basically done; only speed remains

8 files changed, 1249 insertions, 1243 deletions

diff --git a/apps/TODO b/apps/TODO
index b592a6c156..3d0a6ccced 100644
--- a/apps/TODO
+++ b/apps/TODO
@@ -52,8 +52,8 @@ X  1514 cms.c
 X  1758 req.c
 -  1960 s_cb.c
 -  2010 testrsa.h
-   2525 s_client.c
+X  2525 s_client.c
    2942 speed.c
 X  2986 ca.c
 -  3082 apps.c
-   3677 s_server.c
+X  3677 s_server.c
diff --git a/apps/apps.h b/apps/apps.h
index a9a76cf034..0023d30ef0 100644
--- a/apps/apps.h
+++ b/apps/apps.h
@@ -240,7 +240,7 @@ extern void unbuffer(FILE* fp);
 	{" xchain", OPT_X_CHAIN, '<' }, \
 	{ "xchain_build", OPT_X_CHAIN_BUILD, '-' }, \
 	{ "xcertform", OPT_X_CERTFORM, 'F' }, \
-	{ "xkeyform", OPT_X_KEYFORM, 'F' },
+	{ "xkeyform", OPT_X_KEYFORM, 'F' }
 
 #define OPT_X_CASES \
 	OPT_X__FIRST: case OPT_X__LAST: break; \
@@ -249,15 +249,15 @@ extern void unbuffer(FILE* fp);
 	case OPT_X_CHAIN: \
 	case OPT_X_CHAIN_BUILD: \
 	case OPT_X_CERTFORM: \
-	case OPT_X_KEYFORM:
+	case OPT_X_KEYFORM
 
 /*
  * Common SSL options.
  */
 #define OPT_S_ENUM \
 	OPT_S__FIRST=3000, \
-	OPT_S_SIGALGS, OPT_S_CLIENT_SIGALGS, OPT_S_CURVES, OPS_S_NAMED_CURVE, \
-	OPT_S_CIPHER, OPT_S_CERT, OPT_S_KEY, OPT_S_DHPARAM \
+	OPT_S_SIGALGS, OPT_S_CLIENT_SIGALGS, OPT_S_CURVES, OPT_S_NAMED_CURVE, \
+	OPT_S_CIPHER, OPT_S_CERT, OPT_S_KEY, OPT_S_DHPARAM, \
 	OPT_S__LAST
 
 #define OPT_S_OPTIONS \
@@ -268,14 +268,14 @@ extern void unbuffer(FILE* fp);
 	{ "cipher", OPT_S_CIPHER, 's' }, \
 	{ "cert", OPT_S_CERT, '<' }, \
 	{ "key", OPT_S_KEY, '<' }, \
-	{ "dhparam", OPT_S_DHPARAM, '<' },
+	{ "dhparam", OPT_S_DHPARAM, '<' }
 
-#define OPS_S_CASES \
+#define OPT_S_CASES \
 	OPT_S__FIRST: case OPT_S__LAST: break; \
 	case OPT_S_SIGALGS: \
 	case OPT_S_CLIENT_SIGALGS: \
 	case OPT_S_CURVES: \
-	case OPS_S_NAMED_CURVE: \
+	case OPT_S_NAMED_CURVE: \
 	case OPT_S_CIPHER: \
 	case OPT_S_CERT: \
 	case OPT_S_KEY: \
@@ -318,6 +318,7 @@ extern int opt_pair(const char* arg, const OPT_PAIR* pairs, int* result);
 extern int opt_cipher(const char* name, const EVP_CIPHER** cipherp);
 extern int opt_md(const char* name, const EVP_MD** mdp);
 extern char* opt_arg(void);
+extern char* opt_flag(void);
 extern char* opt_unknown(void);
 extern char* opt_reset(void);
 extern char** opt_rest(void);
diff --git a/apps/dsaparam.c b/apps/dsaparam.c
index 61030f251c..f3e382c0f9 100644
--- a/apps/dsaparam.c
+++ b/apps/dsaparam.c
@@ -141,7 +141,7 @@ int dsaparam_main(int argc, char **argv)
 	{
 	DSA *dsa=NULL;
 	BIO *in=NULL,*out=NULL;
-	int i,badops=0,text=0;
+	int i,text=0;
 	int numbits=-1,num,genkey=0, need_rand=0, non_fips_allow=0;
 	int informat=FORMAT_PEM,outformat=FORMAT_PEM,noout=0,C=0,ret=1;
 	char *infile=NULL,*outfile=NULL,*prog,*inrand=NULL;
diff --git a/apps/openssl.c b/apps/openssl.c
index f90e400f4e..a870457575 100644
--- a/apps/openssl.c
+++ b/apps/openssl.c
@@ -576,6 +576,7 @@ static int do_cmd(LHASH_OF(FUNCTION) *prog, int argc, char *argv[])
 		else
 			BIO_printf(out, "%s\n", argv[0]+3);
 		BIO_free_all(out);
+		out = NULL;
 		goto end;
 		}
 	else if ((strcmp(argv[0],"quit") == 0) ||
@@ -624,6 +625,7 @@ static int do_cmd(LHASH_OF(FUNCTION) *prog, int argc, char *argv[])
 								fp->name);
 			}
 		BIO_free_all(out);
+		out = NULL;
 		ret=0;
 		goto end;
 		}
diff --git a/apps/opt.c b/apps/opt.c
index 526159ed0b..da308156c4 100644
--- a/apps/opt.c
+++ b/apps/opt.c
@@ -11,11 +11,13 @@
 #include <errno.h>
 #include <ctype.h>
 #include <openssl/bio.h>
+
 /* Our state */
 static char** argv;
 static int argc;
 static int opt_index;
 static char* arg;
+static char* flag;
 static char* dunno;
 static const OPTIONS* unknown;
 static const OPTIONS* opts;
@@ -90,7 +92,7 @@ char* opt_progname(const char *argv0)
 }
 #endif
 
-char* get_getprog(void)
+char* opt_getprog(void)
 {
 	return prog;
 }
@@ -330,8 +332,9 @@ int opt_verify(int opt, X509_VERIFY_PARAM *vpm)
 		X509_VERIFY_PARAM_set1(vpm, vtmp);
 		break;
 	case OPT_V_VERIFY_DEPTH:
+		i = atoi(opt_arg());
 		if (i >= 0)
-			X509_VERIFY_PARAM_set_depth(vpm, atoi(opt_arg()));
+			X509_VERIFY_PARAM_set_depth(vpm, i);
 		break;
 	case OPT_V_ATTIME:
 		opt_ulong(opt_arg(), &ul);
@@ -443,6 +446,7 @@ int opt_next(void)
 	/* Allow -nnn and --nnn */
 	if (*++p == '-')
 		p++;
+	flag = p - 1;
 
 	/* If we have --flag=foo, snip it off */
 	if ((arg = strchr(p, '=')) != NULL)
@@ -559,6 +563,12 @@ char* opt_arg(void)
 	return arg;
 }
 
+/* Return the most recent flag. */
+char* opt_flag(void)
+{
+	return flag;
+}
+
 /* Return the unknown option. */
 char* opt_unknown(void)
 {
diff --git a/apps/s_cb.c b/apps/s_cb.c
index 2bd72b973c..f4687ef576 100644
--- a/apps/s_cb.c
+++ b/apps/s_cb.c
@@ -1556,52 +1556,6 @@ void print_ssl_summary(BIO *bio, SSL *s)
 #endif
 	}
 
-int args_ssl(char ***pargs, int *pargc, SSL_CONF_CTX *cctx,
-			int *badarg, BIO *err, STACK_OF(OPENSSL_STRING) **pstr)
-	{
-	char *arg = **pargs, *argn = (*pargs)[1];
-	int rv;
-
-	/* Attempt to run SSL configuration command */
-	rv = SSL_CONF_cmd_argv(cctx, pargc, pargs);
-	/* If parameter not recognised just return */
-	if (rv == 0)
-		return 0;
-	/* see if missing argument error */
-	if (rv == -3)
-		{
-		BIO_printf(err, "%s needs an argument\n", arg);
-		*badarg = 1;
-		goto end;
-		}
-	/* Check for some other error */
-	if (rv < 0)
-		{
-		BIO_printf(err, "Error with command: \"%s %s\"\n",
-						arg, argn ? argn : "");
-		*badarg = 1;
-		goto end;
-		}
-	/* Store command and argument */
-	/* If only one argument processed store value as NULL */
-	if (rv == 1)
-		argn = NULL;
-	if (!*pstr)
-		*pstr = sk_OPENSSL_STRING_new_null();
-	if (!*pstr || !sk_OPENSSL_STRING_push(*pstr, arg) ||
-				!sk_OPENSSL_STRING_push(*pstr, argn))
-		{
-		BIO_puts(err, "Memory allocation failure\n");
-		goto end;
-		}
-
-	end:
-	if (*badarg)
-		ERR_print_errors(err);
-
-	return 1;
-	}
-
 int args_ssl_call(SSL_CTX *ctx, BIO *err, SSL_CONF_CTX *cctx,
 		STACK_OF(OPENSSL_STRING) *str, int no_ecdhe, int no_jpake)
 	{
diff --git a/apps/s_client.c b/apps/s_client.c
index ab513acbc2..88440dd2c2 100644
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -182,8 +182,6 @@ typedef unsigned int u_int;
 /*#define SSL_HOST_NAME	"193.118.187.102" */
 #define SSL_HOST_NAME	"localhost"
 
-/*#define TEST_CERT "client.pem" */ /* no default cert. */
-
 #undef BUFSIZZ
 #define BUFSIZZ 1024*8
 
@@ -192,118 +190,25 @@ extern int verify_error;
 extern int verify_return_error;
 extern int verify_quiet;
 
-#ifdef FIONBIO
 static int c_nbio=0;
-#endif
-static int c_Pause=0;
-static int c_debug=0;
-#ifndef OPENSSL_NO_TLSEXT
 static int c_tlsextdebug=0;
 static int c_status_req=0;
-#endif
+static int c_Pause=0;
+static int c_debug=0;
 static int c_msg=0;
 static int c_showcerts=0;
-
 static char *keymatexportlabel=NULL;
 static int keymatexportlen=20;
-
-static void sc_usage(void);
-static void print_stuff(BIO *berr,SSL *con,int full);
-#ifndef OPENSSL_NO_TLSEXT
-static int ocsp_resp_cb(SSL *s, void *arg);
-#endif
 static BIO *bio_c_out=NULL;
 static BIO *bio_c_msg=NULL;
 static int c_quiet=0;
 static int c_ign_eof=0;
 static int c_brief=0;
 
-const char* s_client_help[] = {
-	"-host host     use -connect instead",
-	"-port port     use -connect instead",
-	"-connect host:port  connect over TCP/IP (default is " SSL_HOST_NAME ":" PORT_STR ")",
-	"-unix path     connect over unix domain sockets",
-	"-verify arg    turn on peer certificate verification",
-	"-cert arg      certificate file to use, PEM format assumed",
-	"-certform arg  certificate format (PEM or DER) PEM default",
-	"-key arg       private key file to use, in cert file if",
-	"               not specified but cert file is",
-	"-keyform arg   key format (PEM or DER) PEM default",
-	"-pass arg      private key file pass phrase source",
-	"-CApath arg    PEM format directory of CA's",
-	"-CAfile arg    PEM format file of CA's",
-	"-trusted_first  use local CA's first when building trust chain",
-	"-reconnect     drop and re-make the connection with the same Session-ID",
-	"-pause         sleep(1) after each read(2) and write(2) system call",
-	"-showcerts     show all certificates in the chain",
-	"-debug         extra output",
-#ifdef WATT32
-	"-wdebug        WATT-32 tcp debugging",
-#endif
-	"-msg           show protocol messages",
-	"-nbio_test     more ssl protocol testing",
-	"-state         print the 'ssl' states",
-#ifdef FIONBIO
-	"-nbio         use non-blocking IO",
-#endif
-	"-crlf          convert LF from terminal into CRLF",
-	"-quiet         no s_client output",
-	"-ign_eof       ignore input eof (default when -quiet)",
-	"-no_ign_eof    don't ignore input eof",
-#ifndef OPENSSL_NO_PSK
-	"-psk_identity arg  PSK identity",
-	"-psk arg       PSK in hex (without 0x)",
-# ifndef OPENSSL_NO_JPAKE
-	"-jpake arg     JPAKE secret to use",
-# endif
-#endif
-#ifndef OPENSSL_NO_SRP
-	"-srpuser user  SRP authentification for 'user'",
-	"-srppass arg   password for 'user'",
-	"-srp_lateuser  SRP username into second ClientHello message",
-	"-srp_moregroups   tolerate other than the known g N values.",
-	"-srp_strength int minimal mength in bits for N (default %d).",
-#endif
-	"-ssl2          just use SSLv2",
-	"-ssl3          just use SSLv3",
-	"-tls1_2        just use TLSv1.2",
-	"-tls1_1        just use TLSv1.1",
-	"-tls1          just use TLSv1",
-	"-dtls1         just use DTLSv1",
-	"-mtu           set the link layer MTU",
-	"-no_tls1_2/-no_tls1_1/-no_tls1/-no_ssl3/-no_ssl2  turn off that protocol",
-	"-bugs          switch on all SSL implementation bug workarounds",
-	"-serverpref    use server's cipher preferences (only SSLv2)",
-	"-cipher        preferred cipher to use; see 'openssl ciphers'",
-	"-starttls prot  use the STARTTLS command before starting TLS",
-	"               prot must be: smtp pop3 imap ftp or xmpp",
-	"-xmpphost host  when used with \"-starttls xmpp\" specifies the virtual host",
-#ifndef OPENSSL_NO_ENGINE
-	"-engine id     initialise and use the specified engine",
-#endif
-	"-rand file...  load the file(s) into the random number generator",
-	"-sess_out arg  file to write SSL session to",
-	"-sess_in arg   file to read SSL session from",
+static void print_stuff(BIO *berr,SSL *con,int full);
 #ifndef OPENSSL_NO_TLSEXT
-	"-servername host  set TLS extension servername in ClientHello",
-	"-tlsextdebug   hex dump of all TLS extensions received",
-	"-status        request certificate status from server",
-	"-no_ticket     disable use of RFC4507bis session tickets",
-	"-serverinfo types  send empty ClientHello extensions (comma-separated numbers)",
-	"-auth           send and receive RFC 5878 TLS auth extensions and supplemental data",
-	"-auth_require_reneg  do not send TLS auth extensions until renegotiation",
-# ifndef OPENSSL_NO_NEXTPROTONEG
-	"-nextprotoneg arg  enable NPN extension, considering named protocols supported (comma-separated list)",
-# endif
-	"-alpn arg      enable ALPN extension, considering named protocols supported (comma-separated list)",
+static int ocsp_resp_cb(SSL *s, void *arg);
 #endif
-	"-legacy_renegotiation  enable use of legacy renegotiation (dangerous)",
-	"-use_srtp profiles  offer SRTP key management with a colon-separated profile list",
-	"-keymatexport label   export keying material using label",
-	"-keymatexportlen len  export len bytes of keying material (default 20)",
-
-	NULL
-};
 
 #ifndef OPENSSL_NO_PSK
 /* Default PSK identity and key */
@@ -368,11 +273,6 @@ static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *identity,
 	}
 #endif
 
-static void sc_usage(void)
-	{
-	BIO_printf(bio_err,"usage: s_client args\n");
-	printhelp(s_client_help);
-	}
 
 #ifndef OPENSSL_NO_TLSEXT
 
@@ -382,7 +282,6 @@ typedef struct tlsextctx_st {
    int ack;
 } tlsextctx;
 
-
 static int ssl_servername_cb(SSL *s, int *ad, void *arg)
 	{
 	tlsextctx * p = (tlsextctx *) arg;
@@ -509,7 +408,8 @@ static char * ssl_give_srp_client_pwd_cb(SSL *s, void *arg)
 	}
 
 #endif
-	char *srtp_profiles = NULL;
+
+char *srtp_profiles = NULL;
 
 # ifndef OPENSSL_NO_NEXTPROTONEG
 /* This the context that we pass to next_proto_cb */
@@ -569,7 +469,7 @@ static int serverinfo_cli_cb(SSL* s, unsigned short ext_type,
 
 enum
 {
-	PROTO_OFF	= 0,
+	PROTO_OFF,
 	PROTO_SMTP,
 	PROTO_POP3,
 	PROTO_IMAP,
@@ -577,697 +477,766 @@ enum
 	PROTO_XMPP
 };
 
+const char* s_client_help[] = {
+	"-host host     use -connect instead",
+	"-port port     use -connect instead",
+	"-connect host:port  connect over TCP/IP (default is " SSL_HOST_NAME ":" PORT_STR ")",
+	"-unix path     connect over unix domain sockets",
+	"-verify arg    turn on peer certificate verification",
+	"-cert arg      certificate file to use, PEM format assumed",
+	"-certform arg  certificate format (PEM or DER) PEM default",
+	"-key arg       private key file to use, in cert file if",
+	"               not specified but cert file is",
+	"-keyform arg   key format (PEM or DER) PEM default",
+	"-pass arg      private key file pass phrase source",
+	"-CApath arg    PEM format directory of CA's",
+	"-CAfile arg    PEM format file of CA's",
+	"-trusted_first  use local CA's first when building trust chain",
+	"-reconnect     drop and re-make the connection with the same Session-ID",
+	"-pause         sleep(1) after each read(2) and write(2) system call",
+	"-showcerts     show all certificates in the chain",
+	"-debug         extra output",
+	"-msg           show protocol messages",
+	"-nbio_test     more ssl protocol testing",
+	"-state         print the 'ssl' states",
+	"-crlf          convert LF from terminal into CRLF",
+	"-quiet         no s_client output",
+	"-ign_eof       ignore input eof (default when -quiet)",
+	"-no_ign_eof    don't ignore input eof",
+	"-ssl2          just use SSLv2",
+	"-ssl3          just use SSLv3",
+	"-tls1_2        just use TLSv1.2",
+	"-tls1_1        just use TLSv1.1",
+	"-tls1          just use TLSv1",
+	"-dtls1         just use DTLSv1",
+	"-mtu           set the link layer MTU",
+	"-no_tls1_2/-no_tls1_1/-no_tls1/-no_ssl3/-no_ssl2  turn off that protocol",
+	"-bugs          switch on all SSL implementation bug workarounds",
+	"-serverpref    use server's cipher preferences (only SSLv2)",
+	"-cipher        preferred cipher to use; see 'openssl ciphers'",
+	"-starttls prot  use the STARTTLS command before starting TLS",
+	"               prot must be: smtp pop3 imap ftp or xmpp",
+	"-xmpphost host  when used with \"-starttls xmpp\" specifies the virtual host",
+	"-rand file...  load the file(s) into the random number generator",
+	"-sess_out arg  file to write SSL session to",
+	"-sess_in arg   file to read SSL session from",
+	"-legacy_renegotiation  enable use of legacy renegotiation (dangerous)",
+	"-use_srtp profiles  offer SRTP key management with a colon-separated profile list",
+	"-keymatexport label   export keying material using label",
+	"-keymatexportlen len  export len bytes of keying material (default 20)",
+#ifdef WATT32
+	"-wdebug        WATT-32 tcp debugging",
+#endif
+#ifdef FIONBIO
+	"-nbio         use non-blocking IO",
+#endif
+#ifndef OPENSSL_NO_PSK
+	"-psk_identity arg  PSK identity",
+	"-psk arg       PSK in hex (without 0x)",
+# ifndef OPENSSL_NO_JPAKE
+	"-jpake arg     JPAKE secret to use",
+# endif
+#endif
+#ifndef OPENSSL_NO_SRP
+	"-srpuser user  SRP authentification for 'user'",
+	"-srppass arg   password for 'user'",
+	"-srp_lateuser  SRP username into second ClientHello message",
+	"-srp_moregroups   tolerate other than the known g N values.",
+	"-srp_strength int minimal mength in bits for N (default %d).",
+#endif
+#ifndef OPENSSL_NO_ENGINE
+	"-engine id     initialise and use the specified engine",
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+	"-servername host  set TLS extension servername in ClientHello",
+	"-tlsextdebug   hex dump of all TLS extensions received",
+	"-status        request certificate status from server",
+	"-no_ticket     disable use of RFC4507bis session tickets",
+	"-serverinfo types  send empty ClientHello extensions (comma-separated numbers)",
+	"-auth           send and receive RFC 5878 TLS auth extensions and supplemental data",
+	"-auth_require_reneg  do not send TLS auth extensions until renegotiation",
+	"-alpn arg      enable ALPN extension, considering named protocols supported (comma-separated list)",
+# ifndef OPENSSL_NO_NEXTPROTONEG
+	"-nextprotoneg arg  enable NPN extension, considering named protocols supported (comma-separated list)",
+# endif
+#endif
+	NULL
+};
+
+enum options {
+	OPT_ERR = -1, OPT_EOF = 0,
+	OPT_HOST, OPT_PORT, OPT_CONNECT, OPT_UNIX, OPT_XMPPHOST, OPT_VERIFY,
+	OPT_CERT, OPT_CRL, OPT_CRL_DOWNLOAD, OPT_SESS_OUT, OPT_SESS_IN,
+	OPT_CERTFORM, OPT_CRLFORM, OPT_VERIFY_RET_ERROR, OPT_VERIFY_QUIET,
+	OPT_BRIEF, OPT_PREXIT, OPT_CRLF, OPT_QUIET, OPT_NBIO,
+	OPT_SSL_CLIENT_ENGINE, OPT_RAND, OPT_IGN_EOF, OPT_NO_IGN_EOF,
+	OPT_PAUSE, OPT_DEBUG, OPT_TLSEXTDEBUG, OPT_STATUS, OPT_WDEBUG,
+	OPT_MSG, OPT_MSGFILE, OPT_ENGINE, OPT_TRACE, OPT_SECURITY_DEBUG,
+	OPT_SECURITY_DEBUG_VERBOSE, OPT_SHOWCERTS, OPT_NBIO_TEST, OPT_STATE,
+	OPT_PSK_IDENTITY, OPT_PSK, OPT_SRPUSER, OPT_SRPPASS, OPT_SRP_STRENGTH,
+	OPT_SRP_LATEUSER, OPT_SRP_MOREGROUPS, OPT_SSL2, OPT_SSL3,
+	OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1,
+	OPT_DTLS1_2, OPT_TIMEOUT, OPT_MTU, OPT_KEYFORM, OPT_PASS,
+	OPT_CERT_CHAIN, OPT_CAPATH, OPT_CHAINCAPATH, OPT_VERIFYCAPATH,
+	OPT_KEY, OPT_RECONNECT, OPT_BUILD_CHAIN, OPT_CAFILE,
+	OPT_CHAINCAFILE, OPT_VERIFYCAFILE, OPT_NEXTPROTONEG, OPT_ALPN,
+	OPT_SERVERINFO, OPT_STARTTLS, OPT_SERVERNAME, OPT_JPAKE,
+	OPT_USE_SRTP, OPT_KEYMATEXPORT, OPT_KEYMATEXPORTLEN,
+	OPT_V_ENUM,
+	OPT_X_ENUM,
+	OPT_S_ENUM,
+};
+
+static OPTIONS options[] = {
+	{ "host", OPT_HOST, 's' },
+	{ "port", OPT_PORT, 'p' },
+	{ "connect", OPT_CONNECT, 's' },
+	{ "unix", OPT_UNIX, 's' },
+	{ "xmpphost", OPT_XMPPHOST, 's' },
+	{ "verify", OPT_VERIFY, 'p' },
+	{ "cert", OPT_CERT, '<' },
+	{ "CRL", OPT_CRL, '<' },
+	{ "crl_download", OPT_CRL_DOWNLOAD, '-' },
+	{ "sess_out", OPT_SESS_OUT, '>' },
+	{ "sess_in", OPT_SESS_IN, '<' },
+	{ "certform", OPT_CERTFORM, 'F' },
+	{ "CRLform", OPT_CRLFORM, 'F' },
+	{ "verify_return_error", OPT_VERIFY_RET_ERROR, '-' },
+	{ "verify_quiet", OPT_VERIFY_QUIET, '-' },
+	{ "brief", OPT_BRIEF, '-' },
+	{ "prexit", OPT_PREXIT, '-' },
+	{ "crlf", OPT_CRLF, '-' },
+	{ "quiet", OPT_QUIET, '-' },
+	{ "nbio", OPT_NBIO, '-' },
+	{ "ssl_client_engine", OPT_SSL_CLIENT_ENGINE, 's' },
+	{ "rand", OPT_RAND, 's' },
+	{ "ign_eof", OPT_IGN_EOF, '-' },
+	{ "no_ign_eof", OPT_NO_IGN_EOF, '-' },
+	{ "pause", OPT_PAUSE, '-' },
+	{ "debug", OPT_DEBUG, '-' },
+	{ "tlsextdebug", OPT_TLSEXTDEBUG, '-' },
+	{ "status", OPT_STATUS, '-' },
+	{ "wdebug", OPT_WDEBUG, '-' },
+	{ "msg", OPT_MSG, '-' },
+	{ "msgfile", OPT_MSGFILE, '>' },
+#ifndef OPENSSL_NO_ENGINE
+	{ "engine", OPT_ENGINE, 's' },
+#endif
+	{ "trace", OPT_TRACE, '-' },
+	{ "security_debug", OPT_SECURITY_DEBUG, '-' },
+	{ "security_debug_verbose", OPT_SECURITY_DEBUG_VERBOSE, '-' },
+	{ "showcerts", OPT_SHOWCERTS, '-' },
+	{ "nbio_test", OPT_NBIO_TEST, '-' },
+	{ "state", OPT_STATE, '-' },
+	{ "psk_identity", OPT_PSK_IDENTITY, 's' },
+	{ "psk", OPT_PSK, 's' },
+	{ "srpuser", OPT_SRPUSER, 's' },
+	{ "srppass", OPT_SRPPASS, 's' },
+	{ "srp_strength", OPT_SRP_STRENGTH, 'p' },
+	{ "srp_lateuser", OPT_SRP_LATEUSER, '-' },
+	{ "srp_moregroups", OPT_SRP_MOREGROUPS, '-' },
+#ifndef OPENSSL_NO_SSL2
+	{ "ssl2", OPT_SSL2, '-' },
+#endif
+#ifndef OPENSSL_NO_SSL3
+	{ "ssl3", OPT_SSL3, '-' },
+#endif
+#ifndef OPENSSL_NO_TLS1
+	{ "tls1_2", OPT_TLS1_2, '-' },
+	{ "tls1_1", OPT_TLS1_1, '-' },
+	{ "tls1", OPT_TLS1, '-' },
+	{ "dtls", OPT_DTLS, '-' },
+	{ "dtls1", OPT_DTLS1, '-' },
+	{ "dtls1_2", OPT_DTLS1_2, '-' },
+	{ "timeout", OPT_TIMEOUT, '-' },
+	{ "mtu", OPT_MTU, 'p' },
+#endif
+	{ "keyform", OPT_KEYFORM, 'F' },
+	{ "pass", OPT_PASS, 's' },
+	{ "cert_chain", OPT_CERT_CHAIN, '<' },
+	{ "CApath", OPT_CAPATH, '/' },
+	{ "chainCApath", OPT_CHAINCAPATH, '/' },
+	{ "verifyCApath", OPT_VERIFYCAPATH, '/' },
+	{ "key", OPT_KEY, '<' },
+	{ "reconnect", OPT_RECONNECT, '-' },
+	{ "build_chain", OPT_BUILD_CHAIN, '-' },
+	{ "CAfile", OPT_CAFILE, '<' },
+	{ "chainCAfile", OPT_CHAINCAFILE, '<' },
+	{ "verifyCAfile", OPT_VERIFYCAFILE, '<' },
+	{ "nextprotoneg", OPT_NEXTPROTONEG, 's' },
+	{ "alpn", OPT_ALPN, 's' },
+	{ "serverinfo", OPT_SERVERINFO, 's' },
+	{ "starttls", OPT_STARTTLS, 's' },
+	{ "servername", OPT_SERVERNAME, 's' },
+	{ "jpake", OPT_JPAKE, 's' },
+	{ "use_srtp", OPT_USE_SRTP, '<' },
+	{ "keymatexport", OPT_KEYMATEXPORT, 's' },
+	{ "keymatexportlen", OPT_KEYMATEXPORTLEN, 'p' },
+	OPT_S_OPTIONS,
+	OPT_V_OPTIONS,
+	OPT_X_OPTIONS,
+	{ NULL }
+};
+
+static OPT_PAIR services[] = {
+	{ "smtp", PROTO_SMTP },
+	{ "pop3", PROTO_POP3 },
+	{ "imap", PROTO_IMAP },
+	{ "ftp", PROTO_FTP },
+	{  "xmpp", PROTO_XMPP },
+	{ NULL }
+};
+
 int s_client_main(int argc, char **argv)
 	{
-	int build_chain = 0;
+	BIO *sbio;
+	EVP_PKEY *key=NULL;
 	SSL *con=NULL;
+	SSL_CTX *ctx=NULL;
+	STACK_OF(X509) *chain=NULL;
+	X509 *cert=NULL;
+	X509_VERIFY_PARAM *vpm=NULL;
+	SSL_EXCERT *exc=NULL;
+	SSL_CONF_CTX *cctx=NULL;
+	STACK_OF(OPENSSL_STRING) *ssl_args=NULL;
+	STACK_OF(X509_CRL) *crls=NULL;
+	const SSL_METHOD *meth=SSLv23_client_method();
+	char *CApath=NULL,*CAfile=NULL, *cbuf=NULL,*sbuf=NULL,*mbuf=NULL;
+	char *cert_file=NULL,*key_file=NULL,*chain_file=NULL, *prog;
+	char *chCApath=NULL,*chCAfile=NULL, *host=SSL_HOST_NAME, *inrand=NULL;
+	char *passarg=NULL, *pass=NULL, *vfyCApath=NULL, *vfyCAfile=NULL;
+	char *sess_in=NULL, *sess_out=NULL, *crl_file=NULL, *p;
+	char *xmpphost=NULL, *engine_id=NULL, *ssl_client_engine_id=NULL;
+	char *jpake_secret=NULL;
+	const char *unix_path=NULL;
+	struct sockaddr peer;
+	struct timeval timeout, *timeoutp;
+	fd_set readfds,writefds;
+	int build_chain=0, cbuf_len,cbuf_off;
+	int cert_format=FORMAT_PEM, key_format=FORMAT_PEM;
+	int crlf=0, full_log=1, mbuf_len=0, prexit=0;
+	int enable_timeouts=0, sdebug=0;
+	int peerlen=sizeof peer;
+	int reconnect=0,verify=SSL_VERIFY_NONE, vpmtouched=0;
+	int ret=1, in_init=1, i, nbio_test=0, s, k, width, state=0;
+	int sbuf_len,sbuf_off, socket_type=SOCK_STREAM;
+	int starttls_proto=PROTO_OFF, crl_format=FORMAT_PEM, crl_download=0;
+	int write_tty,read_tty,write_ssl,read_ssl,tty_on,ssl_pending;
+	long socket_mtu=0, randamt=0;
+	short port=PORT;
+	enum options o;
 #ifndef OPENSSL_NO_KRB5
 	KSSL_CTX *kctx;
 #endif
-	int s,k,width,state=0;
-	char *cbuf=NULL,*sbuf=NULL,*mbuf=NULL;
-	int cbuf_len,cbuf_off;
-	int sbuf_len,sbuf_off;
-	fd_set readfds,writefds;
-	short port=PORT;
-	int full_log=1;
-	char *host=SSL_HOST_NAME;
-	const char *unix_path = NULL;
-	char *xmpphost = NULL;
-	char *cert_file=NULL,*key_file=NULL,*chain_file=NULL;
-	int cert_format = FORMAT_PEM, key_format = FORMAT_PEM;
-	char *passarg = NULL, *pass = NULL;
-	X509 *cert = NULL;
-	EVP_PKEY *key = NULL;
-	STACK_OF(X509) *chain = NULL;
-	char *CApath=NULL,*CAfile=NULL;
-	char *chCApath=NULL,*chCAfile=NULL;
-	char *vfyCApath=NULL,*vfyCAfile=NULL;
-	int reconnect=0,badop=0,verify=SSL_VERIFY_NONE;
-	int crlf=0;
-	int write_tty,read_tty,write_ssl,read_ssl,tty_on,ssl_pending;
-	SSL_CTX *ctx=NULL;
-	int ret=1,in_init=1,i,nbio_test=0;
-	int starttls_proto = PROTO_OFF;
-	int prexit = 0;
-	X509_VERIFY_PARAM *vpm = NULL;
-	int badarg = 0;
-	const SSL_METHOD *meth=NULL;
-	int socket_type=SOCK_STREAM;
-	BIO *sbio;
-	char *inrand=NULL;
-	int mbuf_len=0;
-	struct timeval timeout, *timeoutp;
 #ifndef OPENSSL_NO_ENGINE
-	char *engine_id=NULL;
-	char *ssl_client_engine_id=NULL;
 	ENGINE *ssl_client_engine=NULL;
-#endif
 	ENGINE *e=NULL;
+#endif
 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_BEOS_R5)
 	struct timeval tv;
 #if defined(OPENSSL_SYS_BEOS_R5)
-	int stdin_set = 0;
+	int stdin_set=0;
 #endif
 #endif
 #ifndef OPENSSL_NO_TLSEXT
-	char *servername = NULL; 
-        tlsextctx tlsextcbp = 
-        {NULL,0};
-# ifndef OPENSSL_NO_NEXTPROTONEG
-	const char *next_proto_neg_in = NULL;
-# endif
-	const char *alpn_in = NULL;
+	char *servername=NULL; 
+	const char *alpn_in=NULL;
+        tlsextctx tlsextcbp = { NULL, 0 };
 # define MAX_SI_TYPES 100
 	unsigned short serverinfo_types[MAX_SI_TYPES];
-	int serverinfo_types_count = 0;
-#endif
-	char *sess_in = NULL;
-	char *sess_out = NULL;
-	struct sockaddr peer;
-	int peerlen = sizeof(peer);
-	int enable_timeouts = 0 ;
-	long socket_mtu = 0;
-#ifndef OPENSSL_NO_JPAKE
-static char *jpake_secret = NULL;
-#define no_jpake !jpake_secret
-#else
-#define no_jpake 1
+	int serverinfo_types_count=0;
+# ifndef OPENSSL_NO_NEXTPROTONEG
+	const char *next_proto_neg_in=NULL;
+# endif
 #endif
 #ifndef OPENSSL_NO_SRP
-	char * srppass = NULL;
-	int srp_lateuser = 0;
-	SRP_ARG srp_arg = {NULL,NULL,0,0,0,1024};
+	char *srppass=NULL;
+	int srp_lateuser=0;
+	SRP_ARG srp_arg= { NULL, NULL, 0, 0, 0, 1024 };
 #endif
-	SSL_EXCERT *exc = NULL;
 
-	SSL_CONF_CTX *cctx = NULL;
-	STACK_OF(OPENSSL_STRING) *ssl_args = NULL;
-
-	char *crl_file = NULL;
-	int crl_format = FORMAT_PEM;
-	int crl_download = 0;
-	STACK_OF(X509_CRL) *crls = NULL;
-	int sdebug = 0;
-
-	meth=SSLv23_client_method();
-
-	c_Pause=0;
-	c_quiet=0;
-	c_ign_eof=0;
-	c_debug=0;
-	c_msg=0;
+	prog = opt_progname(argv[0]);
+	c_Pause = 0;
+	c_quiet = 0;
+	c_ign_eof = 0;
+	c_debug = 0;
+	c_msg = 0;
 	c_showcerts=0;
-
-	if ((vpm = X509_VERIFY_PARAM_new()) == NULL)
-		return 1;
-
-
+	c_nbio = 0;
+	verify_depth = 0;
+	verify_error = X509_V_OK;
+	vpm = X509_VERIFY_PARAM_new();
+	cbuf = OPENSSL_malloc(BUFSIZZ);
+	sbuf = OPENSSL_malloc(BUFSIZZ);
+	mbuf = OPENSSL_malloc(BUFSIZZ);
 	cctx = SSL_CONF_CTX_new();
-	if (!cctx)
+
+	if (vpm == NULL || cctx == NULL
+	|| cbuf == NULL || sbuf == NULL || mbuf == NULL) {
+		BIO_printf(bio_err, "%s: out of memory\n", prog);
 		goto end;
+	}
+
 	SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CLIENT);
 	SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CMDLINE);
 
-	if (	((cbuf=OPENSSL_malloc(BUFSIZZ)) == NULL) ||
-		((sbuf=OPENSSL_malloc(BUFSIZZ)) == NULL) ||
-		((mbuf=OPENSSL_malloc(BUFSIZZ)) == NULL))
-		{
-		BIO_printf(bio_err,"out of memory\n");
-		goto end;
-		}
-
-	verify_depth=0;
-	verify_error=X509_V_OK;
-#ifdef FIONBIO
-	c_nbio=0;
+	prog = opt_init(argc, argv, options);
+	while ((o = opt_next()) != OPT_EOF) {
+		switch (o) {
+#ifndef WATT32
+		case OPT_WDEBUG:
 #endif
-
-	argc--;
-	argv++;
-	while (argc >= 1)
-		{
-		if	(strcmp(*argv,"-host") == 0)
-			{
-			if (--argc < 1) goto bad;
-			host= *(++argv);
-			}
-		else if	(strcmp(*argv,"-port") == 0)
-			{
-			if (--argc < 1) goto bad;
-			port=atoi(*(++argv));
-			if (port == 0) goto bad;
-			}
-		else if (strcmp(*argv,"-connect") == 0)
-			{
-			if (--argc < 1) goto bad;
-			if (!extract_host_port(*(++argv),&host,NULL,&port))
-				goto bad;
-			}
-		else if (strcmp(*argv,"-unix") == 0)
-			{
-			if (--argc < 1) goto bad;
-			unix_path = *(++argv);
-			}
-		else if	(strcmp(*argv,"-xmpphost") == 0)
-			{
-			if (--argc < 1) goto bad;
-			xmpphost= *(++argv);
-			}
-		else if	(strcmp(*argv,"-verify") == 0)
-			{
-			verify=SSL_VERIFY_PEER;
-			if (--argc < 1) goto bad;
-			verify_depth=atoi(*(++argv));
+#ifdef OPENSSL_NO_JPAKE
+		case OPT_JPAKE:
+#endif
+#ifdef OPENSSL_NO_SSL_TRACE
+		case OPT_TRACE:
+#endif
+		case OPT_EOF:
+		case OPT_ERR:
+			BIO_printf(bio_err,"Valid options are:\n");
+			printhelp(s_client_help);
+			goto end;
+		case OPT_HOST:
+			host = opt_arg();
+			break;
+		case OPT_PORT:
+			port=atoi(opt_arg());
+			break;
+		case OPT_CONNECT:
+			if (!extract_host_port(opt_arg(),&host,NULL,&port))
+				goto end;
+			break;
+		case OPT_UNIX:
+			unix_path = opt_arg();
+			break;
+		case OPT_XMPPHOST:
+			xmpphost = opt_arg();
+			break;
+		case OPT_VERIFY:
+			verify = SSL_VERIFY_PEER;
+			verify_depth = atoi(opt_arg());
 			if (!c_quiet)
-				BIO_printf(bio_err,"verify depth is %d\n",verify_depth);
-			}
-		else if	(strcmp(*argv,"-cert") == 0)
-			{
-			if (--argc < 1) goto bad;
-			cert_file= *(++argv);
-			}
-		else if	(strcmp(*argv,"-CRL") == 0)
-			{
-			if (--argc < 1) goto bad;
-			crl_file= *(++argv);
-			}
-		else if	(strcmp(*argv,"-crl_download") == 0)
+				BIO_printf(bio_err,"verify depth is %d\n",
+						verify_depth);
+			break;
+		case OPT_CERT:
+			cert_file = opt_arg();
+			break;
+		case OPT_CRL:
+			crl_file = opt_arg();
+			break;
+		case OPT_CRL_DOWNLOAD:
 			crl_download = 1;
-		else if	(strcmp(*argv,"-sess_out") == 0)
-			{
-			if (--argc < 1) goto bad;
-			sess_out = *(++argv);
-			}
-		else if	(strcmp(*argv,"-sess_in") == 0)
-			{
-			if (--argc < 1) goto bad;
-			sess_in = *(++argv);
-			}
-		else if	(strcmp(*argv,"-certform") == 0)
-			{
-			if (--argc < 1) goto bad;
-			cert_format = str2fmt(*(++argv));
-			}
-		else if	(strcmp(*argv,"-CRLform") == 0)
-			{
-			if (--argc < 1) goto bad;
-			crl_format = str2fmt(*(++argv));
-			}
-		// case OPT_V_COMMON_VERIFY_CASES: vpmtouched++
-		else if (!opt_verify(i, vpm))
-				goto bad;
-			}
-		else if (strcmp(*argv,"-verify_return_error") == 0)
+			break;
+		case OPT_SESS_OUT:
+			sess_out = opt_arg();
+			break;
+		case OPT_SESS_IN:
+			sess_in = opt_arg();
+			break;
+		case OPT_CERTFORM:
+			opt_format(opt_arg(), 1, &cert_format);
+			break;
+		case OPT_CRLFORM:
+			opt_format(opt_arg(), 1, &crl_format);
+			break;
+		case OPT_VERIFY_RET_ERROR:
 			verify_return_error = 1;
-		else if (strcmp(*argv,"-verify_quiet") == 0)
-			verify_quiet = 1;
-		else if (strcmp(*argv,"-brief") == 0)
-			{
-			c_brief = 1;
+			break;
+		case OPT_VERIFY_QUIET:
 			verify_quiet = 1;
-			c_quiet = 1;
-			}
-		else if (args_excert(&argv, &argc, &badarg, bio_err, &exc))
-			{
-			if (badarg)
-				goto bad;
-			continue;
-			}
-		else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args))
-			{
-			if (badarg)
-				goto bad;
-			continue;
-			}
-		else if	(strcmp(*argv,"-prexit") == 0)
-			prexit=1;
-		else if	(strcmp(*argv,"-crlf") == 0)
-			crlf=1;
-		else if	(strcmp(*argv,"-quiet") == 0)
-			{
-			c_quiet=1;
-			c_ign_eof=1;
+			break;
+		case OPT_BRIEF:
+			c_brief = verify_quiet = c_quiet = 1;
+			break;
+		case OPT_S_CASES:
+			if (ssl_args == NULL)
+				ssl_args = sk_OPENSSL_STRING_new_null();
+			if (ssl_args == NULL
+			|| !sk_OPENSSL_STRING_push(ssl_args, opt_flag())
+			|| !sk_OPENSSL_STRING_push(ssl_args, opt_arg())) {
+				BIO_printf(bio_err,
+					"%s: Memory allocation failure\n",
+					prog);
+				goto end;
 			}
-		else if	(strcmp(*argv,"-ign_eof") == 0)
-			c_ign_eof=1;
-		else if	(strcmp(*argv,"-no_ign_eof") == 0)
-			c_ign_eof=0;
-		else if	(strcmp(*argv,"-pause") == 0)
-			c_Pause=1;
-		else if	(strcmp(*argv,"-debug") == 0)
-			c_debug=1;
+			break;
+		case OPT_V_CASES:
+			if (!opt_verify(o, vpm))
+				goto end;
+			vpmtouched++;
+			break;
+		case OPT_X_CASES:
+			if (!args_excert(o, &exc))
+				goto end;
+			break;
+		case OPT_PREXIT:
+			prexit = 1;
+			break;
+		case OPT_CRLF:
+			crlf = 1;
+			break;
+		case OPT_QUIET:
+			c_quiet = c_ign_eof = 1;
+			break;
+		case OPT_NBIO:
+			c_nbio = 1;
+			break;
+		case OPT_ENGINE:
+			engine_id = opt_arg();
+			break;
+		case OPT_SSL_CLIENT_ENGINE:
+			ssl_client_engine_id = opt_arg();
+			break;
+		case OPT_RAND:
+			inrand = opt_arg();
+			break;
+		case OPT_IGN_EOF:
+			c_ign_eof = 1;
+			break;
+		case OPT_NO_IGN_EOF:
+			c_ign_eof = 0;
+			break;
+		case OPT_PAUSE:
+			c_Pause = 1;
+			break;
+		case OPT_DEBUG:
+			c_debug = 1;
+			break;
 #ifndef OPENSSL_NO_TLSEXT
-		else if	(strcmp(*argv,"-tlsextdebug") == 0)
-			c_tlsextdebug=1;
-		else if	(strcmp(*argv,"-status") == 0)
-			c_status_req=1;
+		case OPT_TLSEXTDEBUG:
+			c_tlsextdebug = 1;
+			break;
+		case OPT_STATUS:
+			c_status_req = 1;
+			break;
 #endif
 #ifdef WATT32
-		else if (strcmp(*argv,"-wdebug") == 0)
+		case OPT_WDEBUG:
 			dbug_init();
+			break;
 #endif
-		else if	(strcmp(*argv,"-msg") == 0)
-			c_msg=1;
-		else if	(strcmp(*argv,"-msgfile") == 0)
-			{
-			if (--argc < 1) goto bad;
-			bio_c_msg = BIO_new_file(*(++argv), "w");
-			}
+		case OPT_MSG:
+			c_msg = 1;
+			break;
+		case OPT_MSGFILE:
+			bio_c_msg = BIO_new_file(opt_arg(), "w");
+			break;
 #ifndef OPENSSL_NO_SSL_TRACE
-		else if	(strcmp(*argv,"-trace") == 0)
-			c_msg=2;
-#endif
-		else if	(strcmp(*argv,"-security_debug") == 0)
-			{ sdebug=1; }
-		else if	(strcmp(*argv,"-security_debug_verbose") == 0)
-			{ sdebug=2; }
-		else if	(strcmp(*argv,"-showcerts") == 0)
-			c_showcerts=1;
-		else if	(strcmp(*argv,"-nbio_test") == 0)
-			nbio_test=1;
-		else if	(strcmp(*argv,"-state") == 0)
-			state=1;
+		case OPT_TRACE:
+			c_msg = 2;
+			break;
+#endif
+		case OPT_SECURITY_DEBUG:
+			sdebug = 1;
+			break;
+		case OPT_SECURITY_DEBUG_VERBOSE:
+			sdebug = 2;
+			break;
+		case OPT_SHOWCERTS:
+			c_showcerts = 1;
+			break;
+		case OPT_NBIO_TEST:
+			nbio_test = 1;
+			break;
+		case OPT_STATE:
+			state = 1;
+			break;
 #ifndef OPENSSL_NO_PSK
-                else if (strcmp(*argv,"-psk_identity") == 0)
-			{
-			if (--argc < 1) goto bad;
-			psk_identity=*(++argv);
-			}
-                else if (strcmp(*argv,"-psk") == 0)
-			{
-                        size_t j;
-
-			if (--argc < 1) goto bad;
-			psk_key=*(++argv);
-			for (j = 0; j < strlen(psk_key); j++)
-                                {
-                                if (isxdigit((unsigned char)psk_key[j]))
+		case OPT_PSK_IDENTITY:
+			psk_identity = opt_arg();
+			break;
+		case OPT_PSK:
+			for (p = psk_key = opt_arg(); *p; p++) {
+                                if (isxdigit(*p))
                                         continue;
-                                BIO_printf(bio_err,"Not a hex number '%s'\n",*argv);
-                                goto bad;
-                                }
+                                BIO_printf(bio_err,"Not a hex number '%s'\n",
+					psk_key);
+                                goto end;
 			}
+			break;
 #endif
 #ifndef OPENSSL_NO_SRP
-		else if (strcmp(*argv,"-srpuser") == 0)
-			{
-			if (--argc < 1) goto bad;
-			srp_arg.srplogin= *(++argv);
-			meth=TLSv1_client_method();
-			}
-		else if (strcmp(*argv,"-srppass") == 0)
-			{
-			if (--argc < 1) goto bad;
-			srppass= *(++argv);
-			meth=TLSv1_client_method();
-			}
-		else if (strcmp(*argv,"-srp_strength") == 0)
-			{
-			if (--argc < 1) goto bad;
-			srp_arg.strength=atoi(*(++argv));
+		case OPT_SRPUSER:
+			srp_arg.srplogin = opt_arg();
+			meth = TLSv1_client_method();
+			break;
+		case OPT_SRPPASS:
+			srppass = opt_arg();
+			meth = TLSv1_client_method();
+			break;
+		case OPT_SRP_STRENGTH:
+			srp_arg.strength = atoi(opt_arg());
 			BIO_printf(bio_err,"SRP minimal length for N is %d\n",srp_arg.strength);
+			meth = TLSv1_client_method();
+			break;
+		case OPT_SRP_LATEUSER:
+			srp_lateuser = 1;
+			meth = TLSv1_client_method();
+			break;
+		case OPT_SRP_MOREGROUPS:
+			srp_arg.amp = 1;
 			meth=TLSv1_client_method();
-			}
-		else if (strcmp(*argv,"-srp_lateuser") == 0)
-			{
-			srp_lateuser= 1;
-			meth=TLSv1_client_method();
-			}
-		else if	(strcmp(*argv,"-srp_moregroups") == 0)
-			{
-			srp_arg.amp=1;
-			meth=TLSv1_client_method();
-			}
+			break;
 #endif
 #ifndef OPENSSL_NO_SSL2
-		else if	(strcmp(*argv,"-ssl2") == 0)
-			meth=SSLv2_client_method();
+		case OPT_SSL2:
+			meth = SSLv2_client_method();
+			break;
 #endif
 #ifndef OPENSSL_NO_SSL3
-		else if	(strcmp(*argv,"-ssl3") == 0)
-			meth=SSLv3_client_method();
+		case OPT_SSL3:
+			meth = SSLv3_client_method();
+			break;
 #endif
 #ifndef OPENSSL_NO_TLS1
-		else if	(strcmp(*argv,"-tls1_2") == 0)
-			meth=TLSv1_2_client_method();
-		else if	(strcmp(*argv,"-tls1_1") == 0)
-			meth=TLSv1_1_client_method();
-		else if	(strcmp(*argv,"-tls1") == 0)
-			meth=TLSv1_client_method();
+		case OPT_TLS1_2:
+			meth = TLSv1_2_client_method();
+			break;
+		case OPT_TLS1_1:
+			meth = TLSv1_1_client_method();
+			break;
+		case OPT_TLS1:
+			meth = TLSv1_client_method();
+			break;
 #endif
 #ifndef OPENSSL_NO_DTLS1
-		else if	(strcmp(*argv,"-dtls") == 0)
-			{
-			meth=DTLS_client_method();
-			socket_type=SOCK_DGRAM;
-			}
-		else if	(strcmp(*argv,"-dtls1") == 0)
-			{
-			meth=DTLSv1_client_method();
-			socket_type=SOCK_DGRAM;
-			}
-		else if	(strcmp(*argv,"-dtls1_2") == 0)
-			{
-			meth=DTLSv1_2_client_method();
-			socket_type=SOCK_DGRAM;
-			}
-		else if (strcmp(*argv,"-timeout") == 0)
-			enable_timeouts=1;
-		else if (strcmp(*argv,"-mtu") == 0)
-			{
-			if (--argc < 1) goto bad;
-			socket_mtu = atol(*(++argv));
-			}
+		case OPT_DTLS:
+			meth = DTLS_client_method();
+			socket_type = SOCK_DGRAM;
+			break;
+		case OPT_DTLS1:
+			meth = DTLSv1_client_method();
+			socket_type = SOCK_DGRAM;
+			break;
+		case OPT_DTLS1_2:
+			meth = DTLSv1_2_client_method();
+			socket_type = SOCK_DGRAM;
+			break;
+		case OPT_TIMEOUT:
+			enable_timeouts = 1;
+			break;
+		case OPT_MTU:
+			socket_mtu = atol(opt_arg());
+			break;
 #endif
-		else if	(strcmp(*argv,"-keyform") == 0)
-			{
-			if (--argc < 1) goto bad;
-			key_format = str2fmt(*(++argv));
-			}
-		else if	(strcmp(*argv,"-pass") == 0)
-			{
-			if (--argc < 1) goto bad;
-			passarg = *(++argv);
-			}
-		else if	(strcmp(*argv,"-cert_chain") == 0)
-			{
-			if (--argc < 1) goto bad;
-			chain_file= *(++argv);
-			}
-		else if	(strcmp(*argv,"-key") == 0)
-			{
-			if (--argc < 1) goto bad;
-			key_file= *(++argv);
-			}
-		else if	(strcmp(*argv,"-reconnect") == 0)
-			{
-			reconnect=5;
-			}
-		else if	(strcmp(*argv,"-CApath") == 0)
-			{
-			if (--argc < 1) goto bad;
-			CApath= *(++argv);
-			}
-		else if	(strcmp(*argv,"-chainCApath") == 0)
-			{
-			if (--argc < 1) goto bad;
-			chCApath= *(++argv);
-			}
-		else if	(strcmp(*argv,"-verifyCApath") == 0)
-			{
-			if (--argc < 1) goto bad;
-			vfyCApath= *(++argv);
-			}
-		else if	(strcmp(*argv,"-build_chain") == 0)
+		case OPT_KEYFORM:
+			opt_format(opt_arg(), 1, &key_format);
+			break;
+		case OPT_PASS:
+			passarg = opt_arg();
+			break;
+		case OPT_CERT_CHAIN:
+			chain_file = opt_arg();
+			break;
+		case OPT_KEY:
+			key_file = opt_arg();
+			break;
+		case OPT_RECONNECT:
+			reconnect = 5;
+			break;
+		case OPT_CAPATH:
+			CApath = opt_arg();
+			break;
+		case OPT_CHAINCAPATH:
+			chCApath = opt_arg();
+			break;
+		case OPT_VERIFYCAPATH:
+			vfyCApath = opt_arg();
+			break;
+		case OPT_BUILD_CHAIN:
 			build_chain = 1;
-		else if	(strcmp(*argv,"-CAfile") == 0)
-			{
-			if (--argc < 1) goto bad;
-			CAfile= *(++argv);
-			}
-		else if	(strcmp(*argv,"-chainCAfile") == 0)
-			{
-			if (--argc < 1) goto bad;
-			chCAfile= *(++argv);
-			}
-		else if	(strcmp(*argv,"-verifyCAfile") == 0)
-			{
-			if (--argc < 1) goto bad;
-			vfyCAfile= *(++argv);
-			}
+			break;
+		case OPT_CAFILE:
+			CAfile = opt_arg();
+			break;
+		case OPT_CHAINCAFILE:
+			chCAfile = opt_arg();
+			break;
+		case OPT_VERIFYCAFILE:
+			vfyCAfile = opt_arg();
+			break;
 #ifndef OPENSSL_NO_TLSEXT
-# ifndef OPENSSL_NO_NEXTPROTONEG
-		else if (strcmp(*argv,"-nextprotoneg") == 0)
-			{
-			if (--argc < 1) goto bad;
-			next_proto_neg_in = *(++argv);
-			}
-# endif
-		else if (strcmp(*argv,"-alpn") == 0)
-			{
-			if (--argc < 1) goto bad;
-			alpn_in = *(++argv);
-			}
-		else if (strcmp(*argv,"-serverinfo") == 0)
+		case OPT_NEXTPROTONEG:
+			next_proto_neg_in = opt_arg();
+			break;
+		case OPT_ALPN:
+			alpn_in = opt_arg();
+			break;
+		case OPT_SERVERINFO:
 			{
+				/* XXX RSALZ FIX */
 			char *c;
 			int start = 0;
 			int len;
 
-			if (--argc < 1) goto bad;
-			c = *(++argv);
+			c = opt_arg();
 			serverinfo_types_count = 0;
 			len = strlen(c);
-			for (i = 0; i <= len; ++i)
-				{
-				if (i == len || c[i] == ',')
-					{
+			for (i = 0; i <= len; ++i) {
+				if (i == len || c[i] == ',') {
 					serverinfo_types[serverinfo_types_count]
 					    = atoi(c+start);
 					serverinfo_types_count++;
 					start = i+1;
-					}
+				}
 				if (serverinfo_types_count == MAX_SI_TYPES)
 					break;
-				}
 			}
-#endif
-#ifdef FIONBIO
-		else if (strcmp(*argv,"-nbio") == 0)
-			{ c_nbio=1; }
-#endif
-		else if	(strcmp(*argv,"-starttls") == 0)
-			{
-			if (--argc < 1) goto bad;
-			++argv;
-			if (strcmp(*argv,"smtp") == 0)
-				starttls_proto = PROTO_SMTP;
-			else if (strcmp(*argv,"pop3") == 0)
-				starttls_proto = PROTO_POP3;
-			else if (strcmp(*argv,"imap") == 0)
-				starttls_proto = PROTO_IMAP;
-			else if (strcmp(*argv,"ftp") == 0)
-				starttls_proto = PROTO_FTP;
-			else if (strcmp(*argv, "xmpp") == 0)
-				starttls_proto = PROTO_XMPP;
-			else
-				goto bad;
-			}
-#ifndef OPENSSL_NO_ENGINE
-		else if	(strcmp(*argv,"-engine") == 0)
-			{
-			if (--argc < 1) goto bad;
-			engine_id = *(++argv);
-			}
-		else if	(strcmp(*argv,"-ssl_client_engine") == 0)
-			{
-			if (--argc < 1) goto bad;
-			ssl_client_engine_id = *(++argv);
 			}
+			break;
 #endif
-		else if (strcmp(*argv,"-rand") == 0)
-			{
-			if (--argc < 1) goto bad;
-			inrand= *(++argv);
-			}
+		case OPT_STARTTLS:
+			if (!opt_pair(opt_arg(), services, &starttls_proto))
+				goto end;
 #ifndef OPENSSL_NO_TLSEXT
-		else if (strcmp(*argv,"-servername") == 0)
-			{
-			if (--argc < 1) goto bad;
-			servername= *(++argv);
+		case OPT_SERVERNAME:
+			servername = opt_arg();
 			/* meth=TLSv1_client_method(); */
-			}
+			break;
 #endif
 #ifndef OPENSSL_NO_JPAKE
-		else if (strcmp(*argv,"-jpake") == 0)
-			{
-			if (--argc < 1) goto bad;
-			jpake_secret = *++argv;
-			}
+		case OPT_JPAKE:
+			jpake_secret = opt_arg();
+			break;
 #endif
-		else if (strcmp(*argv,"-use_srtp") == 0)
-			{
-			if (--argc < 1) goto bad;
-			srtp_profiles = *(++argv);
-			}
-		else if (strcmp(*argv,"-keymatexport") == 0)
-			{
-			if (--argc < 1) goto bad;
-			keymatexportlabel= *(++argv);
-			}
-		else if (strcmp(*argv,"-keymatexportlen") == 0)
-			{
-			if (--argc < 1) goto bad;
-			keymatexportlen=atoi(*(++argv));
-			if (keymatexportlen == 0) goto bad;
-			}
-                else
-			{
-			BIO_printf(bio_err,"unknown option %s\n",*argv);
-			badop=1;
+		case OPT_USE_SRTP:
+			srtp_profiles = opt_arg();
+			break;
+		case OPT_KEYMATEXPORT:
+			keymatexportlabel = opt_arg();
+			break;
+		case OPT_KEYMATEXPORTLEN:
+			keymatexportlen = atoi(opt_arg());
 			break;
-			}
-		argc--;
-		argv++;
-		}
-	if (badop)
-		{
-bad:
-		sc_usage();
-		goto end;
 		}
+	}
 
-	if (unix_path && (socket_type != SOCK_STREAM))
-		{
+
+	if (unix_path && (socket_type != SOCK_STREAM)) {
 		BIO_printf(bio_err, "Can't use unix sockets and datagrams together\n");
-			goto end;
+		goto end;
 		}
 #if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
-	if (jpake_secret)
-		{
-		if (psk_key)
-			{
+	if (jpake_secret) {
+		if (psk_key) {
 			BIO_printf(bio_err,
 				   "Can't use JPAKE and PSK together\n");
 			goto end;
-			}
-		psk_identity = "JPAKE";
 		}
+		psk_identity = "JPAKE";
+	}
 #endif
 
 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
 	next_proto.status = -1;
-	if (next_proto_neg_in)
-		{
+	if (next_proto_neg_in) {
 		next_proto.data = next_protos_parse(&next_proto.len, next_proto_neg_in);
-		if (next_proto.data == NULL)
-			{
+		if (next_proto.data == NULL) {
 			BIO_printf(bio_err, "Error parsing -nextprotoneg argument\n");
 			goto end;
-			}
 		}
+	}
 	else
 		next_proto.data = NULL;
 #endif
 
 #ifndef OPENSSL_NO_ENGINE
         e = setup_engine(bio_err, engine_id, 1);
-	if (ssl_client_engine_id)
-		{
+	if (ssl_client_engine_id) {
 		ssl_client_engine = ENGINE_by_id(ssl_client_engine_id);
-		if (!ssl_client_engine)
-			{
+		if (ssl_client_engine == NULL) {
 			BIO_printf(bio_err,
 					"Error getting client auth engine\n");
 			goto end;
-			}
 		}
-
+	}
 #endif
-	if (!app_passwd(bio_err, passarg, NULL, &pass, NULL))
-		{
+
+	if (!app_passwd(bio_err, passarg, NULL, &pass, NULL)) {
 		BIO_printf(bio_err, "Error getting password\n");
 		goto end;
-		}
+	}
 
 	if (key_file == NULL)
 		key_file = cert_file;
 
 
-	if (key_file)
-
-		{
-
+	if (key_file) {
 		key = load_key(bio_err, key_file, key_format, 0, pass, e,
 			       "client certificate private key file");
-		if (!key)
-			{
+		if (key == NULL) {
 			ERR_print_errors(bio_err);
 			goto end;
-			}
-
 		}
+	}
 
-	if (cert_file)
-
-		{
+	if (cert_file) {
 		cert = load_cert(bio_err,cert_file,cert_format,
 				NULL, e, "client certificate file");
-
-		if (!cert)
-			{
+		if (cert == NULL) {
 			ERR_print_errors(bio_err);
 			goto end;
-			}
 		}
+	}
 
-	if (chain_file)
-		{
+	if (chain_file) {
 		chain = load_certs(bio_err, chain_file,FORMAT_PEM,
 					NULL, e, "client certificate chain");
 		if (!chain)
 			goto end;
-		}
+	}
 
-	if (crl_file)
-		{
+	if (crl_file) {
 		X509_CRL *crl;
 		crl = load_crl(crl_file, crl_format);
-		if (!crl)
-			{
+		if (crl == NULL) {
 			BIO_puts(bio_err, "Error loading CRL\n");
 			ERR_print_errors(bio_err);
 			goto end;
-			}
+		}
 		crls = sk_X509_CRL_new_null();
-		if (!crls || !sk_X509_CRL_push(crls, crl))
-			{
+		if (crls == NULL || !sk_X509_CRL_push(crls, crl)) {
 			BIO_puts(bio_err, "Error adding CRL\n");
 			ERR_print_errors(bio_err);
 			X509_CRL_free(crl);
 			goto end;
-			}
 		}
+	}
 
 	if (!load_excert(&exc, bio_err))
 		goto end;
 
 	if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL
-		&& !RAND_status())
-		{
+		&& !RAND_status()) {
 		BIO_printf(bio_err,"warning, not much extra random data, consider using the -rand option\n");
-		}
-	if (inrand != NULL)
+	}
+	if (inrand != NULL) {
+		randamt = app_RAND_load_files(inrand);
 		BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
-			app_RAND_load_files(inrand));
+				randamt);
+	}
 
-	if (bio_c_out == NULL)
-		{
-		if (c_quiet && !c_debug)
-			{
+	if (bio_c_out == NULL) {
+		if (c_quiet && !c_debug) {
 			bio_c_out=BIO_new(BIO_s_null());
 			if (c_msg && !bio_c_msg)
 				bio_c_msg=dup_bio_out();
-			}
-		else
-			{
-			if (bio_c_out == NULL)
-				bio_c_out=dup_bio_out();
-			}
 		}
+		else if (bio_c_out == NULL)
+			bio_c_out=dup_bio_out();
+	}
 
 #ifndef OPENSSL_NO_SRP
-	if(!app_passwd(bio_err, srppass, NULL, &srp_arg.srppassin, NULL))
-		{
+	if(!app_passwd(bio_err, srppass, NULL, &srp_arg.srppassin, NULL)) {
 		BIO_printf(bio_err, "Error getting password\n");
 		goto end;
-		}
+	}
 #endif
 
 	ctx=SSL_CTX_new(meth);
-	if (ctx == NULL)
-		{
+	if (ctx == NULL) {
 		ERR_print_errors(bio_err);
 		goto end;
 		}
@@ -1278,40 +1247,32 @@ bad:
 	if (vpmtouched)
 		SSL_CTX_set1_param(ctx, vpm);
 
-	if (!args_ssl_call(ctx, bio_err, cctx, ssl_args, 1, no_jpake))
-		{
+	if (!args_ssl_call(ctx, bio_err, cctx, ssl_args, 1, jpake_secret==NULL)) {
 		ERR_print_errors(bio_err);
 		goto end;
-		}
+	}
 
 	if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile,
-						crls, crl_download))
-		{
+						crls, crl_download)) {
 		BIO_printf(bio_err, "Error loading store locations\n");
 		ERR_print_errors(bio_err);
 		goto end;
-		}
+	}
 
 #ifndef OPENSSL_NO_ENGINE
-	if (ssl_client_engine)
-		{
-		if (!SSL_CTX_set_client_cert_engine(ctx, ssl_client_engine))
-			{
+	if (ssl_client_engine) {
+		if (!SSL_CTX_set_client_cert_engine(ctx, ssl_client_engine)) {
 			BIO_puts(bio_err, "Error setting client auth engine\n");
 			ERR_print_errors(bio_err);
 			ENGINE_free(ssl_client_engine);
 			goto end;
-			}
-		ENGINE_free(ssl_client_engine);
 		}
+		ENGINE_free(ssl_client_engine);
+	}
 #endif
 
 #ifndef OPENSSL_NO_PSK
-#ifdef OPENSSL_NO_JPAKE
-	if (psk_key != NULL)
-#else
 	if (psk_key != NULL || jpake_secret)
-#endif
 		{
 		if (c_debug)
 			BIO_printf(bio_c_out, "PSK key given or JPAKE in use, setting client callback\n");
@@ -1320,7 +1281,10 @@ bad:
 	if (srtp_profiles != NULL)
 		SSL_CTX_set_tlsext_use_srtp(ctx, srtp_profiles);
 #endif
-	if (exc) ssl_ctx_set_excert(ctx, exc);
+
+	if (exc)
+		ssl_ctx_set_excert(ctx, exc);
+
 	/* DTLS: partial reads end up discarding unread UDP bytes :-( 
 	 * Setting read ahead solves this problem.
 	 */
@@ -1331,49 +1295,41 @@ bad:
 	if (next_proto.data)
 		SSL_CTX_set_next_proto_select_cb(ctx, next_proto_cb, &next_proto);
 # endif
-	if (alpn_in)
-		{
+	if (alpn_in) {
 		unsigned short alpn_len;
 		unsigned char *alpn = next_protos_parse(&alpn_len, alpn_in);
 
-		if (alpn == NULL)
-			{
+		if (alpn == NULL) {
 			BIO_printf(bio_err, "Error parsing -alpn argument\n");
 			goto end;
-			}
+		}
 		SSL_CTX_set_alpn_protos(ctx, alpn, alpn_len);
 		OPENSSL_free(alpn);
-		}
+	}
 #endif
 #ifndef OPENSSL_NO_TLSEXT
-		if (serverinfo_types_count)
-			{
-			for (i = 0; i < serverinfo_types_count; i++)
-				{
-				SSL_CTX_set_custom_cli_ext(ctx,
-							   serverinfo_types[i],
-							   NULL, 
-							   serverinfo_cli_cb,
-							   NULL);
-				}
-			}
+	if (serverinfo_types_count) {
+		for (i = 0; i < serverinfo_types_count; i++) {
+			SSL_CTX_set_custom_cli_ext(ctx,
+					serverinfo_types[i],
+					NULL, 
+					serverinfo_cli_cb,
+					NULL);
+		}
+	}
 #endif
 
-	if (state) SSL_CTX_set_info_callback(ctx,apps_ssl_info_callback);
-#if 0
-	else
-		SSL_CTX_set_cipher_list(ctx,getenv("SSL_CIPHER"));
-#endif
+	if (state)
+		SSL_CTX_set_info_callback(ctx,apps_ssl_info_callback);
 
 	SSL_CTX_set_verify(ctx,verify,verify_callback);
 
-	if ((!SSL_CTX_load_verify_locations(ctx,CAfile,CApath)) ||
-		(!SSL_CTX_set_default_verify_paths(ctx)))
-		{
+	if (!SSL_CTX_load_verify_locations(ctx,CAfile,CApath)
+	|| !SSL_CTX_set_default_verify_paths(ctx)) {
 		/* BIO_printf(bio_err,"error setting default verify locations\n"); */
 		ERR_print_errors(bio_err);
 		/* goto end; */
-		}
+	}
 
 	ssl_ctx_add_crls(ctx, crls, crl_download);
 
@@ -1381,20 +1337,17 @@ bad:
 		goto end;
 
 #ifndef OPENSSL_NO_TLSEXT
-	if (servername != NULL)
-		{
+	if (servername != NULL) {
 		tlsextcbp.biodebug = bio_err;
 		SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);
 		SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp);
 		}
 #ifndef OPENSSL_NO_SRP
-        if (srp_arg.srplogin)
-		{
-		if (!srp_lateuser && !SSL_CTX_set_srp_username(ctx, srp_arg.srplogin))
-			{
+        if (srp_arg.srplogin) {
+		if (!srp_lateuser && !SSL_CTX_set_srp_username(ctx, srp_arg.srplogin)) {
 			BIO_printf(bio_err,"Unable to set SRP username\n");
 			goto end;
-			}
+		}
 		srp_arg.msg = c_msg;
 		srp_arg.debug = c_debug ;
 		SSL_CTX_set_srp_cb_arg(ctx,&srp_arg);
@@ -1402,7 +1355,7 @@ bad:
 		SSL_CTX_set_srp_strength(ctx, srp_arg.strength);
 		if (c_msg || c_debug || srp_arg.amp == 0)
 			SSL_CTX_set_srp_verify_param_callback(ctx, ssl_srp_verify_param_cb);
-		}
+	}
 
 #endif
 #endif
diff --git a/apps/s_server.c b/apps/s_server.c
index 9836771505..6a14a8e938 100644
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -209,7 +209,6 @@ static int sv_body(char *hostname, int s, int stype, unsigned char *context);
 static int www_body(char *hostname, int s, int stype, unsigned char *context);
 static int rev_body(char *hostname, int s, int stype, unsigned char *context);
 static void close_accept_socket(void );
-static void sv_usage(void);
 static int init_ssl_connection(SSL *s);
 static void print_stats(BIO *bp,SSL_CTX *ctx);
 static int generate_session_id(const SSL *ssl, unsigned char *id,
@@ -289,122 +288,6 @@ static const char *s_serverinfo_file = NULL;
 
 #endif
 
-const char* s_server_help[]={
-	"-accept port   TCP/IP port to accept on (default is " PORT_STR ")",
-	"-unix path     unix domain socket to accept on",
-	"-unlink        for -unix, unlink existing socket first",
-	"-context arg   set session ID context",
-	"-verify arg    turn on peer certificate verification",
-	"-Verify arg    turn on peer certificate verification, must have a cert.",
-	"-cert arg      certificate file to use (default is ", TEST_CERT ")",
-	"-naccept arg   terminate after 'arg' connections",
-#ifndef OPENSSL_NO_TLSEXT
-	"-serverinfo arg  PEM serverinfo file for certificate",
-	"-auth           send and receive RFC 5878 TLS auth extensions and supplemental data",
-	"-auth_require_reneg  do not send TLS auth extensions until renegotiation",
-#endif
-	"-no_resumption_on_reneg  set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION flag",
-	"-crl_check     check the peer certificate has not been revoked by its CA.",
-	"               the CRL(s) are appended to the certificate file",
-	"-crl_check_all check the peer certificate has not been revoked by its CA",
-	"               or any other CRL in the CA chain. CRL(s) are appened to the",
-	"               the certificate file.",
-	"-certform arg  certificate format (PEM or DER) PEM default",
-	"-key arg       private Key file to use, in cert file if",
-	"               not specified (default is " TEST_CERT ")",
-	"-keyform arg   key format (PEM, DER or ENGINE) PEM default",
-	"-pass arg      private key file pass phrase source",
-	"-dcert arg     second certificate file to use (usually for DSA)",
-	"-dcertform x   second certificate format (PEM or DER) PEM default",
-	"-dkey arg      second private key file to use (usually for DSA)",
-	"-dkeyform arg  second key format (PEM, DER or ENGINE) PEM default",
-	"-dpass arg     second private key file pass phrase source",
-	"-dhparam arg   DH parameter file to use, in cert file if not specified",
-	"               or a default set of parameters is used",
-#ifndef OPENSSL_NO_ECDH
-	"-named_curve arg  elliptic curve name to use for ephemeral ECDH keys",
-	"               use \"openssl ecparam -list_curves\" for all names" \
-	"               (default is nistp256).",
-#endif
-#ifdef FIONBIO
-	"-nbio          use non-blocking IO",
-#endif
-	"-nbio_test     test with the non-blocking test bio",
-	"-crlf          convert LF from terminal into CRLF",
-	"-debug         print more output",
-	"-msg           show protocol messages",
-	"-state         print the SSL states",
-	"-CApath arg    PEM format directory of CA's",
-	"-CAfile arg    PEM format file of CA's",
-	"-trusted_first use locally trusted CA's first when building trust chain",
-	"-nocert        don't use any certificates (Anon-DH)",
-	"-cipher arg    play with 'openssl ciphers' to see what goes here",
-	"-serverpref    use server's cipher preferences",
-	"-quiet         no server output",
-	"-no_tmp_rsa    do not generate a tmp RSA key",
-#ifndef OPENSSL_NO_PSK
-	"-psk_hint arg  PSK identity hint to use",
-	"-psk arg       PSK in hex (without 0x)",
-# ifndef OPENSSL_NO_JPAKE
-	"-jpake arg     JPAKE secret to use",
-# endif
-#endif
-#ifndef OPENSSL_NO_SRP
-	"-srpvfile file the verifier file for SRP",
-	"-srpuserseed string  a seed string for a default user salt",
-#endif
-	"-ssl2         just talk SSLv2",
-	"-ssl3         just talk SSLv3",
-	"-tls1_2       just talk TLSv1.2",
-	"-tls1_1       just talk TLSv1.1",
-	"-tls1         just talk TLSv1",
-	"-dtls1        just talk DTLSv1",
-	"-dtls1_2      just talk DTLSv1.2",
-	"-timeout      enable timeouts",
-	"-mtu          set link layer MTU",
-	"-chain        read a certificate chain",
-	"-no_ssl2      just disable SSLv2",
-	"-no_ssl3      just disable SSLv3",
-	"-no_tls1      just disable TLSv1",
-	"-no_tls1_1    just disable TLSv1.1",
-	"-no_tls1_2    just disable TLSv1.2",
-#ifndef OPENSSL_NO_DH
-	"-no_dhe       disable ephemeral DH",
-#endif
-#ifndef OPENSSL_NO_ECDH
-	"-no_ecdhe     disable ephemeral ECDH",
-#endif
-	"-no_resume_ephemeral  disable caching and tickets if ephemeral (EC)DH is used",
-	"-bugs         turn on SSL bug compatibility",
-	"-www          respond to a 'GET /' with a status page",
-	"-WWW          respond to a 'GET /<path> HTTP/1.0' with file ./<path>",
-	"-HTTP         respond to a 'GET /<path> HTTP/1.0' with file ./<path>",
-        "              with the assumption it contains a complete HTTP response",
-#ifndef OPENSSL_NO_ENGINE
-	"-engine id    initialise and use the specified engine",
-#endif
-	"-id_prefix arg  generate SSL/TLS session IDs prefixed by arg",
-	"-rand file... load the file(s) into the random number generator",
-#ifndef OPENSSL_NO_TLSEXT
-	"-servername host  servername for HostName TLS extension",
-	"-servername_fatal on mismatch send fatal alert (default warning alert)",
-	"-cert2 arg    certificate file to use for servername",
-	"              (default is ", TEST_CERT2 ")",
-	"-key2 arg     private Key file to use for servername, in cert file if",
-	"              not specified (default is " TEST_CERT2 ")",
-	"-tlsextdebug  hex dump of all TLS extensions received",
-	"-no_ticket    disable use of RFC4507bis session tickets",
-	"-legacy_renegotiation  enable use of legacy renegotiation (dangerous)",
-#ifndef OPENSSL_NO_NEXTPROTONEG
-	"-nextprotoneg arg  set the advertised protocols for the NPN extension (comma-separated list)",
-#endif
-	"-use_srtp profiles offer SRTP key management with a colon-separated profile list",
-	"-alpn arg     set the advertised protocols for the ALPN extension (comma-separated list)",
-#endif
-	"-keymatexport label   export keying material using label",
-	"-keymatexportlen len  export len bytes of keying material (default 20)",
-	NULL
-};
 
 #ifndef OPENSSL_NO_PSK
 static char *psk_identity="Client_identity";
@@ -521,44 +404,35 @@ static int ssl_srp_server_param_cb(SSL *s, int *ad, void *arg)
 
 static void s_server_init(void)
 	{
-	accept_socket=-1;
-	s_server_verify=SSL_VERIFY_NONE;
-	s_dcert_file=NULL;
-	s_dkey_file=NULL;
-	s_dchain_file=NULL;
-	s_cert_file=TEST_CERT;
-	s_key_file=NULL;
-	s_chain_file=NULL;
+	accept_socket = -1;
+	verify_depth = 0;
+	s_server_verify = SSL_VERIFY_NONE;
+	s_dcert_file = NULL;
+	s_dkey_file = NULL;
+	s_dchain_file = NULL;
+	s_cert_file = TEST_CERT;
+	s_key_file = NULL;
+	s_chain_file = NULL;
 #ifndef OPENSSL_NO_TLSEXT
-	s_cert_file2=TEST_CERT2;
-	s_key_file2=NULL;
-	ctx2=NULL;
-#endif
-#ifdef FIONBIO
-	s_nbio=0;
-#endif
-	s_nbio_test=0;
-	ctx=NULL;
-	www=0;
-
-	bio_s_out=NULL;
-	s_debug=0;
-	s_msg=0;
-	s_quiet=0;
-	s_brief=0;
-	hack=0;
+	s_cert_file2 = TEST_CERT2;
+	s_key_file2 = NULL;
+	ctx2 = NULL;
+#endif
+	s_nbio = 0;
+	s_nbio_test = 0;
+	ctx = NULL;
+	www = 0;
+	bio_s_out = NULL;
+	s_debug = 0;
+	s_msg = 0;
+	s_quiet = 0;
+	s_brief = 0;
+	hack = 0;
 #ifndef OPENSSL_NO_ENGINE
-	engine_id=NULL;
+	engine_id = NULL;
 #endif
 	}
 
-static void sv_usage(void)
-	{
-	BIO_printf(bio_err,"usage: s_server [args ...]\n");
-	BIO_printf(bio_err,"\n");
-	printhelp(s_server_help);
-	}
-
 static int local_argc=0;
 static char **local_argv;
 
@@ -959,6 +833,266 @@ static srpsrvparm srp_callback_parm;
 #endif
 static char *srtp_profiles = NULL;
 
+const char* s_server_help[]={
+	"-accept port   TCP/IP port to accept on (default is " PORT_STR ")",
+	"-unix path     unix domain socket to accept on",
+	"-unlink        for -unix, unlink existing socket first",
+	"-context arg   set session ID context",
+	"-verify arg    turn on peer certificate verification",
+	"-Verify arg    turn on peer certificate verification, must have a cert.",
+	"-cert arg      certificate file to use (default is ", TEST_CERT ")",
+	"-naccept arg   terminate after 'arg' connections",
+#ifndef OPENSSL_NO_TLSEXT
+	"-serverinfo arg  PEM serverinfo file for certificate",
+	"-auth           send and receive RFC 5878 TLS auth extensions and supplemental data",
+	"-auth_require_reneg  do not send TLS auth extensions until renegotiation",
+#endif
+	"-no_resumption_on_reneg  set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION flag",
+	"-crl_check     check the peer certificate has not been revoked by its CA.",
+	"               the CRL(s) are appended to the certificate file",
+	"-crl_check_all check the peer certificate has not been revoked by its CA",
+	"               or any other CRL in the CA chain. CRL(s) are appened to the",
+	"               the certificate file.",
+	"-certform arg  certificate format (PEM or DER) PEM default",
+	"-key arg       private Key file to use, in cert file if",
+	"               not specified (default is " TEST_CERT ")",
+	"-keyform arg   key format (PEM, DER or ENGINE) PEM default",
+	"-pass arg      private key file pass phrase source",
+	"-dcert arg     second certificate file to use (usually for DSA)",
+	"-dcertform x   second certificate format (PEM or DER) PEM default",
+	"-dkey arg      second private key file to use (usually for DSA)",
+	"-dkeyform arg  second key format (PEM, DER or ENGINE) PEM default",
+	"-dpass arg     second private key file pass phrase source",
+	"-dhparam arg   DH parameter file to use, in cert file if not specified",
+	"               or a default set of parameters is used",
+#ifndef OPENSSL_NO_ECDH
+	"-named_curve arg  elliptic curve name to use for ephemeral ECDH keys",
+	"               use \"openssl ecparam -list_curves\" for all names" \
+	"               (default is nistp256).",
+#endif
+#ifdef FIONBIO
+	"-nbio          use non-blocking IO",
+#endif
+	"-nbio_test     test with the non-blocking test bio",
+	"-crlf          convert LF from terminal into CRLF",
+	"-debug         print more output",
+	"-msg           show protocol messages",
+	"-state         print the SSL states",
+	"-CApath arg    PEM format directory of CA's",
+	"-CAfile arg    PEM format file of CA's",
+	"-trusted_first use locally trusted CA's first when building trust chain",
+	"-nocert        don't use any certificates (Anon-DH)",
+	"-cipher arg    play with 'openssl ciphers' to see what goes here",
+	"-serverpref    use server's cipher preferences",
+	"-quiet         no server output",
+	"-no_tmp_rsa    do not generate a tmp RSA key",
+#ifndef OPENSSL_NO_PSK
+	"-psk_hint arg  PSK identity hint to use",
+	"-psk arg       PSK in hex (without 0x)",
+# ifndef OPENSSL_NO_JPAKE
+	"-jpake arg     JPAKE secret to use",
+# endif
+#endif
+#ifndef OPENSSL_NO_SRP
+	"-srpvfile file the verifier file for SRP",
+	"-srpuserseed string  a seed string for a default user salt",
+#endif
+	"-ssl2         just talk SSLv2",
+	"-ssl3         just talk SSLv3",
+	"-tls1_2       just talk TLSv1.2",
+	"-tls1_1       just talk TLSv1.1",
+	"-tls1         just talk TLSv1",
+	"-dtls1        just talk DTLSv1",
+	"-dtls1_2      just talk DTLSv1.2",
+	"-timeout      enable timeouts",
+	"-mtu          set link layer MTU",
+	"-chain        read a certificate chain",
+	"-no_ssl2      just disable SSLv2",
+	"-no_ssl3      just disable SSLv3",
+	"-no_tls1      just disable TLSv1",
+	"-no_tls1_1    just disable TLSv1.1",
+	"-no_tls1_2    just disable TLSv1.2",
+#ifndef OPENSSL_NO_DH
+	"-no_dhe       disable ephemeral DH",
+#endif
+#ifndef OPENSSL_NO_ECDH
+	"-no_ecdhe     disable ephemeral ECDH",
+#endif
+	"-no_resume_ephemeral  disable caching and tickets if ephemeral (EC)DH is used",
+	"-bugs         turn on SSL bug compatibility",
+	"-www          respond to a 'GET /' with a status page",
+	"-WWW          respond to a 'GET /<path> HTTP/1.0' with file ./<path>",
+	"-HTTP         respond to a 'GET /<path> HTTP/1.0' with file ./<path>",
+        "              with the assumption it contains a complete HTTP response",
+#ifndef OPENSSL_NO_ENGINE
+	"-engine id    initialise and use the specified engine",
+#endif
+	"-id_prefix arg  generate SSL/TLS session IDs prefixed by arg",
+	"-rand file... load the file(s) into the random number generator",
+#ifndef OPENSSL_NO_TLSEXT
+	"-servername host  servername for HostName TLS extension",
+	"-servername_fatal on mismatch send fatal alert (default warning alert)",
+	"-cert2 arg    certificate file to use for servername",
+	"              (default is ", TEST_CERT2 ")",
+	"-key2 arg     private Key file to use for servername, in cert file if",
+	"              not specified (default is " TEST_CERT2 ")",
+	"-tlsextdebug  hex dump of all TLS extensions received",
+	"-no_ticket    disable use of RFC4507bis session tickets",
+	"-legacy_renegotiation  enable use of legacy renegotiation (dangerous)",
+#ifndef OPENSSL_NO_NEXTPROTONEG
+	"-nextprotoneg arg  set the advertised protocols for the NPN extension (comma-separated list)",
+#endif
+	"-use_srtp profiles offer SRTP key management with a colon-separated profile list",
+	"-alpn arg     set the advertised protocols for the ALPN extension (comma-separated list)",
+#endif
+	"-keymatexport label   export keying material using label",
+	"-keymatexportlen len  export len bytes of keying material (default 20)",
+	NULL
+};
+
+enum options {
+	OPT_ERR = -1, OPT_EOF = 0,
+	OPT_ENGINE, OPT_PORT, OPT_UNIX, OPT_UNLINK, OPT_NACCEPT,
+	OPT_VERIFY, OPT_UPPER_V_VERIFY, OPT_CONTEXT, OPT_CERT, OPT_CRL,
+	OPT_CRL_DOWNLOAD, OPT_SERVERINFO, OPT_CERTFORM, OPT_KEY, OPT_KEYFORM,
+	OPT_PASS, OPT_CERT_CHAIN, OPT_DHPARAM, OPT_DCERTFORM, OPT_DCERT,
+	OPT_DKEYFORM, OPT_DPASS, OPT_DKEY, OPT_DCERT_CHAIN, OPT_NOCERT,
+	OPT_CAPATH, OPT_CHAINCAPATH, OPT_VERIFYCAPATH, OPT_NO_CACHE,
+	OPT_EXT_CACHE, OPT_CRLFORM, OPT_VERIFY_RET_ERROR, OPT_VERIFY_QUIET,
+	OPT_BUILD_CHAIN, OPT_CAFILE, OPT_CHAINCAFILE, OPT_VERIFYCAFILE,
+	OPT_NBIO, OPT_NBIO_TEST, OPT_IGN_EOF, OPT_NO_IGN_EOF, OPT_DEBUG,
+	OPT_TLSEXTDEBUG, OPT_STATUS, OPT_STATUS_VERBOSE, OPT_STATUS_TIMEOUT,
+	OPT_STATUS_URL, OPT_MSG, OPT_MSGFILE, OPT_TRACE, OPT_SECURITY_DEBUG,
+	OPT_SECURITY_DEBUG_VERBOSE, OPT_STATE, OPT_HACK, OPT_CRLF, OPT_QUIET,
+	OPT_BRIEF, OPT_NO_TMP_RSA, OPT_NO_DHE, OPT_NO_ECDHE,
+	OPT_NO_RESUME_EPHEMERAL, OPT_PSK_HINT, OPT_PSK, OPT_SRPVFILE,
+	OPT_SRPUSERSEED, OPT_REV, OPT_WWW, OPT_UPPER_WWW, OPT_HTTP,
+#ifndef OPENSSL_NO_SSL2
+	OPT_SSL2,
+#endif
+#ifndef OPENSSL_NO_SSL3
+	OPT_SSL3,
+#endif
+#ifndef OPENSSL_NO_TLS1
+	OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1,
+	OPT_DTLS1_2, OPT_TIMEOUT, OPT_MTU, OPT_CHAIN,
+#endif
+	OPT_ID_PREFIX, OPT_RAND, OPT_SERVERNAME, OPT_SERVERNAME_FATAL,
+	OPT_CERT2, OPT_KEY2, OPT_NEXTPROTONEG, OPT_ALPN, OPT_JPAKE,
+	OPT_SRTP_PROFILES, OPT_KEYMATEXPORT, OPT_KEYMATEXPORTLEN,
+	OPT_S_ENUM,
+	OPT_V_ENUM,
+	OPT_X_ENUM,
+};
+
+static OPTIONS options[] = {
+#ifndef OPENSSL_NO_ENGINE
+	{ "engine", OPT_ENGINE, 's' },
+#endif
+	{ "port", OPT_PORT, 'p' },
+	{ "accept", OPT_PORT, 'p' },
+	{ "unix", OPT_UNIX, 's' },
+	{ "unlink", OPT_UNLINK, '-' },
+	{ "naccept", OPT_NACCEPT, 'n' },
+	{ "verify", OPT_VERIFY, 'n' },
+	{ "Verify", OPT_UPPER_V_VERIFY, 'n' },
+	{ "context", OPT_CONTEXT, 's' },
+	{ "cert", OPT_CERT, '<' },
+	{ "CRL", OPT_CRL, '<' },
+	{ "crl_download", OPT_CRL_DOWNLOAD, '-' },
+	{ "serverinfo", OPT_SERVERINFO, 's' },
+	{ "certform", OPT_CERTFORM, 'F' },
+	{ "key", OPT_KEY, '<' },
+	{ "keyform", OPT_KEYFORM, 'F' },
+	{ "pass", OPT_PASS, 's' },
+	{ "cert_chain", OPT_CERT_CHAIN, '<' },
+	{ "dhparam", OPT_DHPARAM, '<' },
+	{ "dcertform", OPT_DCERTFORM, 'F' },
+	{ "dcert", OPT_DCERT, '<' },
+	{ "dkeyform", OPT_DKEYFORM, 'F' },
+	{ "dpass", OPT_DPASS, 's' },
+	{ "dkey", OPT_DKEY, '<' },
+	{ "dcert_chain", OPT_DCERT_CHAIN, '<' },
+	{ "nocert", OPT_NOCERT, '-' },
+	{ "CApath", OPT_CAPATH, '/' },
+	{ "chainCApath", OPT_CHAINCAPATH, '/' },
+	{ "verifyCApath", OPT_VERIFYCAPATH, '/' },
+	{ "no_cache", OPT_NO_CACHE, '-' },
+	{ "ext_cache", OPT_EXT_CACHE, '-' },
+	{ "CRLform", OPT_CRLFORM, 'F' },
+	{ "verify_return_error", OPT_VERIFY_RET_ERROR, '-' },
+	{ "verify_quiet", OPT_VERIFY_QUIET, '-' },
+	{ "build_chain", OPT_BUILD_CHAIN, '-' },
+	{ "CAfile", OPT_CAFILE, '<' },
+	{ "chainCAfile", OPT_CHAINCAFILE, '<' },
+	{ "verifyCAfile", OPT_VERIFYCAFILE, '<' },
+	{ "nbio", OPT_NBIO, '-' },
+	{ "nbio_test", OPT_NBIO_TEST, '-' },
+	{ "ign_eof", OPT_IGN_EOF, '-' },
+	{ "no_ign_eof", OPT_NO_IGN_EOF, '-' },
+	{ "debug", OPT_DEBUG, '-' },
+	{ "tlsextdebug", OPT_TLSEXTDEBUG, '-' },
+	{ "status", OPT_STATUS, '-' },
+	{ "status_verbose", OPT_STATUS_VERBOSE, '-' },
+	{ "status_timeout", OPT_STATUS_TIMEOUT, 'n' },
+	{ "status_url", OPT_STATUS_URL, 's' },
+	{ "msg", OPT_MSG, '-' },
+	{ "msgfile", OPT_MSGFILE, '>' },
+	{ "trace", OPT_TRACE, '-' },
+	{ "security_debug", OPT_SECURITY_DEBUG, '-' },
+	{ "security_debug_verbose", OPT_SECURITY_DEBUG_VERBOSE, '-' },
+	{ "hack", OPT_HACK, '-' },
+	{ "state", OPT_STATE, '-' },
+	{ "crlf", OPT_CRLF, '-' },
+	{ "quiet", OPT_QUIET, '-' },
+	{ "brief", OPT_BRIEF, '-' },
+	{ "no_tmp_rsa", OPT_NO_TMP_RSA, '-' },
+	{ "no_dhe", OPT_NO_DHE, '-' },
+	{ "no_ecdhe", OPT_NO_ECDHE, '-' },
+	{ "no_resume_ephemeral", OPT_NO_RESUME_EPHEMERAL, '-' },
+	{ "psk_hint", OPT_PSK_HINT, 's' },
+	{ "psk", OPT_PSK, 's' },
+	{ "srpvfile", OPT_SRPVFILE, '<' },
+	{ "srpuserseed", OPT_SRPUSERSEED, 's' },
+	{ "rev", OPT_REV, '-' },
+	{ "www", OPT_WWW, '-' },
+	{ "WWW", OPT_UPPER_WWW, '-' },
+	{ "HTTP", OPT_HTTP, '-' },
+#ifndef OPENSSL_NO_SSL2
+	{ "ssl2", OPT_SSL2, '-' },
+#endif
+#ifndef OPENSSL_NO_SSL3
+	{ "ssl3", OPT_SSL3, '-' },
+#endif
+#ifndef OPENSSL_NO_TLS1
+	{ "tls1_2", OPT_TLS1_2, '-' },
+	{ "tls1_1", OPT_TLS1_1, '-' },
+	{ "tls1", OPT_TLS1, '-' },
+	{ "dtls", OPT_DTLS, '-' },
+	{ "dtls1", OPT_DTLS1, '-' },
+	{ "dtls1_2", OPT_DTLS1_2, '-' },
+	{ "timeout", OPT_TIMEOUT, '-' },
+	{ "mtu", OPT_MTU, 'p' },
+	{ "chain", OPT_CHAIN, '-' },
+#endif
+	{ "id_prefix", OPT_ID_PREFIX, 's' },
+	{ "rand", OPT_RAND, 's' },
+	{ "servername", OPT_SERVERNAME, 's' },
+	{ "servername_fatal", OPT_SERVERNAME_FATAL, '-' },
+	{ "cert2", OPT_CERT2, '<' },
+	{ "key2", OPT_KEY2, '<' },
+	{ "nextprotoneg", OPT_NEXTPROTONEG, 's' },
+	{ "alpn", OPT_ALPN, 's' },
+	{ "jpake", OPT_JPAKE, 's' },
+	{ "use_srtp", OPT_SRTP_PROFILES, '<' },
+	{ "keymatexport", OPT_KEYMATEXPORT, 's' },
+	{ "keymatexportlen", OPT_KEYMATEXPORTLEN, 'p' },
+	OPT_S_OPTIONS,
+	OPT_V_OPTIONS,
+	OPT_X_OPTIONS,
+	{ NULL }
+};
+
 int s_server_main(int argc, char *argv[])
 	{
 	ENGINE *e=NULL;
@@ -974,10 +1108,10 @@ int s_server_main(int argc, char *argv[])
 	char *CApath=NULL,*CAfile=NULL, *chCApath=NULL,*chCAfile=NULL;
 	char *dhfile=NULL, *dpassarg=NULL, *dpass=NULL, *inrand=NULL;
 	char *passarg=NULL, *pass=NULL, *vfyCApath=NULL,*vfyCAfile=NULL;
-	char *crl_file=NULL;
+	char *crl_file=NULL, *prog, *p;
 	const char *unix_path=NULL;
 	int (*server_cb)(char *hostname, int s, int stype, unsigned char *context);
-	int badarg=0, badop=0, build_chain=0, no_cache=0, ext_cache=0;
+	int vpmtouched=0, build_chain=0, no_cache=0, ext_cache=0;
 	int no_tmp_rsa=0,no_dhe=0,no_ecdhe=0,nocert=0, ret=1;
 	int s_cert_format=FORMAT_PEM, s_key_format=FORMAT_PEM;
 	int s_dcert_format=FORMAT_PEM, s_dkey_format=FORMAT_PEM;
@@ -986,7 +1120,6 @@ int s_server_main(int argc, char *argv[])
 	int crl_format=FORMAT_PEM, crl_download=0;
 	short port=PORT;
 	unsigned char *context=NULL;
-
 #ifndef OPENSSL_NO_TLSEXT
 	EVP_PKEY *s_key2=NULL;
 	X509 *s_cert2=NULL;
@@ -1006,442 +1139,395 @@ int s_server_main(int argc, char *argv[])
 	char *srpuserseed=NULL;
 	char *srp_verifier_file=NULL;
 #endif
+	enum options o;
 
-
-	local_argc=argc;
-	local_argv=argv;
+	local_argc = argc;
+	local_argv = argv;
 
 	s_server_init();
 	cctx = SSL_CONF_CTX_new();
-	if (!cctx)
+	vpm = X509_VERIFY_PARAM_new();
+	if (cctx == NULL || vpm == NULL)
 		goto end;
 	SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_SERVER);
 	SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CMDLINE);
-	if ((vpm = X509_VERIFY_PARAM_new()) == NULL)
-		return 1;
-
-
-	verify_depth=0;
-#ifdef FIONBIO
-	s_nbio=0;
-#endif
-	s_nbio_test=0;
 
-	argc--;
-	argv++;
+	prog = opt_init(argc, argv, options);
+	while ((o = opt_next()) != OPT_EOF) {
+		switch (o) {
+		case OPT_EOF:
+		case OPT_ERR:
+err:
+			BIO_printf(bio_err,"Valid options are:\n");
+			printhelp(s_server_help);
+			goto end;
 
-	while (argc >= 1)
-		{
-		if	((strcmp(*argv,"-port") == 0) ||
-			 (strcmp(*argv,"-accept") == 0))
-			{
+		case OPT_PORT:
 			if (!extract_port(opt_arg(),&port))
-				goto bad;
-			}
-		else if (strcmp(*argv,"-unix") == 0)
-			{
+				goto end;
+			break;
+		case OPT_UNIX:
 #ifdef NO_SYS_UN_H
 			BIO_printf(bio_err, "unix domain sockets unsupported\n");
-			goto bad;
+			goto end;
 #else
 			unix_path = opt_arg();
 #endif
-			}
-		else if (strcmp(*argv,"-unlink") == 0)
-			{
+			break;
+		case OPT_UNLINK:
 #ifdef NO_SYS_UN_H
 			BIO_printf(bio_err, "unix domain sockets unsupported\n");
-			goto bad;
+			goto end;
 #else
 			unlink_unix_path = 1;
 #endif
-			}
-		else if	(strcmp(*argv,"-naccept") == 0)
-			{
+			break;
+		case OPT_NACCEPT:
 			naccept = atol(opt_arg());
-			if (naccept <= 0)
-				{
-				BIO_printf(bio_err, "bad accept value %s\n",
-							*argv);
-				goto bad;
-				}
-			}
-		else if	(strcmp(*argv,"-verify") == 0)
-			{
-			s_server_verify=SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE;
-			verify_depth=atoi(opt_arg());
+			break;
+		case OPT_VERIFY:
+			s_server_verify = SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE;
+			verify_depth = atoi(opt_arg());
 			if (!s_quiet)
 				BIO_printf(bio_err,"verify depth is %d\n",verify_depth);
-			}
-		else if	(strcmp(*argv,"-Verify") == 0)
-			{
-			s_server_verify=SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT|
+			break;
+		case OPT_UPPER_V_VERIFY:
+			s_server_verify = SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT|
 				SSL_VERIFY_CLIENT_ONCE;
-			verify_depth=atoi(opt_arg());
+			verify_depth = atoi(opt_arg());
 			if (!s_quiet)
 				BIO_printf(bio_err,"verify depth is %d, must return a certificate\n",verify_depth);
-			}
-		else if	(strcmp(*argv,"-context") == 0)
-			{
-			context= (unsigned char *)opt_arg();
-			}
-		else if	(strcmp(*argv,"-cert") == 0)
-			{
-			s_cert_file= opt_arg();
-			}
-		else if	(strcmp(*argv,"-CRL") == 0)
-			{
-			crl_file= opt_arg();
-			}
-		else if	(strcmp(*argv,"-crl_download") == 0)
+			break;
+		case OPT_CONTEXT:
+			context = (unsigned char *)opt_arg();
+			break;
+		case OPT_CERT:
+			s_cert_file = opt_arg();
+			break;
+		case OPT_CRL:
+			crl_file = opt_arg();
+			break;
+		case OPT_CRL_DOWNLOAD:
 			crl_download = 1;
+			break;
 #ifndef OPENSSL_NO_TLSEXT
-		else if	(strcmp(*argv,"-serverinfo") == 0)
-			{
+		case OPT_SERVERINFO:
 			s_serverinfo_file = opt_arg();
-			}
+			break;
 #endif
-		else if	(strcmp(*argv,"-certform") == 0)
-			{
-			s_cert_format = str2fmt(opt_arg());
-			}
-		else if	(strcmp(*argv,"-key") == 0)
-			{
+		case OPT_CERTFORM:
+			opt_format(opt_arg(), 1, &s_cert_format);
+			break;
+		case OPT_KEY:
 			s_key_file= opt_arg();
-			}
-		else if	(strcmp(*argv,"-keyform") == 0)
-			{
-			s_key_format = str2fmt(opt_arg());
-			}
-		else if	(strcmp(*argv,"-pass") == 0)
-			{
+			break;
+		case OPT_KEYFORM:
+			opt_format(opt_arg(), 1, &s_key_format);
+			break;
+		case OPT_PASS:
 			passarg = opt_arg();
-			}
-		else if	(strcmp(*argv,"-cert_chain") == 0)
-			{
-			s_chain_file= opt_arg();
-			}
-		else if	(strcmp(*argv,"-dhparam") == 0)
-			{
+			break;
+		case OPT_CERT_CHAIN:
+			s_chain_file = opt_arg();
+			break;
+		case OPT_DHPARAM:
 			dhfile = opt_arg();
-			}
-		else if	(strcmp(*argv,"-dcertform") == 0)
-			{
-			s_dcert_format = str2fmt(opt_arg());
-			}
-		else if	(strcmp(*argv,"-dcert") == 0)
-			{
-			s_dcert_file= opt_arg();
-			}
-		else if	(strcmp(*argv,"-dkeyform") == 0)
-			{
-			s_dkey_format = str2fmt(opt_arg());
-			}
-		else if	(strcmp(*argv,"-dpass") == 0)
-			{
+			break;
+		case OPT_DCERTFORM:
+			opt_format(opt_arg(), 1, &s_dcert_format);
+			break;
+		case OPT_DCERT:
+			s_dcert_file = opt_arg();
+			break;
+		case OPT_DKEYFORM:
+			opt_format(opt_arg(), 1, &s_dkey_format);
+			break;
+		case OPT_DPASS:
 			dpassarg = opt_arg();
-			}
-		else if	(strcmp(*argv,"-dkey") == 0)
-			{
-			s_dkey_file= opt_arg();
-			}
-		else if	(strcmp(*argv,"-dcert_chain") == 0)
-			{
-			s_dchain_file= opt_arg();
-			}
-		else if (strcmp(*argv,"-nocert") == 0)
-			{
-			nocert=1;
-			}
-		else if	(strcmp(*argv,"-CApath") == 0)
-			{
-			CApath= opt_arg();
-			}
-		else if	(strcmp(*argv,"-chainCApath") == 0)
-			{
-			chCApath= opt_arg();
-			}
-		else if	(strcmp(*argv,"-verifyCApath") == 0)
-			{
+			break;
+		case OPT_DKEY:
+			s_dkey_file = opt_arg();
+			break;
+		case OPT_DCERT_CHAIN:
+			s_dchain_file = opt_arg();
+			break;
+		case OPT_NOCERT:
+			nocert = 1;
+			break;
+		case OPT_CAPATH:
+			CApath = opt_arg();
+			break;
+		case OPT_CHAINCAPATH:
+			chCApath = opt_arg();
+			break;
+		case OPT_VERIFYCAPATH:
 			vfyCApath= opt_arg();
-			}
-		else if (strcmp(*argv,"-no_cache") == 0)
+			break;
+		case OPT_NO_CACHE:
 			no_cache = 1;
-		else if (strcmp(*argv,"-ext_cache") == 0)
+			break;
+		case OPT_EXT_CACHE:
 			ext_cache = 1;
-		else if	(strcmp(*argv,"-CRLform") == 0)
-			{
-			crl_format = str2fmt(opt_arg());
-			}
-		// case OPT_V_COMMON_VERIFY_CASES: vpmtouched++
-		else if (!opt_verify(i, vpm))
-			goto bad;
-		else if (args_excert(&argv, &argc, &badarg, bio_err, &exc))
-			{
-			if (badarg)
-				goto bad;
-			continue;
-			}
-		else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args))
-			{
-			if (badarg)
-				goto bad;
-			continue;
+			break;
+		case OPT_CRLFORM:
+			opt_format(opt_arg(), 1, &crl_format);
+			break;
+		case OPT_S_CASES:
+			if (ssl_args == NULL)
+				ssl_args = sk_OPENSSL_STRING_new_null();
+			if (ssl_args == NULL
+			|| !sk_OPENSSL_STRING_push(ssl_args, opt_flag())
+			|| !sk_OPENSSL_STRING_push(ssl_args, opt_arg())) {
+				BIO_printf(bio_err,
+					"%s: Memory allocation failure\n",
+					prog);
+				goto end;
 			}
-		else if (strcmp(*argv,"-verify_return_error") == 0)
+			break;
+		case OPT_V_CASES:
+			if (!opt_verify(o, vpm))
+				goto end;
+			vpmtouched++;
+			break;
+		case OPT_X_CASES:
+			if (!args_excert(o, &exc))
+				goto end;
+			break;
+		case OPT_VERIFY_RET_ERROR:
 			verify_return_error = 1;
-		else if (strcmp(*argv,"-verify_quiet") == 0)
+			break;
+		case OPT_VERIFY_QUIET:
 			verify_quiet = 1;
-		else if	(strcmp(*argv,"-build_chain") == 0)
+			break;
+		case OPT_BUILD_CHAIN:
 			build_chain = 1;
-		else if	(strcmp(*argv,"-CAfile") == 0)
-			{
-			CAfile= opt_arg();
-			}
-		else if	(strcmp(*argv,"-chainCAfile") == 0)
-			{
-			chCAfile= opt_arg();
-			}
-		else if	(strcmp(*argv,"-verifyCAfile") == 0)
-			{
+			break;
+		case OPT_CAFILE:
+			CAfile = opt_arg();
+			break;
+		case OPT_CHAINCAFILE:
+			chCAfile = opt_arg();
+			break;
+		case OPT_VERIFYCAFILE:
 			vfyCAfile= opt_arg();
-			}
-#ifdef FIONBIO	
-		else if	(strcmp(*argv,"-nbio") == 0)
-			{ s_nbio=1; }
-#endif
-		else if	(strcmp(*argv,"-nbio_test") == 0)
-			{
-#ifdef FIONBIO	
-			s_nbio=1;
-#endif
-			s_nbio_test=1;
-			}
-		else if	(strcmp(*argv,"-ign_eof") == 0)
-			s_ign_eof=1;
-		else if	(strcmp(*argv,"-no_ign_eof") == 0)
-			s_ign_eof=0;
-		else if	(strcmp(*argv,"-debug") == 0)
-			{ s_debug=1; }
+			break;
+		case OPT_NBIO:
+			s_nbio = 1;
+			break;
+		case OPT_NBIO_TEST:
+			s_nbio = s_nbio_test = 1;
+			break;
+		case OPT_IGN_EOF:
+			s_ign_eof = 1;
+			break;
+		case OPT_NO_IGN_EOF:
+			s_ign_eof = 0;
+			break;
+		case OPT_DEBUG:
+			s_debug = 1;
+			break;
 #ifndef OPENSSL_NO_TLSEXT
-		else if	(strcmp(*argv,"-tlsextdebug") == 0)
-			s_tlsextdebug=1;
-		else if	(strcmp(*argv,"-status") == 0)
-			s_tlsextstatus=1;
-		else if	(strcmp(*argv,"-status_verbose") == 0)
-			{
-			s_tlsextstatus=1;
-			tlscstatp.verbose = 1;
-			}
-		else if (!strcmp(*argv, "-status_timeout"))
-			{
-			s_tlsextstatus=1;
+		case OPT_TLSEXTDEBUG:
+			s_tlsextdebug = 1;
+			break;
+		case OPT_STATUS:
+			s_tlsextstatus = 1;
+			break;
+		case OPT_STATUS_VERBOSE:
+			s_tlsextstatus = tlscstatp.verbose = 1;
+			break;
+		case OPT_STATUS_TIMEOUT:
+			s_tlsextstatus = 1;
 			tlscstatp.timeout = atoi(opt_arg());
-			}
-		else if (!strcmp(*argv, "-status_url"))
-			{
-			s_tlsextstatus=1;
+			break;
+		case OPT_STATUS_URL:
+			s_tlsextstatus = 1;
 			if (!OCSP_parse_url(opt_arg(),
 					&tlscstatp.host,
 					&tlscstatp.port,
 					&tlscstatp.path,
-					&tlscstatp.use_ssl))
-				{
+					&tlscstatp.use_ssl)) {
 				BIO_printf(bio_err, "Error parsing URL\n");
-				goto bad;
-				}
+				goto end;
 			}
+			break;
 #endif
-		else if	(strcmp(*argv,"-msg") == 0)
-			{ s_msg=1; }
-		else if	(strcmp(*argv,"-msgfile") == 0)
-			{
+		case OPT_MSG:
+			s_msg = 1;
+			break;
+		case OPT_MSGFILE:
 			bio_s_msg = BIO_new_file(opt_arg(), "w");
-			}
+			break;
 #ifndef OPENSSL_NO_SSL_TRACE
-		else if	(strcmp(*argv,"-trace") == 0)
-			{ s_msg=2; }
-#endif
-		else if	(strcmp(*argv,"-security_debug") == 0)
-			{ sdebug=1; }
-		else if	(strcmp(*argv,"-security_debug_verbose") == 0)
-			{ sdebug=2; }
-		else if	(strcmp(*argv,"-hack") == 0)
-			{ hack=1; }
-		else if	(strcmp(*argv,"-state") == 0)
-			{ state=1; }
-		else if	(strcmp(*argv,"-crlf") == 0)
-			{ s_crlf=1; }
-		else if	(strcmp(*argv,"-quiet") == 0)
-			{ s_quiet=1; }
-		else if	(strcmp(*argv,"-brief") == 0)
-			{
-			s_quiet=1;
-			s_brief=1;
-			verify_quiet=1;
-			}
-		else if	(strcmp(*argv,"-no_tmp_rsa") == 0)
-			{ no_tmp_rsa=1; }
-		else if	(strcmp(*argv,"-no_dhe") == 0)
-			{ no_dhe=1; }
-		else if	(strcmp(*argv,"-no_ecdhe") == 0)
-			{ no_ecdhe=1; }
-		else if (strcmp(*argv,"-no_resume_ephemeral") == 0)
-			{ no_resume_ephemeral = 1; }
+		case OPT_TRACE:
+			s_msg = 2;
+			break;
+#else
+		case OPT_TRACE:
+			goto err;
+#endif
+		case OPT_SECURITY_DEBUG:
+			sdebug = 1;
+			break;
+		case OPT_SECURITY_DEBUG_VERBOSE:
+			sdebug = 2;
+			break;
+		case OPT_HACK:
+			hack = 1;
+			break;
+		case OPT_STATE:
+			state = 1;
+			break;
+		case OPT_CRLF:
+			s_crlf = 1;
+			break;
+		case OPT_QUIET:
+			s_quiet = 1;
+			break;
+		case OPT_BRIEF:
+			s_quiet = s_brief = verify_quiet = 1;
+			break;
+		case OPT_NO_TMP_RSA:
+			no_tmp_rsa = 1;
+			break;
+		case OPT_NO_DHE:
+			no_dhe = 1;
+			break;
+		case OPT_NO_ECDHE:
+			no_ecdhe = 1;
+			break;
+		case OPT_NO_RESUME_EPHEMERAL:
+			no_resume_ephemeral = 1;
+			break;
 #ifndef OPENSSL_NO_PSK
-                else if (strcmp(*argv,"-psk_hint") == 0)
-			{
-                        psk_identity_hint= opt_arg();
-                        }
-                else if (strcmp(*argv,"-psk") == 0)
-			{
-			size_t i;
-
-			psk_key=opt_arg();
-			for (i=0; i<strlen(psk_key); i++)
-				{
-				if (isxdigit((unsigned char)psk_key[i]))
+		case OPT_PSK_HINT:
+                        psk_identity_hint = opt_arg();
+			break;
+		case OPT_PSK:
+			for (p = psk_key=opt_arg(); *p; p++) {
+				if (isxdigit(*p))
 					continue;
 				BIO_printf(bio_err,"Not a hex number '%s'\n",*argv);
-				goto bad;
-				}
+				goto end;
 			}
+			break;
 #endif
 #ifndef OPENSSL_NO_SRP
-		else if (strcmp(*argv, "-srpvfile") == 0)
-			{
+		case OPT_SRPVFILE:
 			srp_verifier_file = opt_arg();
 			meth = TLSv1_server_method();
-			}
-		else if (strcmp(*argv, "-srpuserseed") == 0)
-			{
+			break;
+		case OPT_SRPUSERSEED:
 			srpuserseed = opt_arg();
 			meth = TLSv1_server_method();
-			}
+			break;
 #endif
-		else if	(strcmp(*argv,"-rev") == 0)
-			{ rev=1; }
-		else if	(strcmp(*argv,"-www") == 0)
-			{ www=1; }
-		else if	(strcmp(*argv,"-WWW") == 0)
-			{ www=2; }
-		else if	(strcmp(*argv,"-HTTP") == 0)
-			{ www=3; }
+		case OPT_REV:
+			rev = 1;
+			break;
+		case OPT_WWW:
+			www = 1;
+			break;
+		case OPT_UPPER_WWW:
+			www = 2;
+			break;
+		case OPT_HTTP:
+			www = 3;
+			break;
 #ifndef OPENSSL_NO_SSL2
-		else if	(strcmp(*argv,"-ssl2") == 0)
-			{ meth=SSLv2_server_method(); }
+		case OPT_SSL2:
+			meth = SSLv2_client_method();
+			break;
 #endif
 #ifndef OPENSSL_NO_SSL3
-		else if	(strcmp(*argv,"-ssl3") == 0)
-			{ meth=SSLv3_server_method(); }
+		case OPT_SSL3:
+			meth = SSLv3_client_method();
+			break;
 #endif
 #ifndef OPENSSL_NO_TLS1
-		else if	(strcmp(*argv,"-tls1") == 0)
-			{ meth=TLSv1_server_method(); }
-		else if	(strcmp(*argv,"-tls1_1") == 0)
-			{ meth=TLSv1_1_server_method(); }
-		else if	(strcmp(*argv,"-tls1_2") == 0)
-			{ meth=TLSv1_2_server_method(); }
+		case OPT_TLS1_2:
+			meth = TLSv1_2_client_method();
+			break;
+		case OPT_TLS1_1:
+			meth = TLSv1_1_client_method();
+			break;
+		case OPT_TLS1:
+			meth = TLSv1_client_method();
+			break;
 #endif
 #ifndef OPENSSL_NO_DTLS1
-		else if	(strcmp(*argv,"-dtls") == 0)
-			{ 
-			meth=DTLS_server_method();
+		case OPT_DTLS:
+			meth = DTLS_client_method();
 			socket_type = SOCK_DGRAM;
-			}
-		else if	(strcmp(*argv,"-dtls1") == 0)
-			{ 
-			meth=DTLSv1_server_method();
+			break;
+		case OPT_DTLS1:
+			meth = DTLSv1_client_method();
 			socket_type = SOCK_DGRAM;
-			}
-		else if	(strcmp(*argv,"-dtls1_2") == 0)
-			{ 
-			meth=DTLSv1_2_server_method();
+			break;
+		case OPT_DTLS1_2:
+			meth = DTLSv1_2_client_method();
 			socket_type = SOCK_DGRAM;
-			}
-		else if (strcmp(*argv,"-timeout") == 0)
+			break;
+		case OPT_TIMEOUT:
 			enable_timeouts = 1;
-		else if (strcmp(*argv,"-mtu") == 0)
-			{
+			break;
+		case OPT_MTU:
 			socket_mtu = atol(opt_arg());
-			}
-		else if (strcmp(*argv, "-chain") == 0)
+			break;
+		case OPT_CHAIN:
 			cert_chain = 1;
+			break;
 #endif
-		else if (strcmp(*argv, "-id_prefix") == 0)
-			{
+		case OPT_ID_PREFIX:
 			session_id_prefix = opt_arg();
-			}
-#ifndef OPENSSL_NO_ENGINE
-		else if (strcmp(*argv,"-engine") == 0)
-			{
-			engine_id= opt_arg();
-			}
-#endif
-		else if (strcmp(*argv,"-rand") == 0)
-			{
-			inrand= opt_arg();
-			}
+			break;
+		case OPT_ENGINE:
+			engine_id = opt_arg();
+			break;
+		case OPT_RAND:
+			inrand = opt_arg();
+			break;
 #ifndef OPENSSL_NO_TLSEXT
-		else if (strcmp(*argv,"-servername") == 0)
-			{
-			tlsextcbp.servername= opt_arg();
-			}
-		else if (strcmp(*argv,"-servername_fatal") == 0)
-			{ tlsextcbp.extension_error = SSL_TLSEXT_ERR_ALERT_FATAL; }
-		else if	(strcmp(*argv,"-cert2") == 0)
-			{
-			s_cert_file2= opt_arg();
-			}
-		else if	(strcmp(*argv,"-key2") == 0)
-			{
-			s_key_file2= opt_arg();
-			}
+		case OPT_SERVERNAME:
+			tlsextcbp.servername = opt_arg();
+			break;
+		case OPT_SERVERNAME_FATAL:
+			tlsextcbp.extension_error = SSL_TLSEXT_ERR_ALERT_FATAL;
+			break;
+		case OPT_CERT2:
+			s_cert_file2 = opt_arg();
+			break;
+		case OPT_KEY2:
+			s_key_file2 = opt_arg();
+			break;
 # ifndef OPENSSL_NO_NEXTPROTONEG
-		else if	(strcmp(*argv,"-nextprotoneg") == 0)
-			{
+		case OPT_NEXTPROTONEG:
 			next_proto_neg_in = opt_arg();
-			}
+			break;
 # endif
-		else if	(strcmp(*argv,"-alpn") == 0)
-			{
+		case OPT_ALPN:
 			alpn_in = opt_arg();
-			}
+			break;
 #endif
 #if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
-		else if (strcmp(*argv,"-jpake") == 0)
-			{
+		case OPT_JPAKE:
 			jpake_secret = opt_arg();
-			}
+			break;
+#else
+		case OPT_JPAKE:
+			goto err;
 #endif
-		else if (strcmp(*argv,"-use_srtp") == 0)
-			{
+		case OPT_SRTP_PROFILES:
 			srtp_profiles = opt_arg();
-			}
-		else if (strcmp(*argv,"-keymatexport") == 0)
-			{
-			keymatexportlabel= opt_arg();
-			}
-		else if (strcmp(*argv,"-keymatexportlen") == 0)
-			{
-			keymatexportlen=atoi(opt_arg());
-			if (keymatexportlen == 0) goto bad;
-			}
-		else
-			{
-			BIO_printf(bio_err,"unknown option %s\n",*argv);
-			badop=1;
 			break;
-			}
-		argc--;
-		argv++;
-		}
-	if (badop)
-		{
-bad:
-		sv_usage();
-		goto end;
+		case OPT_KEYMATEXPORT:
+			keymatexportlabel = opt_arg();
+			break;
+		case OPT_KEYMATEXPORTLEN:
+			keymatexportlen = atoi(opt_arg());
+			break;
 		}
+	}
 
 	if (unix_path && (socket_type != SOCK_STREAM))
 		{