code_signing_key
+
+# Whether this key will be used to sign OCSP data.
+ocsp_signing_key
+
+# Whether this key will be used for time stamping.
+#time_stamping_key
+
+# Whether this key will be used for IPsec IKE operations.
+#ipsec_ike_key
diff --git a/tests/testpkcs11-certs/ca.crt b/tests/testpkcs11-certs/ca.crt
new file mode 100644
index 000000000..e39ee41f7
--- /dev/null
+++ b/tests/testpkcs11-certs/ca.crt
@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----
+MIICUjCCAbugAwIBAgIBATANBgkqhkiG9w0BAQsFADAaMQswCQYDVQQDEwJDQTEL
+MAkGA1UEBhMCQ1owIhgPMjAxMzExMTAwODI0NTRaGA8yMDIwMTIxMzA4MjQ1NFow
+GjELMAkGA1UEAxMCQ0ExCzAJBgNVBAYTAkNaMIGfMA0GCSqGSIb3DQEBAQUAA4GN
+ADCBiQKBgQCoomr+kiRtx+/doF2FRSOxqBuuLbcpK5KwxtYk82L8MQzzJijfjS88
+4kCijlR6dqD0oDS70ngNogg2uIgn1SfLTTgXw/v6w/nMnMIYZ+ePrF5WD1qGeOAu
+R+qts4Y4rfb9Yb8sXIPdui7HelqimJaVeMxAYJsqRBSixDSpYbkEhwIDAQABo4Gj
+MIGgMA8GA1UdEwEB/wQFMAMBAf8wGAYDVR0RBBEwD4ENbm9uZUBub25lLm9yZzAT
+BgNVHSUEDDAKBggrBgEFBQcDCTAPBgNVHQ8BAf8EBQMDBwYAMB0GA1UdDgQWBBQS
+DtpREkBWrvQcbcyhsD0oYX4zATAuBgNVHR8EJzAlMCOgIaAfhh1odHRwOi8vd3d3
+LmdldGNybC5jcmwvZ2V0Y3JsLzANBgkqhkiG9w0BAQsFAAOBgQBzRzkYVGhl0ltc
+iVvXModMh9cb1TcUrc2nhfEh63u5ZF1/8MJPaMMLw3FZmGc5B8lNYOoWiSqK/Ark
+iO9chPwqRKWY8n52USgGDcUNRxbwCa2vOQg9cdSWIcdt18W5mtJ3hz+CDaT8ZH8t
+sVW/i5eG6O7o3rZGSwbcC1pgIWZqCw==
+-----END CERTIFICATE-----
diff --git a/tests/testpkcs11-certs/ca.key b/tests/testpkcs11-certs/ca.key
new file mode 100644
index 000000000..62f5bfae3
--- /dev/null
+++ b/tests/testpkcs11-certs/ca.key
@@ -0,0 +1,94 @@
+Public Key Info:
+	Public Key Algorithm: RSA
+	Key Security Level: Weak (1024 bits)
+
+modulus:
+	00:a8:a2:6a:fe:92:24:6d:c7:ef:dd:a0:5d:85:45:
+	23:b1:a8:1b:ae:2d:b7:29:2b:92:b0:c6:d6:24:f3:
+	62:fc:31:0c:f3:26:28:df:8d:2f:3c:e2:40:a2:8e:
+	54:7a:76:a0:f4:a0:34:bb:d2:78:0d:a2:08:36:b8:
+	88:27:d5:27:cb:4d:38:17:c3:fb:fa:c3:f9:cc:9c:
+	c2:18:67:e7:8f:ac:5e:56:0f:5a:86:78:e0:2e:47:
+	ea:ad:b3:86:38:ad:f6:fd:61:bf:2c:5c:83:dd:ba:
+	2e:c7:7a:5a:a2:98:96:95:78:cc:40:60:9b:2a:44:
+	14:a2:c4:34:a9:61:b9:04:87:
+
+public exponent:
+	01:00:01:
+
+private exponent:
+	08:f8:4a:b4:ab:d5:60:39:88:5a:c3:92:f5:e9:cd:
+	92:3f:9c:e9:50:e9:33:39:6c:1e:17:15:80:f5:a9:
+	48:3c:db:b1:7b:50:25:43:ff:45:3f:cb:ac:59:e1:
+	c8:79:d2:e9:f0:33:9d:e1:fe:1c:cb:87:a0:51:84:
+	7c:89:ec:09:e0:3d:c9:df:ca:43:d9:c1:79:3c:47:
+	f7:8e:71:bf:a5:6e:11:87:0d:d9:2e:5a:5d:a0:d3:
+	ba:5b:9c:23:db:33:54:5f:a2:2f:db:28:05:9d:07:
+	a4:d4:76:0e:ef:d1:f9:c3:f9:21:01:ad:06:4c:9d:
+	59:14:09:37:91:df:86:01:
+
+prime1:
+	00:d6:e8:07:49:7f:a6:6a:d7:f3:76:84:4b:a9:cb:
+	91:66:8a:c8:07:54:29:25:1d:e4:70:dd:2c:fd:ff:
+	dc:c6:0c:24:75:4f:a0:ca:82:e2:b6:3b:8b:f0:7b:
+	37:c3:97:be:6c:b3:5f:91:a6:c0:56:48:aa:aa:3a:
+	d9:12:24:b7:81:
+
+prime2:
+	00:c8:e1:50:40:9b:7e:34:9c:44:88:1e:16:4b:bf:
+	04:0f:a6:b0:2b:9d:2f:a2:84:29:96:54:35:69:68:
+	6f:a2:a7:2b:8a:de:e9:9e:0e:6f:b3:cf:d8:af:68:
+	33:52:a6:e4:b5:d1:21:d0:6b:d2:d2:a6:af:97:62:
+	44:fe:b8:00:07:
+
+coefficient:
+	75:16:b8:48:0b:61:9a:a9:78:b1:72:93:94:51:54:
+	c1:07:69:b8:b1:dc:61:4a:f5:ef:b7:9c:f5:07:74:
+	0d:8e:1a:a2:51:ea:00:91:ef:05:75:42:53:4d:6a:
+	e3:f5:de:07:a5:55:5f:8b:37:58:55:2b:43:ef:b2:
+	d0:38:a8:89:
+
+exp1:
+	00:c9:b9:60:e5:b7:e1:b1:56:e5:dc:70:d0:49:20:
+	a1:6a:3c:89:08:80:12:63:19:cd:0d:b8:3e:fc:69:
+	48:85:ca:6e:0a:83:e5:2d:52:70:96:98:0c:82:7e:
+	56:d8:cd:3e:5c:f0:7e:9b:cc:87:ac:36:67:a4:84:
+	ba:af:92:31:81:
+
+exp2:
+	65:0a:d8:78:36:fe:8b:6e:13:16:b8:b3:94:54:37:
+	b1:bb:b1:9f:ae:88:18:62:0c:1d:1e:ac:63:21:f2:
+	0d:49:b3:20:3e:32:1a:9b:be:5a:1e:f1:2a:81:ea:
+	56:e7:b5:e1:32:99:a4:a1:a7:c0:e7:b1:29:1f:77:
+	fe:fc:04:9f:
+
+
+Public Key ID: 12:0E:DA:51:12:40:56:AE:F4:1C:6D:CC:A1:B0:3D:28:61:7E:33:01
+Public key's random art:
++--[ RSA 1024]----+
+|.E*++.o          |
+|oo *.B .         |
+|..++O *          |
+| o.*oB .         |
+|  o + o S        |
+|       .         |
+|                 |
+|                 |
+|                 |
++-----------------+
+
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQCoomr+kiRtx+/doF2FRSOxqBuuLbcpK5KwxtYk82L8MQzzJijf
+jS884kCijlR6dqD0oDS70ngNogg2uIgn1SfLTTgXw/v6w/nMnMIYZ+ePrF5WD1qG
+eOAuR+qts4Y4rfb9Yb8sXIPdui7HelqimJaVeMxAYJsqRBSixDSpYbkEhwIDAQAB
+AoGACPhKtKvVYDmIWsOS9enNkj+c6VDpMzlsHhcVgPWpSDzbsXtQJUP/RT/LrFnh
+yHnS6fAzneH+HMuHoFGEfInsCeA9yd/KQ9nBeTxH945xv6VuEYcN2S5aXaDTuluc
+I9szVF+iL9soBZ0HpNR2Du/R+cP5IQGtBkydWRQJN5HfhgECQQDW6AdJf6Zq1/N2
+hEupy5FmisgHVCklHeRw3Sz9/9zGDCR1T6DKguK2O4vwezfDl75ss1+RpsBWSKqq
+OtkSJLeBAkEAyOFQQJt+NJxEiB4WS78ED6awK50vooQpllQ1aWhvoqcrit7png5v
+s8/Yr2gzUqbktdEh0GvS0qavl2JE/rgABwJBAMm5YOW34bFW5dxw0EkgoWo8iQiA
+EmMZzQ24PvxpSIXKbgqD5S1ScJaYDIJ+VtjNPlzwfpvMh6w2Z6SEuq+SMYECQGUK
+2Hg2/otuExa4s5RUN7G7sZ+uiBhiDB0erGMh8g1JsyA+Mhqbvloe8SqB6lbnteEy
+maShp8DnsSkfd/78BJ8CQHUWuEgLYZqpeLFyk5RRVMEHabix3GFK9e+3nPUHdA2O
+GqJR6gCR7wV1QlNNauP13gelVV+LN1hVK0PvstA4qIk=
+-----END RSA PRIVATE KEY-----
diff --git a/tests/testpkcs11-certs/client-tmpl b/tests/testpkcs11-certs/client-tmpl
new file mode 100644
index 000000000..a22eef84b
--- /dev/null
+++ b/tests/testpkcs11-certs/client-tmpl
@@ -0,0 +1,67 @@
+# X.509 Certificate options
+#
+# DN options
+
+dn = "cn=Client,C=CZ"
+
+# The serial number of the certificate
+serial = 3
+
+# In how many days, counting from today, this certificate will expire.
+expiration_days = 2590
+
+# X.509 v3 extensions
+
+# A dnsname in case of a WWW server.
+#dns_name = "localhost"
+#dns_name = "www.morethanone.org"
+
+# An IP address in case of a server.
+#ip_address = "192.168.1.1"
+
+#dns_name = "www.evenmorethanone.org"
+
+# An email in case of a person
+email = "none@none.org"
+
+# An URL that has CRLs (certificate revocation lists)
+# available. Needed in CA certificates.
+#crl_dist_points = "http://www.getcrl.crl/getcrl/"
+
+#email = "where@none.org"
+
+# Whether this is a CA certificate or not
+#ca
+
+# Whether this certificate will be used for a TLS client
+tls_www_client
+
+# Whether this certificate will be used for a TLS server
+#tls_www_server
+
+# Whether this certificate will be used to sign data (needed
+# in TLS DHE ciphersuites).
+signing_key
+
+# Whether this certificate will be used to encrypt data (needed
+# in TLS RSA ciphersuites). Note that it is preferred to use different
+# keys for encryption and signing.
+#encryption_key
+
+# Whether this key will be used to sign other certificates.
+#cert_signing_key
+
+# Whether this key will be used to sign CRLs.
+#crl_signing_key
+
+# Whether this key will be used to sign code.
+#code_signing_key
+
+# Whether this key will be used to sign OCSP data.
+#ocsp_signing_key
+
+# Whether this key will be used for time stamping.
+#time_stamping_key
+
+# Whether this key will be used for IPsec IKE operations.
+#ipsec_ike_key
diff --git a/tests/testpkcs11-certs/client.crt b/tests/testpkcs11-certs/client.crt
new file mode 100644
index 000000000..6f75590d2
--- /dev/null
+++ b/tests/testpkcs11-certs/client.crt
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICdDCCAd2gAwIBAgIBAzANBgkqhkiG9w0BAQsFADAaMQswCQYDVQQDEwJDQTEL
+MAkGA1UEBhMCQ1owIhgPMjAxMzExMTAwODI1MjdaGA8yMDIwMTIxMzA4MjUyN1ow
+HjEPMA0GA1UEAxMGQ2xpZW50MQswCQYDVQQGEwJDWjCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEAvQRIzvKyhr3tqmB4Pe+91DWSFayaNtcrDIT597bhxugVYW8o
+jB206kx5aknAMA3PQGYcGqkLrt+nsJcmOIXDZsC6P4zeOSsF1PPhDAoX3bkUr2lF
+MEt374eKdg1yvyhRxt4DOR6aD4gkC7fVtaYdgV6yXpJGMHV05LBIgQ7QtykCAwEA
+AaOBwTCBvjAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMBgGA1Ud
+EQQRMA+BDW5vbmVAbm9uZS5vcmcwDwYDVR0PAQH/BAUDAweAADAdBgNVHQ4EFgQU
+Dbinh11GaaJcTyOpmxPYuttsiGowHwYDVR0jBBgwFoAUEg7aURJAVq70HG3MobA9
+KGF+MwEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3d3dy5nZXRjcmwuY3JsL2dl
+dGNybC8wDQYJKoZIhvcNAQELBQADgYEAN/Henso+5zzuFQWTpJXlUsWtRQAFhRY3
+WVt3xtnyPs4pF/LKBp3Ov0GLGBkz5YlyJGFNESSyUviMsH7g7rJM8i7Bph6BQTE9
+XdqbZPc0opfms4EHjmlXj5HQ0f0yoxHnLk43CR+vmbn0JPuurnEKAwjznAJR8GxI
+R2MRyMxdGqs=
+-----END CERTIFICATE-----
diff --git a/tests/testpkcs11-certs/client.key b/tests/testpkcs11-certs/client.key
new file mode 100644
index 000000000..9277bdfd8
--- /dev/null
+++ b/tests/testpkcs11-certs/client.key
@@ -0,0 +1,94 @@
+Public Key Info:
+	Public Key Algorithm: RSA
+	Key Security Level: Weak (1024 bits)
+
+modulus:
+	00:bd:04:48:ce:f2:b2:86:bd:ed:aa:60:78:3d:ef:
+	bd:d4:35:92:15:ac:9a:36:d7:2b:0c:84:f9:f7:b6:
+	e1:c6:e8:15:61:6f:28:8c:1d:b4:ea:4c:79:6a:49:
+	c0:30:0d:cf:40:66:1c:1a:a9:0b:ae:df:a7:b0:97:
+	26:38:85:c3:66:c0:ba:3f:8c:de:39:2b:05:d4:f3:
+	e1:0c:0a:17:dd:b9:14:af:69:45:30:4b:77:ef:87:
+	8a:76:0d:72:bf:28:51:c6:de:03:39:1e:9a:0f:88:
+	24:0b:b7:d5:b5:a6:1d:81:5e:b2:5e:92:46:30:75:
+	74:e4:b0:48:81:0e:d0:b7:29:
+
+public exponent:
+	01:00:01:
+
+private exponent:
+	00:a5:eb:b1:e2:00:07:98:e1:f6:53:de:35:0e:e1:
+	79:78:63:c2:25:c6:8a:e4:e3:02:46:0e:20:c3:43:
+	45:73:ee:5c:7e:58:2e:76:b8:c9:0b:f7:2f:89:8e:
+	cd:e7:20:e8:32:36:b0:2a:f3:03:6f:71:a2:e9:0f:
+	f5:9c:1e:47:84:54:2b:67:12:e3:f4:20:80:7f:54:
+	81:63:f4:41:4a:6f:8f:89:e8:83:24:64:87:b5:2b:
+	5b:25:55:c5:b6:e8:1d:c9:a0:a9:68:0d:2d:1f:06:
+	ac:46:6a:96:93:96:16:24:fe:7f:e4:00:c7:bf:37:
+	fe:48:6f:3f:94:0b:36:9e:81:
+
+prime1:
+	00:dd:8b:ef:a9:f3:e9:7a:97:6f:50:2f:d4:93:ff:
+	0b:6d:52:b4:2c:64:d2:bb:6c:a7:ca:5d:5f:31:ba:
+	2c:f6:59:09:34:57:5f:3c:cd:f5:2b:a0:c7:7a:ac:
+	e2:20:64:a8:58:24:a3:02:c3:7f:7b:c5:7b:31:4e:
+	de:81:6b:48:f9:
+
+prime2:
+	00:da:69:4a:53:be:3d:36:07:58:a7:8e:58:4e:cd:
+	90:cd:72:54:7c:40:89:ab:fd:3a:8b:6d:d0:9c:b0:
+	00:7f:11:6a:b7:f2:4e:e0:81:8b:23:09:3f:c4:6f:
+	f7:6d:06:b1:c8:83:63:87:72:c7:43:01:24:5d:2d:
+	88:7f:b9:1b:b1:
+
+coefficient:
+	30:19:e0:d7:bd:0f:0d:96:b0:65:64:00:82:2a:9d:
+	6c:52:a6:89:a6:db:89:e3:7f:10:c3:3b:5b:97:73:
+	ea:13:af:fc:4c:3e:72:5e:da:cb:b7:d4:b6:2c:d0:
+	05:c3:58:bb:2d:59:2c:50:1f:08:6d:03:53:ba:ec:
+	15:ec:b6:08:
+
+exp1:
+	00:d0:6d:4e:54:3d:bc:72:30:f5:f0:22:8f:83:8c:
+	76:5b:ab:6b:06:38:f4:68:8f:98:6b:b1:dc:55:14:
+	2a:28:b9:2b:07:ab:0b:56:51:0d:4e:b6:3b:f5:15:
+	a0:c7:88:eb:37:c1:7f:fa:a1:a1:d5:f7:bc:26:6f:
+	64:b5:ad:11:41:
+
+exp2:
+	2a:a6:b1:0b:15:75:62:9d:a0:a4:67:d9:ba:d9:cd:
+	d3:30:e6:6a:b5:37:ad:4c:70:28:56:33:8c:c5:99:
+	f3:36:75:7e:a2:64:e0:d6:ab:53:16:35:4b:a9:09:
+	ca:52:aa:59:1b:bf:4d:ee:0e:17:79:9b:9e:4e:8b:
+	ff:55:28:a1:
+
+
+Public Key ID: 0D:B8:A7:87:5D:46:69:A2:5C:4F:23:A9:9B:13:D8:BA:DB:6C:88:6A
+Public key's random art:
++--[ RSA 1024]----+
+|                 |
+|       . . .     |
+|      . * *      |
+|     + = X .     |
+|    . B S =      |
+|     . O o       |
+|   ...* o        |
+| E. .+.o         |
+|o.  ooo          |
++-----------------+
+
+-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQC9BEjO8rKGve2qYHg9773UNZIVrJo21ysMhPn3tuHG6BVhbyiM
+HbTqTHlqScAwDc9AZhwaqQuu36ewlyY4hcNmwLo/jN45KwXU8+EMChfduRSvaUUw
+S3fvh4p2DXK/KFHG3gM5HpoPiCQLt9W1ph2BXrJekkYwdXTksEiBDtC3KQIDAQAB
+AoGBAKXrseIAB5jh9lPeNQ7heXhjwiXGiuTjAkYOIMNDRXPuXH5YLna4yQv3L4mO
+zecg6DI2sCrzA29xoukP9ZweR4RUK2cS4/QggH9UgWP0QUpvj4nogyRkh7UrWyVV
+xbboHcmgqWgNLR8GrEZqlpOWFiT+f+QAx783/khvP5QLNp6BAkEA3YvvqfPpepdv
+UC/Uk/8LbVK0LGTSu2ynyl1fMbos9lkJNFdfPM31K6DHeqziIGSoWCSjAsN/e8V7
+MU7egWtI+QJBANppSlO+PTYHWKeOWE7NkM1yVHxAiav9Oott0JywAH8RarfyTuCB
+iyMJP8Rv920GsciDY4dyx0MBJF0tiH+5G7ECQQDQbU5UPbxyMPXwIo+DjHZbq2sG
+OPRoj5hrsdxVFCoouSsHqwtWUQ1Otjv1FaDHiOs3wX/6oaHV97wmb2S1rRFBAkAq
+prELFXVinaCkZ9m62c3TMOZqtTetTHAoVjOMxZnzNnV+omTg1qtTFjVLqQnKUqpZ
+G79N7g4XeZueTov/VSihAkAwGeDXvQ8NlrBlZACCKp1sUqaJptuJ438Qwztbl3Pq
+E6/8TD5yXtrLt9S2LNAFw1i7LVksUB8IbQNTuuwV7LYI
+-----END RSA PRIVATE KEY-----
diff --git a/tests/testpkcs11-certs/server-tmpl b/tests/testpkcs11-certs/server-tmpl
new file mode 100644
index 000000000..23103b4a9
--- /dev/null
+++ b/tests/testpkcs11-certs/server-tmpl
@@ -0,0 +1,67 @@
+# X.509 Certificate options
+#
+# DN options
+
+dn = "cn=Server,C=CZ"
+
+# The serial number of the certificate
+serial = 2
+
+# In how many days, counting from today, this certificate will expire.
+expiration_days = 2590
+
+# X.509 v3 extensions
+
+# A dnsname in case of a WWW server.
+dns_name = "localhost"
+#dns_name = "www.morethanone.org"
+
+# An IP address in case of a server.
+ip_address = "127.0.0.1"
+
+#dns_name = "www.evenmorethanone.org"
+
+# An email in case of a person
+email = "none@none.org"
+
+# An URL that has CRLs (certificate revocation lists)
+# available. Needed in CA certificates.
+#crl_dist_points = "http://www.getcrl.crl/getcrl/"
+
+#email = "where@none.org"
+
+# Whether this is a CA certificate or not
+#ca
+
+# Whether this certificate will be used for a TLS client
+#tls_www_client
+
+# Whether this certificate will be used for a TLS server
+tls_www_server
+
+# Whether this certificate will be used to sign data (needed
+# in TLS DHE ciphersuites).
+signing_key
+
+# Whether this certificate will be used to encrypt data (needed
+# in TLS RSA ciphersuites). Note that it is preferred to use different
+# keys for encryption and signing.
+encryption_key
+
+# Whether this key will be used to sign other certificates.
+#cert_signing_key
+
+# Whether this key will be used to sign CRLs.
+#crl_signing_key
+
+# Whether this key will be used to sign code.
+#code_signing_key
+
+# Whether this key will be used to sign OCSP data.
+#ocsp_signing_key
+
+# Whether this key will be used for time stamping.
+#time_stamping_key
+
+# Whether this key will be used for IPsec IKE operations.
+#ipsec_ike_key
diff --git a/tests/testpkcs11-certs/server.crt b/tests/testpkcs11-certs/server.crt
new file mode 100644
index 000000000..694a0101f
--- /dev/null
+++ b/tests/testpkcs11-certs/server.crt
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICdjCCAd+gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAaMQswCQYDVQQDEwJDQTEL
+MAkGA1UEBhMCQ1owIhgPMjAxMzExMTAwODI1MDJaGA8yMDIwMTIxMzA4MjUwMlow
+HjEPMA0GA1UEAxMGU2VydmVyMQswCQYDVQQGEwJDWjCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEApf9FBAZadRuU0AGrH4xgNh5V5tFDErTba2bF8b7USLRUzETm
++qBW87I6QXWDFsZlvyyzrpINmpbG3UNr3cVLgT7DLC2ct5nZFT4j25BYswcr0V5C
+00BAz6NUcuTzY0e0iN+H80H/mUr3Xu5r9wJca1LGTspBF1NOTNoAunlSm3cCAwEA
+AaOBwzCBwDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAA
+ATATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQW
+BBSsHXo5y3IXlGZsdERzQJFEwKBDfTAfBgNVHSMEGDAWgBQSDtpREkBWrvQcbcyh
+sD0oYX4zATAuBgNVHR8EJzAlMCOgIaAfhh1odHRwOi8vd3d3LmdldGNybC5jcmwv
+Z2V0Y3JsLzANBgkqhkiG9w0BAQsFAAOBgQBG1omwPssQQPTLd4WeCQyuM/Yj1kOO
+VwFOATVs2+XELAGg6GVrSS302+JKdW51j+11NpIMgJfgaeRdZkgBNR4uOi1okOQh
+Asm8TC3ex3v1rxZdunp0wBQ/H/ox4zMM5Ds8ITtQNeUwXqUj3tPorTWFEsNegTnY
+WmV1jslH8fZ4Fg==
+-----END CERTIFICATE-----
diff --git a/tests/testpkcs11-certs/server.key b/tests/testpkcs11-certs/server.key
new file mode 100644
index 000000000..56e48735a
--- /dev/null
+++ b/tests/testpkcs11-certs/server.key
@@ -0,0 +1,94 @@
+Public Key Info:
+	Public Key Algorithm: RSA
+	Key Security Level: Weak (1024 bits)
+
+modulus:
+	00:a5:ff:45:04:06:5a:75:1b:94:d0:01:ab:1f:8c:
+	60:36:1e:55:e6:d1:43:12:b4:db:6b:66:c5:f1:be:
+	d4:48:b4:54:cc:44:e6:fa:a0:56:f3:b2:3a:41:75:
+	83:16:c6:65:bf:2c:b3:ae:92:0d:9a:96:c6:dd:43:
+	6b:dd:c5:4b:81:3e:c3:2c:2d:9c:b7:99:d9:15:3e:
+	23:db:90:58:b3:07:2b:d1:5e:42:d3:40:40:cf:a3:
+	54:72:e4:f3:63:47:b4:88:df:87:f3:41:ff:99:4a:
+	f7:5e:ee:6b:f7:02:5c:6b:52:c6:4e:ca:41:17:53:
+	4e:4c:da:00:ba:79:52:9b:77:
+
+public exponent:
+	01:00:01:
+
+private exponent:
+	55:76:38:45:1b:34:45:28:9f:13:fc:57:ea:d5:2d:
+	cf:8f:0c:b0:da:3a:0b:0e:7c:0d:2e:8b:68:ab:d3:
+	c5:5e:ba:6d:b4:67:aa:cf:14:15:41:44:46:e1:46:
+	4d:5a:75:95:d8:60:e5:d6:a2:14:5d:de:22:9a:8c:
+	95:4f:f7:4f:cd:eb:65:a0:29:35:b1:16:b7:c2:74:
+	f1:a4:45:43:6c:77:59:37:b3:cb:43:60:80:29:5e:
+	b6:99:60:9a:12:4d:2b:54:2e:c3:3a:76:96:7d:72:
+	b1:72:24:f1:2a:2d:ff:99:92:1e:bb:55:f1:58:6e:
+	64:08:36:26:4b:b2:c6:99:
+
+prime1:
+	00:c7:65:44:0f:4e:6b:51:cd:d4:0b:84:9c:a9:30:
+	1b:7b:6d:9a:ca:f7:27:8d:8f:b5:05:81:b8:0d:d2:
+	a2:b3:e3:ab:bb:04:a1:8d:ec:dc:65:38:99:e9:e1:
+	4f:70:47:79:8d:e6:3a:f0:9f:7b:3b:aa:bd:80:1d:
+	4d:0d:2a:00:7d:
+
+prime2:
+	00:d5:1e:d4:82:40:de:a6:ce:1a:59:93:b8:51:c6:
+	55:15:7f:83:d0:11:ac:a1:44:0a:95:f0:e5:96:03:
+	53:5e:2c:27:eb:63:5f:b7:1c:06:64:fb:35:c9:a3:
+	a1:1a:fb:f2:3c:31:a1:51:58:40:5e:24:28:dd:ba:
+	dc:c4:14:22:03:
+
+coefficient:
+	00:9c:b5:66:d6:6d:93:93:da:0f:15:96:48:07:c6:
+	4a:eb:ae:da:2a:fc:d8:b3:03:cb:5e:5e:10:9e:7f:
+	e8:49:96:db:70:6b:ef:d7:5a:4a:a4:f5:2a:da:89:
+	39:b4:51:09:64:4c:75:92:57:ee:4f:9e:4d:55:f9:
+	d0:34:0e:6f:43:
+
+exp1:
+	2a:3c:5f:10:46:f2:20:9f:d2:bc:a5:d8:71:56:09:
+	5c:39:b9:42:28:dc:2d:f6:34:c7:f7:d4:3e:c9:51:
+	41:7d:86:50:d5:08:4b:81:d2:a5:76:39:d3:fa:af:
+	d2:fe:b0:d6:c7:df:d0:3c:57:e4:29:a4:7e:50:b6:
+	93:85:44:19:
+
+exp2:
+	1a:1b:38:b4:eb:f5:5a:41:8d:00:c4:13:a4:10:c3:
+	83:6a:a7:5e:e9:8b:58:05:d9:b6:1c:58:43:54:0c:
+	f6:50:3a:63:9f:3c:ae:55:84:83:02:32:c8:8c:7e:
+	c3:ab:71:34:e6:6f:78:63:73:1f:15:16:dc:72:73:
+	70:a1:76:b9:
+
+
+Public Key ID: AC:1D:7A:39:CB:72:17:94:66:6C:74:44:73:40:91:44:C0:A0:43:7D
+Public key's random art:
++--[ RSA 1024]----+
+|      ...o.BX+.  |
+|     . .. E oo   |
+|      o  + o     |
+|       o  B      |
+|        S=       |
+|       + o.      |
+|      o =  .     |
+|      .o.o.      |
+|       oo.       |
++-----------------+
+
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQCl/0UEBlp1G5TQAasfjGA2HlXm0UMStNtrZsXxvtRItFTMROb6
+oFbzsjpBdYMWxmW/LLOukg2alsbdQ2vdxUuBPsMsLZy3mdkVPiPbkFizByvRXkLT
+QEDPo1Ry5PNjR7SI34fzQf+ZSvde7mv3AlxrUsZOykEXU05M2gC6eVKbdwIDAQAB
+AoGAVXY4RRs0RSifE/xX6tUtz48MsNo6Cw58DS6LaKvTxV66bbRnqs8UFUFERuFG
+TVp1ldhg5daiFF3eIpqMlU/3T83rZaApNbEWt8J08aRFQ2x3WTezy0NggCletplg
+mhJNK1Quwzp2ln1ysXIk8Sot/5mSHrtV8VhuZAg2JkuyxpkCQQDHZUQPTmtRzdQL
+hJypMBt7bZrK9yeNj7UFgbgN0qKz46u7BKGN7NxlOJnp4U9wR3mN5jrwn3s7qr2A
+HU0NKgB9AkEA1R7UgkDeps4aWZO4UcZVFX+D0BGsoUQKlfDllgNTXiwn62NftxwG
+ZPs1yaOhGvvyPDGhUVhAXiQo3brcxBQiAwJAKjxfEEbyIJ/SvKXYcVYJXDm5Qijc
+LfY0x/fUPslRQX2GUNUIS4HSpXY50/qv0v6w1sff0DxX5CmkflC2k4VEGQJAGhs4
+tOv1WkGNAMQTpBDDg2qnXumLWAXZthxYQ1QM9lA6Y588rlWEgwIyyIx+w6txNOZv
+eGNzHxUW3HJzcKF2uQJBAJy1ZtZtk5PaDxWWSAfGSuuu2ir82LMDy15eEJ5/6EmW
+23Br79daSqT1KtqJObRRCWRMdZJX7k+eTVX50DQOb0M=
+-----END RSA PRIVATE KEY-----
diff --git a/tests/testpkcs11.pkcs15 b/tests/testpkcs11.pkcs15
new file mode 100644
index 000000000..565282a31
--- /dev/null
+++ b/tests/testpkcs11.pkcs15
@@ -0,0 +1,45 @@
+#!/bin/sh
+
+# Copyright (C) 2013 Nikos Mavrogiannopoulos
+#
+# This file is part of GnuTLS.
+#
+# GnuTLS is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# GnuTLS is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GnuTLS; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+
+init_card () {
+	PIN="$1"
+	PUK="$2"
+
+	echo -n "* Erasing smart card... "
+	pkcs15-init -E >"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		cat "${TMPFILE}"
+		exit_error
+	fi
+
+	echo -n "* Initializing smart card... "
+	pkcs15-init --create-pkcs15 --profile pkcs15+onepin --use-default-transport-key --so-pin "${PIN}" --pin "${PIN}" --puk "${PUK}" --label "GnuTLS-Test" >"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		cat "${TMPFILE}"
+		exit_error
+	fi
+}
diff --git a/tests/testpkcs11.sc-hsm b/tests/testpkcs11.sc-hsm
new file mode 100644
index 000000000..f3eab685f
--- /dev/null
+++ b/tests/testpkcs11.sc-hsm
@@ -0,0 +1,50 @@
+#!/bin/sh
+
+# Copyright (C) 2013 Nikos Mavrogiannopoulos
+#
+# This file is part of GnuTLS.
+#
+# GnuTLS is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# GnuTLS is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GnuTLS; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+
+init_card () {
+	PIN="$1"
+	PUK=3537363231383830
+	export GNUTLS_SO_PIN="${PUK}"
+
+	echo -n "* Erasing smart card... "
+	sc-hsm-tool --initialize --so-pin "${PUK}" --pin "${PIN}" --label=GnuTLS-Test >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit_error
+	fi
+
+	echo -n "* Initializing smart card... "
+	TOKEN=`${P11TOOL} ${ADDITIONAL_PARAM} --list-tokens pkcs11:token=Nikos|grep URL|grep token=GnuTLS-Test|sed 's/\s*URL\: //g'`
+	if test -z "${TOKEN}"; then
+		echo "Could not find initialized card"
+		exit_error
+	fi
+
+	${P11TOOL} ${ADDITIONAL_PARAM} --initialize "${TOKEN}" --set-so-pin "${PUK}" --set-pin "${PIN}" --label "GnuTLS-Test" >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit_error
+	fi
+}
diff --git a/tests/testpkcs11.sh b/tests/testpkcs11.sh
new file mode 100755
index 000000000..e8cdcd30d
--- /dev/null
+++ b/tests/testpkcs11.sh
@@ -0,0 +1,938 @@
+#!/bin/sh
+
+# Copyright (C) 2013 Nikos Mavrogiannopoulos
+#
+# This file is part of GnuTLS.
+#
+# GnuTLS is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# GnuTLS is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GnuTLS; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+srcdir="${srcdir:-.}"
+P11TOOL="${P11TOOL:-../src/p11tool${EXEEXT}}"
+CERTTOOL="${CERTTOOL:-../src/certtool${EXEEXT}}"
+DIFF="${DIFF:-diff -b -B}"
+SERV="${SERV:-../src/gnutls-serv${EXEEXT}}"
+CLI="${CLI:-../src/gnutls-cli${EXEEXT}}"
+RETCODE=0
+
+if test "${GNUTLS_FORCE_FIPS_MODE}" = 1;then
+	echo "Cannot run in FIPS140-2 mode"
+	exit 77
+fi
+
+if ! test -x "${P11TOOL}"; then
+	exit 77
+fi
+
+if ! test -x "${CERTTOOL}"; then
+	exit 77
+fi
+
+if ! test -x "${SERV}"; then
+	exit 77
+fi
+
+if ! test -x "${CLI}"; then
+	exit 77
+fi
+
+if ! test -z "${VALGRIND}"; then
+	VALGRIND="${LIBTOOL:-libtool} --mode=execute valgrind --leak-check=full"
+fi
+
+TMPFILE="testpkcs11.debug.log"
+CERTTOOL_PARAM="--stdout-info"
+
+if test "${WINDIR}" != ""; then
+	exit 77
+fi 
+
+ASAN_OPTIONS="detect_leaks=0"
+export ASAN_OPTIONS
+
+P11TOOL="${VALGRIND} ${P11TOOL} --batch"
+SERV="${SERV} -q"
+
+. ${srcdir}/scripts/common.sh
+
+rm -f "${TMPFILE}"
+
+exit_error () {
+	echo "check ${TMPFILE} for additional debugging information"
+	echo ""
+	echo ""
+	tail "${TMPFILE}"
+	exit 1
+}
+
+# $1: token
+# $2: PIN
+# $3: filename
+# ${srcdir}/testpkcs11-certs/client.key
+write_privkey () {
+	export GNUTLS_PIN="$2"
+	filename="$3"
+	token="$1"
+
+	echo -n "* Writing a client private key... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label gnutls-client2 --load-privkey "${filename}" "${token}" >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit_error
+	fi
+
+	echo -n "* Checking whether object was marked private... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --list-privkeys "${token};object=gnutls-client2" 2>/dev/null | grep 'Label\:' >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo "private object was public"
+		exit_error
+	fi
+	echo ok
+
+	echo -n "* Checking whether object was marked sensitive... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-privkeys "${token};object=gnutls-client2" | grep "CKA_SENSITIVE" >/dev/null 2>&1
+	if test $? != 0; then
+		echo "private object was not sensitive"
+		exit_error
+	fi
+	echo ok
+}
+
+# $1: token
+# $2: PIN
+# $3: filename
+write_serv_privkey () {
+	export GNUTLS_PIN="$2"
+	filename="$3"
+	token="$1"
+
+	echo -n "* Writing the server private key... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label serv-key --load-privkey "${filename}" "${token}" >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit_error
+	fi
+
+}
+
+# $1: token
+# $2: PIN
+# $3: filename
+write_serv_pubkey () {
+	export GNUTLS_PIN="$2"
+	filename="$3"
+	token="$1"
+
+	echo -n "* Writing the server public key... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label serv-pubkey --load-pubkey "${filename}" "${token}" >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit_error
+	fi
+
+	#verify it being written
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all "${token};object=serv-pubkey;type=public" >>"${TMPFILE}" 2>&1
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all "${token};object=serv-pubkey;type=public"|grep "Public key" >/dev/null 2>&1
+	if test $? != 0;then
+		echo "Cannot verify the existence of the written pubkey"
+		exit_error
+	fi
+}
+
+# $1: token
+# $2: PIN
+# $3: filename
+write_serv_cert () {
+	export GNUTLS_PIN="$2"
+	filename="$3"
+	token="$1"
+
+	echo -n "* Writing the server certificate... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --no-mark-private --label serv-cert --load-certificate "${filename}" "${token}" >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit_error
+	fi
+
+}
+
+# $1: token
+# $2: PIN
+test_delete_cert () {
+	export GNUTLS_PIN="$2"
+	filename="$3"
+	token="$1"
+
+	echo -n "* Deleting the server certificate... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --delete "${token};object=serv-cert;object-type=cert" >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit_error
+	fi
+}
+
+# $1: token
+# $2: PIN
+# $3: bits
+generate_rsa_privkey () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+	bits="$3"
+
+	echo -n "* Generating RSA private key ("${bits}")... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --id 000102030405 --label gnutls-client --generate-rsa --bits "${bits}" "${token}" --outfile tmp-client.pub >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit 1
+	fi
+
+	echo -n "* Checking whether generated private key was marked private... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --list-privkeys "${token};object=gnutls-client" 2>/dev/null | grep 'Label\:' >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo "private object was public"
+		exit_error
+	fi
+	echo ok
+
+	echo -n "* Checking whether private key was marked sensitive... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-privkeys "${token};object=gnutls-client" | grep "CKA_SENSITIVE" >/dev/null 2>&1
+	if test $? != 0; then
+		echo "private object was not sensitive"
+		exit_error
+	fi
+	echo ok
+}
+
+# $1: token
+# $2: PIN
+# $3: bits
+generate_temp_rsa_privkey () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+	bits="$3"
+
+	echo -n "* Generating RSA private key ("${bits}")... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --label temp-rsa-"${bits}" --generate-rsa --bits "${bits}" "${token}" --outfile tmp-client.pub >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit 1
+	fi
+
+#  if test ${RETCODE} = 0; then
+#    echo -n "* Testing private key flags... "
+#    ${P11TOOL} ${ADDITIONAL_PARAM} --login --list-keys "${token};object=gnutls-client2;object-type=private" >tmp-client-2.pub 2>>"${TMPFILE}"
+#    if test $? != 0; then
+#      echo failed
+#      exit_error
+#    fi
+#
+#    grep CKA_WRAP tmp-client-2.pub >>"${TMPFILE}" 2>&1
+#    if test $? != 0; then
+#      echo "failed (no CKA_WRAP)"
+#      exit_error
+#    else
+#      echo ok
+#    fi
+#  fi
+}
+
+generate_temp_dsa_privkey () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+	bits="$3"
+
+	echo -n "* Generating DSA private key ("${bits}")... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --label temp-dsa-"${bits}" --generate-dsa --bits "${bits}" "${token}" --outfile tmp-client.pub >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit 1
+	fi
+}
+
+# $1: token
+# $2: PIN
+delete_temp_privkey () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+	type="$3"
+
+	test "${RETCODE}" = "0" || return
+
+	echo -n "* Deleting private key... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --delete "${token};object=temp-${type};object-type=private" >>"${TMPFILE}" 2>&1
+
+	if test $? != 0; then
+		echo failed
+		RETCODE=1
+		return
+	fi
+
+	RETCODE=0
+	echo ok
+}
+
+# $1: token
+# $2: PIN
+# $3: bits
+export_pubkey_of_privkey () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+	bits="$3"
+
+	echo -n "* Exporting public key of generated private key... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --export-pubkey "${token};object=gnutls-client;object-type=private" --outfile tmp-client-2.pub >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo failed
+		exit 1
+	fi
+
+	${DIFF} tmp-client.pub tmp-client-2.pub
+	if test $? != 0; then
+		echo keys differ
+		exit 1
+	fi
+
+	echo ok
+}
+
+# $1: token
+# $2: PIN
+change_id_of_privkey () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+
+	echo -n "* Change the CKA_ID of generated private key... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --set-id "01a1b103" "${token};object=gnutls-client;id=%00%01%02%03%04%05;object-type=private" >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo failed
+		exit_error
+	fi
+
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-privkeys "${token};object=gnutls-client;object-type=private;id=%01%a1%b1%03" 2>&1 | grep 'ID: 01:a1:b1:03' >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo "ID didn't change"
+		exit_error
+	fi
+
+	echo ok
+}
+
+# $1: token
+# $2: PIN
+change_label_of_privkey () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+
+	echo -n "* Change the CKA_LABEL of generated private key... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --set-label "new-label" "${token};object=gnutls-client;object-type=private" >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo failed
+		exit_error
+	fi
+
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-privkeys "${token};object=new-label;object-type=private" 2>&1 |grep 'Label: new-label' >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo "label didn't change"
+		exit_error
+	fi
+
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --set-label "gnutls-client" "${token};object=new-label;object-type=private" >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo failed
+		exit_error
+	fi
+
+	echo ok
+}
+
+# $1: token
+# $2: PIN
+# $3: bits
+generate_temp_ecc_privkey () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+	bits="$3"
+
+	echo -n "* Generating ECC private key (${bits})... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --label "temp-ecc-${bits}" --generate-ecc --bits "${bits}" "${token}" --outfile tmp-client.pub >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit 1
+	fi
+}
+
+# $1: token
+# $2: PIN
+# $3: bits
+# The same as generate_temp_ecc_privkey but no explicit login is performed.
+# p11tool should detect that login is required for the operation.
+generate_temp_ecc_privkey_no_login () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+	bits="$3"
+
+	echo -n "* Generating ECC private key without --login (${bits})... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --label "temp-ecc-no-${bits}" --generate-ecc --bits "${bits}" "${token}" --outfile tmp-client.pub >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit 1
+	fi
+}
+
+# $1: name
+# $2: label prefix
+# $3: generate option
+# $4: token
+# $5: PIN
+# $6: bits
+import_privkey () {
+	export GNUTLS_PIN="$5"
+	name="$1"
+	prefix="$2"
+	gen_option="$3"
+	token="$4"
+	bits="$6"
+
+	outfile="tmp-${prefix}-${bits}.pem"
+
+	echo -n "* Importing ${name} private key (${bits})... "
+
+	"${CERTTOOL}" ${CERTTOOL_PARAM} --generate-privkey "${gen_option}" --pkcs8 --password= --outfile "${outfile}" >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo failed
+		exit 1
+	fi
+
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label "${prefix}-${bits}" --load-privkey "${outfile}" "${token}" >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit 1
+	fi
+}
+
+import_temp_rsa_privkey () {
+	import_privkey RSA temp-rsa --rsa $@
+}
+
+import_temp_ecc_privkey () {
+	import_privkey ECC temp-ecc --ecc $@
+}
+
+import_temp_dsa_privkey () {
+	import_privkey DSA temp-dsa --dsa $@
+}
+
+# $1: token
+# $2: PIN
+# $3: cakey: ${srcdir}/testpkcs11-certs/ca.key
+# $4: cacert: ${srcdir}/testpkcs11-certs/ca.crt
+#
+# Tests writing a certificate which corresponds to the given key,
+# as well as the CA certificate, and tries to export them.
+write_certificate_test () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+	cakey="$3"
+	cacert="$4"
+	pubkey="$5"
+
+	echo -n "* Generating client certificate... "
+	"${CERTTOOL}" ${CERTTOOL_PARAM} ${ADDITIONAL_PARAM}  --generate-certificate --load-ca-privkey "${cakey}"  --load-ca-certificate "${cacert}"  \
+	--template ${srcdir}/testpkcs11-certs/client-tmpl --load-privkey "${token};object=gnutls-client;object-type=private" \
+	--load-pubkey "$pubkey" --outfile tmp-client.crt >>"${TMPFILE}" 2>&1
+
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit_error
+	fi
+
+	echo -n "* Writing client certificate... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --id "01a1b103" --label gnutls-client --load-certificate tmp-client.crt "${token}" >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit_error
+	fi
+
+	echo -n "* Checking whether ID was correctly set... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-certs "${token};object=gnutls-client;object-type=private;id=%01%a1%b1%03" 2>&1 | grep 'ID: 01:a1:b1:03' >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo "ID was not set on copy"
+		exit_error
+	fi
+	echo ok
+
+	if test -n "${BROKEN_SOFTHSM2}";then
+		return
+	fi
+
+	echo -n "* Checking whether object was public... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --list-all-certs "${token};object=gnutls-client;id=%01%a1%b1%03" 2>&1 | grep 'ID: 01:a1:b1:03' >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo "certificate object was not public"
+		exit_error
+	fi
+	echo ok
+
+	if test -n "${BROKEN_SOFTHSM2}";then
+		return
+	fi
+
+	echo -n "* Writing certificate of client's CA... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --mark-trusted --mark-ca --write --label gnutls-ca --load-certificate "${cacert}" "${token}" >>"${TMPFILE}" 2>&1
+	ret=$?
+	if test ${ret} != 0; then
+		echo "Failed with PIN, trying to write with so PIN" >>"${TMPFILE}"
+		${P11TOOL} ${ADDITIONAL_PARAM} --so-login --mark-ca --write --mark-trusted --label gnutls-ca --load-certificate "${cacert}" "${token}" >>"${TMPFILE}" 2>&1
+		ret=$?
+	fi
+
+	if test ${ret} = 0; then
+		echo ok
+	else
+		echo failed
+		exit_error
+	fi
+
+	echo -n "* Testing certificate flags... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all-certs "${token};object=gnutls-ca;object-type=cert" |grep Flags|head -n 1 >tmp-client-2.pub 2>>"${TMPFILE}"
+	if test $? != 0; then
+		echo failed
+		exit_error
+	fi
+
+	grep CKA_TRUSTED tmp-client-2.pub >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo "failed (no CKA_TRUSTED)"
+		#exit_error
+	fi
+
+	grep "CKA_CERTIFICATE_CATEGORY=CA" tmp-client-2.pub >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo "failed (no CKA_CERTIFICATE_CATEGORY=CA)"
+		#exit_error
+	fi
+
+	echo ok
+
+
+	echo -n "* Trying to obtain back the cert... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --export "${token};object=gnutls-ca;object-type=cert" --outfile crt1.tmp >>"${TMPFILE}" 2>&1
+	${DIFF} crt1.tmp "${srcdir}/testpkcs11-certs/ca.crt"
+	if test $? != 0; then
+		echo "failed. Exported certificate differs (crt1.tmp)!"
+		exit_error
+	fi
+	rm -f crt1.tmp
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit_error
+	fi
+
+	echo -n "* Trying to obtain the full chain... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --export-chain "${token};object=gnutls-client;object-type=cert"|"${CERTTOOL}" ${CERTTOOL_PARAM}  -i --outfile crt1.tmp >>"${TMPFILE}" 2>&1
+
+	cat tmp-client.crt ${srcdir}/testpkcs11-certs/ca.crt|"${CERTTOOL}" ${CERTTOOL_PARAM}  -i >crt2.tmp
+	${DIFF} crt1.tmp crt2.tmp
+	if test $? != 0; then
+		echo "failed. Exported certificate chain differs!"
+		exit_error
+	fi
+	rm -f crt1.tmp crt2.tmp
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit_error
+	fi
+}
+
+# $1: token
+# $2: PIN
+# $3: cakey: ${srcdir}/testpkcs11-certs/ca.key
+# $4: cacert: ${srcdir}/testpkcs11-certs/ca.crt
+#
+# Tests writing a certificate which corresponds to the given key,
+# and verifies whether the ID is the same. Should utilize the
+# ID of the public key.
+write_certificate_id_test_rsa () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+	cakey="$3"
+	cacert="$4"
+
+	echo -n "* Generating RSA private key on HSM... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --label xxx1-rsa --generate-rsa --bits 1024 "${token}" >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit 1
+	fi
+
+	echo -n "* Checking whether right ID is set on copy... "
+	"${CERTTOOL}" ${CERTTOOL_PARAM} ${ADDITIONAL_PARAM}  --generate-certificate --load-ca-privkey "${cakey}"  --load-ca-certificate "${cacert}"  \
+	--template ${srcdir}/testpkcs11-certs/client-tmpl --load-privkey "${token};object=xxx1-rsa;object-type=private" \
+	--outfile tmp-client.crt >>"${TMPFILE}" 2>&1
+
+	if test $? != 0; then
+		echo failed
+		exit_error
+	fi
+
+	id=$(${P11TOOL} ${ADDITIONAL_PARAM} --list-all "${token};object=xxx1-rsa;object-type=public" 2>&1 | grep 'ID: '|sed -e 's/ID://' -e 's/^[ \t]*//' -e 's/[ \t]*$//')
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label tmp-xxx1-rsa --load-certificate tmp-client.crt "${token}" >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo failed
+		exit_error
+	fi
+
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-certs "${token};object=tmp-xxx1-rsa;object-type=cert" 2>&1 | grep "ID: ${id}" >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo "ID '$id' was not set on copy"
+		exit_error
+	fi
+	echo ok
+}
+
+# $1: token
+# $2: PIN
+# $3: cakey: ${srcdir}/testpkcs11-certs/ca.key
+# $4: cacert: ${srcdir}/testpkcs11-certs/ca.crt
+#
+# Tests writing a certificate which corresponds to the given key,
+# and verifies whether the ID is the same. Should utilize the
+# ID of the private key.
+write_certificate_id_test_rsa2 () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+	cakey="$3"
+	cacert="$4"
+	tmpkey="key.$$.tmp"
+
+	echo -n "* Generating RSA private key... "
+	${CERTTOOL} ${ADDITIONAL_PARAM} --generate-privkey --bits 1024 --outfile ${tmpkey} >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit 1
+	fi
+
+	echo -n "* Checking whether right ID is set on copy... "
+	"${CERTTOOL}" ${CERTTOOL_PARAM} ${ADDITIONAL_PARAM}  --generate-certificate --load-ca-privkey "${cakey}"  --load-ca-certificate "${cacert}"  \
+	--template ${srcdir}/testpkcs11-certs/client-tmpl --load-privkey ${tmpkey} \
+	--outfile tmp-client.crt >>"${TMPFILE}" 2>&1
+
+	if test $? != 0; then
+		echo failed
+		exit_error
+	fi
+
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label xxx2-rsa --load-privkey ${tmpkey} "${token}" >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo failed
+		exit_error
+	fi
+
+	id=$(${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all "${token};object=xxx2-rsa;object-type=private" 2>&1 | grep 'ID: '|sed -e 's/ID://' -e 's/^[ \t]*//' -e 's/[ \t]*$//')
+
+	rm -f ${tmpkey}
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label tmp-xxx2-rsa --load-certificate tmp-client.crt "${token}" >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo failed
+		exit_error
+	fi
+
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-certs "${token};object=tmp-xxx2-rsa;object-type=cert" 2>&1 | grep "ID: ${id}" >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo "ID '$id' was not set on copy"
+		exit_error
+	fi
+	echo ok
+}
+
+# $1: token
+# $2: PIN
+# $3: cakey: ${srcdir}/testpkcs11-certs/ca.key
+# $4: cacert: ${srcdir}/testpkcs11-certs/ca.crt
+#
+# Tests writing a certificate which corresponds to the given key,
+# and verifies whether the ID is the same. Should utilize the
+# ID of the private key.
+write_certificate_id_test_ecdsa () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+	cakey="$3"
+	cacert="$4"
+	tmpkey="key.$$.tmp"
+
+	echo -n "* Generating ECDSA private key... "
+	${CERTTOOL} ${ADDITIONAL_PARAM} --generate-privkey --ecdsa --outfile ${tmpkey} >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit 1
+	fi
+
+	echo -n "* Checking whether right ID is set on copy... "
+	"${CERTTOOL}" ${CERTTOOL_PARAM} ${ADDITIONAL_PARAM}  --generate-certificate --load-ca-privkey "${cakey}"  --load-ca-certificate "${cacert}"  \
+	--template ${srcdir}/testpkcs11-certs/client-tmpl --load-privkey ${tmpkey} \
+	--outfile tmp-client.crt >>"${TMPFILE}" 2>&1
+
+	if test $? != 0; then
+		echo failed
+		exit_error
+	fi
+
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label xxx-ecdsa --load-privkey ${tmpkey} "${token}" >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo failed
+		exit_error
+	fi
+
+	id=$(${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all "${token};object=xxx-ecdsa;object-type=private" 2>&1 | grep 'ID: '|sed -e 's/ID://' -e 's/^[ \t]*//' -e 's/[ \t]*$//')
+
+	rm -f ${tmpkey}
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label tmp-xxx-ecdsa --load-certificate tmp-client.crt "${token}" >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo failed
+		exit_error
+	fi
+
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-certs "${token};object=tmp-xxx-ecdsa;object-type=cert" 2>&1 | grep "ID: ${id}" >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo "ID '$id' was not set on copy"
+		exit_error
+	fi
+	echo ok
+}
+
+test_sign () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+
+	echo -n "* Testing signatures using the private key... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --test-sign "${token};object=serv-key" >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo "failed. Cannot test signatures."
+		exit_error
+	fi
+	echo ok
+
+	echo -n "* Testing RSA-PSS signatures using the private key... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --sign-params rsa-pss --test-sign "${token};object=serv-key" >>"${TMPFILE}" 2>&1
+	rc=$?
+	if test $rc != 0; then
+		if test $rc = 2; then
+			echo "failed. RSA-PSS not supported."
+		else
+			echo "failed. Cannot test signatures."
+			exit_error
+		fi
+	else
+		echo ok
+	fi
+
+	echo -n "* Testing signatures using the private key (with ID)... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --test-sign "${token};id=%ac%1d%7a%39%cb%72%17%94%66%6c%74%44%73%40%91%44%c0%a0%43%7d" >>"${TMPFILE}" 2>&1
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --test-sign "${token};id=%ac%1d%7a%39%cb%72%17%94%66%6c%74%44%73%40%91%44%c0%a0%43%7d" 2>&1|grep "Verifying against public key in the token..."|grep ok >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo "failed. Cannot test signatures with ID."
+		exit_error
+	fi
+	echo ok
+}
+
+# This tests the signing operation as well as the usage of --set-pin
+test_sign_set_pin () {
+	pin="$2"
+	token="$1"
+
+	unset GNUTLS_PIN
+
+	echo -n "* Testing signatures using the private key and --set-pin... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --set-pin ${pin} --test-sign "${token};object=serv-key" >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo "failed. Cannot test signatures."
+		exit_error
+	fi
+	echo ok
+
+	export GNUTLS_PIN=${pin}
+}
+
+# $1: token
+# $2: PIN
+# $3: certfile
+# $4: keyfile
+# $5: cafile
+#
+# Tests using a certificate and key pair using gnutls-serv and gnutls-cli.
+use_certificate_test () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+	certfile="$3"
+	keyfile="$4"
+	cafile="$5"
+	txt="$6"
+
+	echo -n "* Using PKCS #11 with gnutls-cli (${txt})... "
+	# start server
+	eval "${GETPORT}"
+	launch_pkcs11_server $$ "${ADDITIONAL_PARAM}" --echo --priority NORMAL --x509certfile="${certfile}" \
+		--x509keyfile="$keyfile" --x509cafile="${cafile}" \
+		--verify-client-cert --require-client-cert >>"${TMPFILE}" 2>&1
+
+	PID=$!
+	wait_server ${PID}
+
+	# connect to server using SC
+	${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509cafile="${cafile}" </dev/null >>"${TMPFILE}" 2>&1 && \
+		fail ${PID} "Connection should have failed!"
+
+	${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509certfile="${certfile}" \
+	--x509keyfile="$keyfile" --x509cafile="${cafile}" </dev/null >>"${TMPFILE}" 2>&1 || \
+		fail ${PID} "Connection (with files) should have succeeded!"
+
+	${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509certfile="${token};object=gnutls-client;object-type=cert" \
+		--x509keyfile="${token};object=gnutls-client;object-type=private" \
+		--x509cafile="${cafile}" </dev/null >>"${TMPFILE}" 2>&1 || \
+		fail ${PID} "Connection (with SC) should have succeeded!"
+
+	kill ${PID}
+	wait
+
+	echo ok
+}
+
+
+
+echo "Testing PKCS11 support"
+
+# erase SC
+
+type="$1"
+
+if test -z "${type}"; then
+	echo "usage: $0: [pkcs15|softhsm|sc-hsm]"
+	if test -x "/usr/bin/softhsm" || test -x "/usr/bin/softhsm2-util"; then
+		echo "assuming 'softhsm'"
+		echo ""
+		type=softhsm
+	else
+		exit 77
+	fi
+
+fi
+
+. "${srcdir}/testpkcs11.${type}"
+
+export GNUTLS_PIN=12345678
+export GNUTLS_SO_PIN=00000000
+
+init_card "${GNUTLS_PIN}" "${GNUTLS_SO_PIN}"
+
+# find token name
+TOKEN=`${P11TOOL} ${ADDITIONAL_PARAM} --list-tokens pkcs11:token=Nikos|grep URL|grep token=GnuTLS-Test|sed 's/\s*URL\: //g'`
+
+echo "* Token: ${TOKEN}"
+if test "x${TOKEN}" = x; then
+	echo "Could not find generated token"
+	exit_error
+fi
+
+#write a given privkey
+write_privkey "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/testpkcs11-certs/client.key"
+
+generate_temp_ecc_privkey "${TOKEN}" "${GNUTLS_PIN}" 256
+delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" ecc-256
+
+generate_temp_ecc_privkey_no_login "${TOKEN}" "${GNUTLS_PIN}" 256
+delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" ecc-no-256
+
+generate_temp_ecc_privkey "${TOKEN}" "${GNUTLS_PIN}" 384
+delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" ecc-384
+
+generate_temp_rsa_privkey "${TOKEN}" "${GNUTLS_PIN}" 2048
+delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" rsa-2048
+
+generate_temp_dsa_privkey "${TOKEN}" "${GNUTLS_PIN}" 3072
+delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" dsa-3072
+
+import_temp_rsa_privkey "${TOKEN}" "${GNUTLS_PIN}" 1024
+delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" rsa-1024
+import_temp_ecc_privkey "${TOKEN}" "${GNUTLS_PIN}" 256
+delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" ecc-256
+import_temp_dsa_privkey "${TOKEN}" "${GNUTLS_PIN}" 2048
+delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" dsa-2048
+
+generate_rsa_privkey "${TOKEN}" "${GNUTLS_PIN}" 1024
+change_id_of_privkey "${TOKEN}" "${GNUTLS_PIN}"
+export_pubkey_of_privkey "${TOKEN}" "${GNUTLS_PIN}"
+change_label_of_privkey "${TOKEN}" "${GNUTLS_PIN}"
+
+write_certificate_test "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/testpkcs11-certs/ca.key" "${srcdir}/testpkcs11-certs/ca.crt" tmp-client.pub
+write_serv_privkey "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/testpkcs11-certs/server.key"
+write_serv_cert "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/testpkcs11-certs/server.crt"
+
+write_serv_pubkey "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/testpkcs11-certs/server.crt"
+test_sign "${TOKEN}" "${GNUTLS_PIN}"
+
+use_certificate_test "${TOKEN}" "${GNUTLS_PIN}" "${TOKEN};object=serv-cert;object-type=cert" "${TOKEN};object=serv-key;object-type=private" "${srcdir}/testpkcs11-certs/ca.crt" "full URLs"
+
+use_certificate_test "${TOKEN}" "${GNUTLS_PIN}" "${TOKEN};object=serv-cert" "${TOKEN};object=serv-key" "${srcdir}/testpkcs11-certs/ca.crt" "abbrv URLs"
+
+write_certificate_id_test_rsa "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/testpkcs11-certs/ca.key" "${srcdir}/testpkcs11-certs/ca.crt"
+write_certificate_id_test_rsa2 "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/testpkcs11-certs/ca.key" "${srcdir}/testpkcs11-certs/ca.crt"
+write_certificate_id_test_ecdsa "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/testpkcs11-certs/ca.key" "${srcdir}/testpkcs11-certs/ca.crt"
+
+test_delete_cert "${TOKEN}" "${GNUTLS_PIN}"
+
+test_sign_set_pin "${TOKEN}" "${GNUTLS_PIN}"
+
+if test ${RETCODE} = 0; then
+	echo "* All smart cards tests succeeded"
+fi
+rm -f tmp-client.crt tmp-client.pub tmp-client-2.pub "${TMPFILE}"
+
+exit 0
diff --git a/tests/testpkcs11.softhsm b/tests/testpkcs11.softhsm
new file mode 100755
index 000000000..d79a8528e
--- /dev/null
+++ b/tests/testpkcs11.softhsm
@@ -0,0 +1,77 @@
+#!/bin/sh
+
+# Copyright (C) 2013 Nikos Mavrogiannopoulos
+#
+# This file is part of GnuTLS.
+#
+# GnuTLS is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# GnuTLS is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GnuTLS; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+for i in /usr/lib64/pkcs11 /usr/lib/softhsm /usr/lib/x86_64-linux-gnu/softhsm /usr/lib /usr/lib64/softhsm;do
+	if test -f "$i/libsofthsm2.so"; then
+		ADDITIONAL_PARAM="--provider $i/libsofthsm2.so"
+		break
+	else
+		if test -f "$i/libsofthsm.so";then
+			ADDITIONAL_PARAM="--provider $i/libsofthsm.so"
+			break
+		fi
+	fi
+done
+
+init_card () {
+	PIN="$1"
+	PUK="$2"
+
+	if test -x "/usr/bin/softhsm2-util"; then
+		export SOFTHSM2_CONF="softhsm-testpkcs11.$$.config.tmp"
+		SOFTHSM_TOOL="/usr/bin/softhsm2-util"
+		${SOFTHSM_TOOL} --version|grep "2.0.0" >/dev/null 2>&1
+		if test $? = 0; then
+			echo "softhsm2-util 2.0.0 is broken"
+			export BROKEN_SOFTHSM2=1
+		fi
+	fi
+
+	if test -x "/usr/bin/softhsm"; then
+		export SOFTHSM_CONF="softhsm-testpkcs11.$$.config.tmp"
+		SOFTHSM_TOOL="/usr/bin/softhsm"
+	fi
+
+	if test -z "${SOFTHSM_TOOL}"; then
+		echo "Could not find softhsm(2) tool"
+		exit 77
+	fi
+
+	if test -z "${SOFTHSM_CONF}"; then
+		rm -rf ./softhsm-testpkcs11.$$.tmp
+		mkdir -p ./softhsm-testpkcs11.$$.tmp
+		echo "objectstore.backend = file" > "${SOFTHSM2_CONF}"
+		echo "directories.tokendir = ./softhsm-testpkcs11.$$.tmp" >> "${SOFTHSM2_CONF}"
+
+	else
+		rm -rf ./softhsm-testpkcs11.$$.tmp
+		echo "0:./softhsm-testpkcs11.$$.tmp" > "${SOFTHSM_CONF}"
+	fi
+
+
+	echo -n "* Initializing smart card... "
+	${SOFTHSM_TOOL} --init-token --slot 0 --label "GnuTLS-Test" --so-pin "${PUK}" --pin "${PIN}" >/dev/null #2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit_error
+	fi
+}