tests: testpkcs11.sh was moved to the main tests

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

15 files changed, 2 insertions, 1837 deletions

diff --git a/tests/suite/Makefile.am b/tests/suite/Makefile.am
index 6e784fff8e..4b39da6f0f 100644
--- a/tests/suite/Makefile.am
+++ b/tests/suite/Makefile.am
@@ -85,17 +85,12 @@ nodist_libecore_la_SOURCES = ecore/src/lib/ecore_anim.c			\
 	ecore/src/lib/eina_ustringshare.c ecore/src/lib/eina_value.c
 
 
-EXTRA_DIST += testcompat-main-polarssl testcompat-main-openssl testcompat-common \
-	testpkcs11.pkcs15 testpkcs11.softhsm testpkcs11.sc-hsm
+EXTRA_DIST += testcompat-main-polarssl testcompat-main-openssl testcompat-common
 nodist_check_SCRIPTS = chain.sh invalid-cert.sh \
 	testrng.sh testcompat-polarssl.sh testcompat-openssl.sh \
-	testrandom.sh certtool-pkcs11.sh tls-fuzzer/tls-fuzzer-nocert.sh \
+	testrandom.sh tls-fuzzer/tls-fuzzer-nocert.sh \
 	tls-fuzzer/tls-fuzzer-cert.sh tls-fuzzer/tls-fuzzer-alpn.sh
 
-if ENABLE_PKCS11
-nodist_check_SCRIPTS += testpkcs11.sh
-endif
-
 TESTS_ENVIRONMENT = EXEEXT=$(EXEEXT) \
 	LC_ALL="C"			\
 	VALGRIND="$(VALGRIND)"		\
diff --git a/tests/suite/certtool-pkcs11.sh b/tests/suite/certtool-pkcs11.sh
deleted file mode 100755
index 39933cd0c3..0000000000
--- a/tests/suite/certtool-pkcs11.sh
+++ /dev/null
@@ -1,193 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) 2016 Nikos Mavrogiannopoulos
-#
-# This file is part of GnuTLS.
-#
-# GnuTLS is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 3 of the License, or (at
-# your option) any later version.
-#
-# GnuTLS is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with GnuTLS; if not, write to the Free Software Foundation,
-# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-
-srcdir="${srcdir:-.}"
-P11TOOL="${P11TOOL:-../../src/p11tool${EXEEXT}}"
-CERTTOOL="${CERTTOOL:-../../src/certtool${EXEEXT}}"
-DIFF="${DIFF:-diff -b -B}"
-SERV="${SERV:-../../src/gnutls-serv${EXEEXT}}"
-CLI="${CLI:-../../src/gnutls-cli${EXEEXT}}"
-RETCODE=0
-
-if ! test -x "${P11TOOL}"; then
-	exit 77
-fi
-
-if ! test -x "${CERTTOOL}"; then
-	exit 77
-fi
-
-if ! test -x "${SERV}"; then
-	exit 77
-fi
-
-if ! test -x "${CLI}"; then
-	exit 77
-fi
-
-if ! test -z "${VALGRIND}"; then
-	VALGRIND="${LIBTOOL:-libtool} --mode=execute valgrind --leak-check=full"
-fi
-
-TMPFILE="verify-pkcs11.debug"
-CERTTOOL_PARAM="--stdout-info"
-
-if test "${WINDIR}" != ""; then
-	exit 77
-fi 
-
-P11TOOL="${VALGRIND} ${P11TOOL} --batch"
-SERV="${SERV} -q"
-
-. ${srcdir}/../scripts/common.sh
-
-rm -f "${TMPFILE}"
-
-exit_error () {
-	echo "check ${TMPFILE} for additional debugging information"
-	echo ""
-	echo ""
-	tail "${TMPFILE}"
-	exit 1
-}
-
-check_for_datefudge
-
-# $1: token
-# $2: PIN
-# $3: filename
-# $4: label
-write_ca_cert () {
-	export GNUTLS_PIN="$2"
-	filename="$3"
-	token="$1"
-	label="$4"
-
-	echo -n "* Writing the CA certificate... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --mark-ca --mark-trusted --no-mark-private --so-login --write --label "$label" --load-certificate "${filename}" "${token}" >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit_error
-	fi
-
-}
-
-# $1: token
-# $2: PIN
-# $3: filename
-write_ca_privkey () {
-	export GNUTLS_PIN="$2"
-	filename="$3"
-	token="$1"
-
-	echo -n "* Writing the CA private key... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label CA-key --load-privkey "${filename}" "${token}" >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit_error
-	fi
-}
-
-# $1: URL
-# $2: cert file to verify
-verify_certificate_test() {
-	url=$1
-	file=$2
-
-	echo -n "* Verifying a certificate... "
-	datefudge -s "2015-10-10" \
-	$CERTTOOL ${ADDITIONAL_PARAM} --verify --load-ca-certificate "$url" --infile "$file" >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo "failed $file with $url"
-		exit_error
-	fi
-}
-
-generate_cert() {
-	url=$1
-
-	echo -n "* Generating a certificate... "
-	$CERTTOOL ${ADDITIONAL_PARAM} --generate-certificate --load-ca-certificate "$url" --load-ca-privkey "${srcdir}/pkcs11-certs/ca.key" --load-privkey "${srcdir}/pkcs11-certs/server.key" --template "${srcdir}/pkcs11-certs/server-tmpl" >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo "failed generation with $url"
-		exit_error
-	fi
-}
-
-generate_cert_with_key() {
-	ca_url=$1
-	ca_key_url=$2
-
-	echo -n "* Generating a certificate (privkey in pkcs11)... "
-	$CERTTOOL ${ADDITIONAL_PARAM} --generate-certificate --load-ca-certificate "${ca_url}" --load-ca-privkey "${ca_key_url}" --load-privkey "${srcdir}/pkcs11-certs/server.key" --template "${srcdir}/pkcs11-certs/server-tmpl" >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo "failed generation with $url"
-		exit_error
-	fi
-}
-
-echo "Testing PKCS11 verification"
-
-# erase SC
-
-type="softhsm"
-
-. "${srcdir}/testpkcs11.${type}"
-
-export GNUTLS_PIN=12345678
-export GNUTLS_SO_PIN=00000000
-
-init_card "${GNUTLS_PIN}" "${GNUTLS_SO_PIN}"
-
-# find token name
-TOKEN=`${P11TOOL} ${ADDITIONAL_PARAM} --list-tokens pkcs11:token=Nikos|grep URL|grep token=GnuTLS-Test|sed 's/\s*URL\: //g'`
-
-echo "* Token: ${TOKEN}"
-if test "x${TOKEN}" = x; then
-	echo "Could not find generated token"
-	exit_error
-fi
-
-write_ca_cert "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/ca.crt" "CA"
-
-verify_certificate_test "${TOKEN};object=CA;object-type=cert" "${srcdir}/pkcs11-certs/server.crt"
-verify_certificate_test "${TOKEN};object=CA;object-type=cert" "${srcdir}/pkcs11-certs/client.crt"
-generate_cert "${TOKEN};object=CA;object-type=cert"
-
-write_ca_privkey "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/ca.key"
-
-generate_cert_with_key "${TOKEN};object=CA;object-type=cert" "${TOKEN};object=CA-key;object-type=private"
-
-if test ${RETCODE} = 0; then
-	echo "* All tests succeeded"
-fi
-rm -f "${TMPFILE}"
-
-exit 0
diff --git a/tests/suite/pkcs11-certs/ca-tmpl b/tests/suite/pkcs11-certs/ca-tmpl
deleted file mode 100644
index 5bf462d1ef..0000000000
--- a/tests/suite/pkcs11-certs/ca-tmpl
+++ /dev/null
@@ -1,67 +0,0 @@
-# X.509 Certificate options
-#
-# DN options
-
-dn = "cn=CA,C=CZ"
-
-# The serial number of the certificate
-serial = 1
-
-# In how many days, counting from today, this certificate will expire.
-expiration_days = 2590
-
-# X.509 v3 extensions
-
-# A dnsname in case of a WWW server.
-#dns_name = "localhost"
-#dns_name = "www.morethanone.org"
-
-# An IP address in case of a server.
-#ip_address = "192.168.1.1"
-
-#dns_name = "www.evenmorethanone.org"
-
-# An email in case of a person
-email = "none@none.org"
-
-# An URL that has CRLs (certificate revocation lists)
-# available. Needed in CA certificates.
-crl_dist_points = "http://www.getcrl.crl/getcrl/"
-
-#email = "where@none.org"
-
-# Whether this is a CA certificate or not
-ca
-
-# Whether this certificate will be used for a TLS client
-#tls_www_client
-
-# Whether this certificate will be used for a TLS server
-#tls_www_server
-
-# Whether this certificate will be used to sign data (needed
-# in TLS DHE ciphersuites).
-signing_key
-
-# Whether this certificate will be used to encrypt data (needed
-# in TLS RSA ciphersuites). Note that it is preferred to use different
-# keys for encryption and signing.
-#encryption_key
-
-# Whether this key will be used to sign other certificates.
-cert_signing_key
-
-# Whether this key will be used to sign CRLs.
-crl_signing_key
-
-# Whether this key will be used to sign code.
-#code_signing_key
-
-# Whether this key will be used to sign OCSP data.
-ocsp_signing_key
-
-# Whether this key will be used for time stamping.
-#time_stamping_key
-
-# Whether this key will be used for IPsec IKE operations.
-#ipsec_ike_key
diff --git a/tests/suite/pkcs11-certs/ca.crt b/tests/suite/pkcs11-certs/ca.crt
deleted file mode 100644
index e39ee41f7a..0000000000
--- a/tests/suite/pkcs11-certs/ca.crt
+++ /dev/null
@@ -1,15 +0,0 @@
------BEGIN CERTIFICATE-----
-MIICUjCCAbugAwIBAgIBATANBgkqhkiG9w0BAQsFADAaMQswCQYDVQQDEwJDQTEL
-MAkGA1UEBhMCQ1owIhgPMjAxMzExMTAwODI0NTRaGA8yMDIwMTIxMzA4MjQ1NFow
-GjELMAkGA1UEAxMCQ0ExCzAJBgNVBAYTAkNaMIGfMA0GCSqGSIb3DQEBAQUAA4GN
-ADCBiQKBgQCoomr+kiRtx+/doF2FRSOxqBuuLbcpK5KwxtYk82L8MQzzJijfjS88
-4kCijlR6dqD0oDS70ngNogg2uIgn1SfLTTgXw/v6w/nMnMIYZ+ePrF5WD1qGeOAu
-R+qts4Y4rfb9Yb8sXIPdui7HelqimJaVeMxAYJsqRBSixDSpYbkEhwIDAQABo4Gj
-MIGgMA8GA1UdEwEB/wQFMAMBAf8wGAYDVR0RBBEwD4ENbm9uZUBub25lLm9yZzAT
-BgNVHSUEDDAKBggrBgEFBQcDCTAPBgNVHQ8BAf8EBQMDBwYAMB0GA1UdDgQWBBQS
-DtpREkBWrvQcbcyhsD0oYX4zATAuBgNVHR8EJzAlMCOgIaAfhh1odHRwOi8vd3d3
-LmdldGNybC5jcmwvZ2V0Y3JsLzANBgkqhkiG9w0BAQsFAAOBgQBzRzkYVGhl0ltc
-iVvXModMh9cb1TcUrc2nhfEh63u5ZF1/8MJPaMMLw3FZmGc5B8lNYOoWiSqK/Ark
-iO9chPwqRKWY8n52USgGDcUNRxbwCa2vOQg9cdSWIcdt18W5mtJ3hz+CDaT8ZH8t
-sVW/i5eG6O7o3rZGSwbcC1pgIWZqCw==
------END CERTIFICATE-----
diff --git a/tests/suite/pkcs11-certs/ca.key b/tests/suite/pkcs11-certs/ca.key
deleted file mode 100644
index 62f5bfae39..0000000000
--- a/tests/suite/pkcs11-certs/ca.key
+++ /dev/null
@@ -1,94 +0,0 @@
-Public Key Info:
-	Public Key Algorithm: RSA
-	Key Security Level: Weak (1024 bits)
-
-modulus:
-	00:a8:a2:6a:fe:92:24:6d:c7:ef:dd:a0:5d:85:45:
-	23:b1:a8:1b:ae:2d:b7:29:2b:92:b0:c6:d6:24:f3:
-	62:fc:31:0c:f3:26:28:df:8d:2f:3c:e2:40:a2:8e:
-	54:7a:76:a0:f4:a0:34:bb:d2:78:0d:a2:08:36:b8:
-	88:27:d5:27:cb:4d:38:17:c3:fb:fa:c3:f9:cc:9c:
-	c2:18:67:e7:8f:ac:5e:56:0f:5a:86:78:e0:2e:47:
-	ea:ad:b3:86:38:ad:f6:fd:61:bf:2c:5c:83:dd:ba:
-	2e:c7:7a:5a:a2:98:96:95:78:cc:40:60:9b:2a:44:
-	14:a2:c4:34:a9:61:b9:04:87:
-
-public exponent:
-	01:00:01:
-
-private exponent:
-	08:f8:4a:b4:ab:d5:60:39:88:5a:c3:92:f5:e9:cd:
-	92:3f:9c:e9:50:e9:33:39:6c:1e:17:15:80:f5:a9:
-	48:3c:db:b1:7b:50:25:43:ff:45:3f:cb:ac:59:e1:
-	c8:79:d2:e9:f0:33:9d:e1:fe:1c:cb:87:a0:51:84:
-	7c:89:ec:09:e0:3d:c9:df:ca:43:d9:c1:79:3c:47:
-	f7:8e:71:bf:a5:6e:11:87:0d:d9:2e:5a:5d:a0:d3:
-	ba:5b:9c:23:db:33:54:5f:a2:2f:db:28:05:9d:07:
-	a4:d4:76:0e:ef:d1:f9:c3:f9:21:01:ad:06:4c:9d:
-	59:14:09:37:91:df:86:01:
-
-prime1:
-	00:d6:e8:07:49:7f:a6:6a:d7:f3:76:84:4b:a9:cb:
-	91:66:8a:c8:07:54:29:25:1d:e4:70:dd:2c:fd:ff:
-	dc:c6:0c:24:75:4f:a0:ca:82:e2:b6:3b:8b:f0:7b:
-	37:c3:97:be:6c:b3:5f:91:a6:c0:56:48:aa:aa:3a:
-	d9:12:24:b7:81:
-
-prime2:
-	00:c8:e1:50:40:9b:7e:34:9c:44:88:1e:16:4b:bf:
-	04:0f:a6:b0:2b:9d:2f:a2:84:29:96:54:35:69:68:
-	6f:a2:a7:2b:8a:de:e9:9e:0e:6f:b3:cf:d8:af:68:
-	33:52:a6:e4:b5:d1:21:d0:6b:d2:d2:a6:af:97:62:
-	44:fe:b8:00:07:
-
-coefficient:
-	75:16:b8:48:0b:61:9a:a9:78:b1:72:93:94:51:54:
-	c1:07:69:b8:b1:dc:61:4a:f5:ef:b7:9c:f5:07:74:
-	0d:8e:1a:a2:51:ea:00:91:ef:05:75:42:53:4d:6a:
-	e3:f5:de:07:a5:55:5f:8b:37:58:55:2b:43:ef:b2:
-	d0:38:a8:89:
-
-exp1:
-	00:c9:b9:60:e5:b7:e1:b1:56:e5:dc:70:d0:49:20:
-	a1:6a:3c:89:08:80:12:63:19:cd:0d:b8:3e:fc:69:
-	48:85:ca:6e:0a:83:e5:2d:52:70:96:98:0c:82:7e:
-	56:d8:cd:3e:5c:f0:7e:9b:cc:87:ac:36:67:a4:84:
-	ba:af:92:31:81:
-
-exp2:
-	65:0a:d8:78:36:fe:8b:6e:13:16:b8:b3:94:54:37:
-	b1:bb:b1:9f:ae:88:18:62:0c:1d:1e:ac:63:21:f2:
-	0d:49:b3:20:3e:32:1a:9b:be:5a:1e:f1:2a:81:ea:
-	56:e7:b5:e1:32:99:a4:a1:a7:c0:e7:b1:29:1f:77:
-	fe:fc:04:9f:
-
-
-Public Key ID: 12:0E:DA:51:12:40:56:AE:F4:1C:6D:CC:A1:B0:3D:28:61:7E:33:01
-Public key's random art:
-+--[ RSA 1024]----+
-|.E*++.o          |
-|oo *.B .         |
-|..++O *          |
-| o.*oB .         |
-|  o + o S        |
-|       .         |
-|                 |
-|                 |
-|                 |
-+-----------------+
-
------BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCoomr+kiRtx+/doF2FRSOxqBuuLbcpK5KwxtYk82L8MQzzJijf
-jS884kCijlR6dqD0oDS70ngNogg2uIgn1SfLTTgXw/v6w/nMnMIYZ+ePrF5WD1qG
-eOAuR+qts4Y4rfb9Yb8sXIPdui7HelqimJaVeMxAYJsqRBSixDSpYbkEhwIDAQAB
-AoGACPhKtKvVYDmIWsOS9enNkj+c6VDpMzlsHhcVgPWpSDzbsXtQJUP/RT/LrFnh
-yHnS6fAzneH+HMuHoFGEfInsCeA9yd/KQ9nBeTxH945xv6VuEYcN2S5aXaDTuluc
-I9szVF+iL9soBZ0HpNR2Du/R+cP5IQGtBkydWRQJN5HfhgECQQDW6AdJf6Zq1/N2
-hEupy5FmisgHVCklHeRw3Sz9/9zGDCR1T6DKguK2O4vwezfDl75ss1+RpsBWSKqq
-OtkSJLeBAkEAyOFQQJt+NJxEiB4WS78ED6awK50vooQpllQ1aWhvoqcrit7png5v
-s8/Yr2gzUqbktdEh0GvS0qavl2JE/rgABwJBAMm5YOW34bFW5dxw0EkgoWo8iQiA
-EmMZzQ24PvxpSIXKbgqD5S1ScJaYDIJ+VtjNPlzwfpvMh6w2Z6SEuq+SMYECQGUK
-2Hg2/otuExa4s5RUN7G7sZ+uiBhiDB0erGMh8g1JsyA+Mhqbvloe8SqB6lbnteEy
-maShp8DnsSkfd/78BJ8CQHUWuEgLYZqpeLFyk5RRVMEHabix3GFK9e+3nPUHdA2O
-GqJR6gCR7wV1QlNNauP13gelVV+LN1hVK0PvstA4qIk=
------END RSA PRIVATE KEY-----
diff --git a/tests/suite/pkcs11-certs/client-tmpl b/tests/suite/pkcs11-certs/client-tmpl
deleted file mode 100644
index a22eef84ba..0000000000
--- a/tests/suite/pkcs11-certs/client-tmpl
+++ /dev/null
@@ -1,67 +0,0 @@
-# X.509 Certificate options
-#
-# DN options
-
-dn = "cn=Client,C=CZ"
-
-# The serial number of the certificate
-serial = 3
-
-# In how many days, counting from today, this certificate will expire.
-expiration_days = 2590
-
-# X.509 v3 extensions
-
-# A dnsname in case of a WWW server.
-#dns_name = "localhost"
-#dns_name = "www.morethanone.org"
-
-# An IP address in case of a server.
-#ip_address = "192.168.1.1"
-
-#dns_name = "www.evenmorethanone.org"
-
-# An email in case of a person
-email = "none@none.org"
-
-# An URL that has CRLs (certificate revocation lists)
-# available. Needed in CA certificates.
-#crl_dist_points = "http://www.getcrl.crl/getcrl/"
-
-#email = "where@none.org"
-
-# Whether this is a CA certificate or not
-#ca
-
-# Whether this certificate will be used for a TLS client
-tls_www_client
-
-# Whether this certificate will be used for a TLS server
-#tls_www_server
-
-# Whether this certificate will be used to sign data (needed
-# in TLS DHE ciphersuites).
-signing_key
-
-# Whether this certificate will be used to encrypt data (needed
-# in TLS RSA ciphersuites). Note that it is preferred to use different
-# keys for encryption and signing.
-#encryption_key
-
-# Whether this key will be used to sign other certificates.
-#cert_signing_key
-
-# Whether this key will be used to sign CRLs.
-#crl_signing_key
-
-# Whether this key will be used to sign code.
-#code_signing_key
-
-# Whether this key will be used to sign OCSP data.
-#ocsp_signing_key
-
-# Whether this key will be used for time stamping.
-#time_stamping_key
-
-# Whether this key will be used for IPsec IKE operations.
-#ipsec_ike_key
diff --git a/tests/suite/pkcs11-certs/client.crt b/tests/suite/pkcs11-certs/client.crt
deleted file mode 100644
index 6f75590d25..0000000000
--- a/tests/suite/pkcs11-certs/client.crt
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN CERTIFICATE-----
-MIICdDCCAd2gAwIBAgIBAzANBgkqhkiG9w0BAQsFADAaMQswCQYDVQQDEwJDQTEL
-MAkGA1UEBhMCQ1owIhgPMjAxMzExMTAwODI1MjdaGA8yMDIwMTIxMzA4MjUyN1ow
-HjEPMA0GA1UEAxMGQ2xpZW50MQswCQYDVQQGEwJDWjCBnzANBgkqhkiG9w0BAQEF
-AAOBjQAwgYkCgYEAvQRIzvKyhr3tqmB4Pe+91DWSFayaNtcrDIT597bhxugVYW8o
-jB206kx5aknAMA3PQGYcGqkLrt+nsJcmOIXDZsC6P4zeOSsF1PPhDAoX3bkUr2lF
-MEt374eKdg1yvyhRxt4DOR6aD4gkC7fVtaYdgV6yXpJGMHV05LBIgQ7QtykCAwEA
-AaOBwTCBvjAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMBgGA1Ud
-EQQRMA+BDW5vbmVAbm9uZS5vcmcwDwYDVR0PAQH/BAUDAweAADAdBgNVHQ4EFgQU
-Dbinh11GaaJcTyOpmxPYuttsiGowHwYDVR0jBBgwFoAUEg7aURJAVq70HG3MobA9
-KGF+MwEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3d3dy5nZXRjcmwuY3JsL2dl
-dGNybC8wDQYJKoZIhvcNAQELBQADgYEAN/Henso+5zzuFQWTpJXlUsWtRQAFhRY3
-WVt3xtnyPs4pF/LKBp3Ov0GLGBkz5YlyJGFNESSyUviMsH7g7rJM8i7Bph6BQTE9
-XdqbZPc0opfms4EHjmlXj5HQ0f0yoxHnLk43CR+vmbn0JPuurnEKAwjznAJR8GxI
-R2MRyMxdGqs=
------END CERTIFICATE-----
diff --git a/tests/suite/pkcs11-certs/client.key b/tests/suite/pkcs11-certs/client.key
deleted file mode 100644
index 9277bdfd8f..0000000000
--- a/tests/suite/pkcs11-certs/client.key
+++ /dev/null
@@ -1,94 +0,0 @@
-Public Key Info:
-	Public Key Algorithm: RSA
-	Key Security Level: Weak (1024 bits)
-
-modulus:
-	00:bd:04:48:ce:f2:b2:86:bd:ed:aa:60:78:3d:ef:
-	bd:d4:35:92:15:ac:9a:36:d7:2b:0c:84:f9:f7:b6:
-	e1:c6:e8:15:61:6f:28:8c:1d:b4:ea:4c:79:6a:49:
-	c0:30:0d:cf:40:66:1c:1a:a9:0b:ae:df:a7:b0:97:
-	26:38:85:c3:66:c0:ba:3f:8c:de:39:2b:05:d4:f3:
-	e1:0c:0a:17:dd:b9:14:af:69:45:30:4b:77:ef:87:
-	8a:76:0d:72:bf:28:51:c6:de:03:39:1e:9a:0f:88:
-	24:0b:b7:d5:b5:a6:1d:81:5e:b2:5e:92:46:30:75:
-	74:e4:b0:48:81:0e:d0:b7:29:
-
-public exponent:
-	01:00:01:
-
-private exponent:
-	00:a5:eb:b1:e2:00:07:98:e1:f6:53:de:35:0e:e1:
-	79:78:63:c2:25:c6:8a:e4:e3:02:46:0e:20:c3:43:
-	45:73:ee:5c:7e:58:2e:76:b8:c9:0b:f7:2f:89:8e:
-	cd:e7:20:e8:32:36:b0:2a:f3:03:6f:71:a2:e9:0f:
-	f5:9c:1e:47:84:54:2b:67:12:e3:f4:20:80:7f:54:
-	81:63:f4:41:4a:6f:8f:89:e8:83:24:64:87:b5:2b:
-	5b:25:55:c5:b6:e8:1d:c9:a0:a9:68:0d:2d:1f:06:
-	ac:46:6a:96:93:96:16:24:fe:7f:e4:00:c7:bf:37:
-	fe:48:6f:3f:94:0b:36:9e:81:
-
-prime1:
-	00:dd:8b:ef:a9:f3:e9:7a:97:6f:50:2f:d4:93:ff:
-	0b:6d:52:b4:2c:64:d2:bb:6c:a7:ca:5d:5f:31:ba:
-	2c:f6:59:09:34:57:5f:3c:cd:f5:2b:a0:c7:7a:ac:
-	e2:20:64:a8:58:24:a3:02:c3:7f:7b:c5:7b:31:4e:
-	de:81:6b:48:f9:
-
-prime2:
-	00:da:69:4a:53:be:3d:36:07:58:a7:8e:58:4e:cd:
-	90:cd:72:54:7c:40:89:ab:fd:3a:8b:6d:d0:9c:b0:
-	00:7f:11:6a:b7:f2:4e:e0:81:8b:23:09:3f:c4:6f:
-	f7:6d:06:b1:c8:83:63:87:72:c7:43:01:24:5d:2d:
-	88:7f:b9:1b:b1:
-
-coefficient:
-	30:19:e0:d7:bd:0f:0d:96:b0:65:64:00:82:2a:9d:
-	6c:52:a6:89:a6:db:89:e3:7f:10:c3:3b:5b:97:73:
-	ea:13:af:fc:4c:3e:72:5e:da:cb:b7:d4:b6:2c:d0:
-	05:c3:58:bb:2d:59:2c:50:1f:08:6d:03:53:ba:ec:
-	15:ec:b6:08:
-
-exp1:
-	00:d0:6d:4e:54:3d:bc:72:30:f5:f0:22:8f:83:8c:
-	76:5b:ab:6b:06:38:f4:68:8f:98:6b:b1:dc:55:14:
-	2a:28:b9:2b:07:ab:0b:56:51:0d:4e:b6:3b:f5:15:
-	a0:c7:88:eb:37:c1:7f:fa:a1:a1:d5:f7:bc:26:6f:
-	64:b5:ad:11:41:
-
-exp2:
-	2a:a6:b1:0b:15:75:62:9d:a0:a4:67:d9:ba:d9:cd:
-	d3:30:e6:6a:b5:37:ad:4c:70:28:56:33:8c:c5:99:
-	f3:36:75:7e:a2:64:e0:d6:ab:53:16:35:4b:a9:09:
-	ca:52:aa:59:1b:bf:4d:ee:0e:17:79:9b:9e:4e:8b:
-	ff:55:28:a1:
-
-
-Public Key ID: 0D:B8:A7:87:5D:46:69:A2:5C:4F:23:A9:9B:13:D8:BA:DB:6C:88:6A
-Public key's random art:
-+--[ RSA 1024]----+
-|                 |
-|       . . .     |
-|      . * *      |
-|     + = X .     |
-|    . B S =      |
-|     . O o       |
-|   ...* o        |
-| E. .+.o         |
-|o.  ooo          |
-+-----------------+
-
------BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQC9BEjO8rKGve2qYHg9773UNZIVrJo21ysMhPn3tuHG6BVhbyiM
-HbTqTHlqScAwDc9AZhwaqQuu36ewlyY4hcNmwLo/jN45KwXU8+EMChfduRSvaUUw
-S3fvh4p2DXK/KFHG3gM5HpoPiCQLt9W1ph2BXrJekkYwdXTksEiBDtC3KQIDAQAB
-AoGBAKXrseIAB5jh9lPeNQ7heXhjwiXGiuTjAkYOIMNDRXPuXH5YLna4yQv3L4mO
-zecg6DI2sCrzA29xoukP9ZweR4RUK2cS4/QggH9UgWP0QUpvj4nogyRkh7UrWyVV
-xbboHcmgqWgNLR8GrEZqlpOWFiT+f+QAx783/khvP5QLNp6BAkEA3YvvqfPpepdv
-UC/Uk/8LbVK0LGTSu2ynyl1fMbos9lkJNFdfPM31K6DHeqziIGSoWCSjAsN/e8V7
-MU7egWtI+QJBANppSlO+PTYHWKeOWE7NkM1yVHxAiav9Oott0JywAH8RarfyTuCB
-iyMJP8Rv920GsciDY4dyx0MBJF0tiH+5G7ECQQDQbU5UPbxyMPXwIo+DjHZbq2sG
-OPRoj5hrsdxVFCoouSsHqwtWUQ1Otjv1FaDHiOs3wX/6oaHV97wmb2S1rRFBAkAq
-prELFXVinaCkZ9m62c3TMOZqtTetTHAoVjOMxZnzNnV+omTg1qtTFjVLqQnKUqpZ
-G79N7g4XeZueTov/VSihAkAwGeDXvQ8NlrBlZACCKp1sUqaJptuJ438Qwztbl3Pq
-E6/8TD5yXtrLt9S2LNAFw1i7LVksUB8IbQNTuuwV7LYI
------END RSA PRIVATE KEY-----
diff --git a/tests/suite/pkcs11-certs/server-tmpl b/tests/suite/pkcs11-certs/server-tmpl
deleted file mode 100644
index 23103b4a91..0000000000
--- a/tests/suite/pkcs11-certs/server-tmpl
+++ /dev/null
@@ -1,67 +0,0 @@
-# X.509 Certificate options
-#
-# DN options
-
-dn = "cn=Server,C=CZ"
-
-# The serial number of the certificate
-serial = 2
-
-# In how many days, counting from today, this certificate will expire.
-expiration_days = 2590
-
-# X.509 v3 extensions
-
-# A dnsname in case of a WWW server.
-dns_name = "localhost"
-#dns_name = "www.morethanone.org"
-
-# An IP address in case of a server.
-ip_address = "127.0.0.1"
-
-#dns_name = "www.evenmorethanone.org"
-
-# An email in case of a person
-email = "none@none.org"
-
-# An URL that has CRLs (certificate revocation lists)
-# available. Needed in CA certificates.
-#crl_dist_points = "http://www.getcrl.crl/getcrl/"
-
-#email = "where@none.org"
-
-# Whether this is a CA certificate or not
-#ca
-
-# Whether this certificate will be used for a TLS client
-#tls_www_client
-
-# Whether this certificate will be used for a TLS server
-tls_www_server
-
-# Whether this certificate will be used to sign data (needed
-# in TLS DHE ciphersuites).
-signing_key
-
-# Whether this certificate will be used to encrypt data (needed
-# in TLS RSA ciphersuites). Note that it is preferred to use different
-# keys for encryption and signing.
-encryption_key
-
-# Whether this key will be used to sign other certificates.
-#cert_signing_key
-
-# Whether this key will be used to sign CRLs.
-#crl_signing_key
-
-# Whether this key will be used to sign code.
-#code_signing_key
-
-# Whether this key will be used to sign OCSP data.
-#ocsp_signing_key
-
-# Whether this key will be used for time stamping.
-#time_stamping_key
-
-# Whether this key will be used for IPsec IKE operations.
-#ipsec_ike_key
diff --git a/tests/suite/pkcs11-certs/server.crt b/tests/suite/pkcs11-certs/server.crt
deleted file mode 100644
index 694a0101f7..0000000000
--- a/tests/suite/pkcs11-certs/server.crt
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN CERTIFICATE-----
-MIICdjCCAd+gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAaMQswCQYDVQQDEwJDQTEL
-MAkGA1UEBhMCQ1owIhgPMjAxMzExMTAwODI1MDJaGA8yMDIwMTIxMzA4MjUwMlow
-HjEPMA0GA1UEAxMGU2VydmVyMQswCQYDVQQGEwJDWjCBnzANBgkqhkiG9w0BAQEF
-AAOBjQAwgYkCgYEApf9FBAZadRuU0AGrH4xgNh5V5tFDErTba2bF8b7USLRUzETm
-+qBW87I6QXWDFsZlvyyzrpINmpbG3UNr3cVLgT7DLC2ct5nZFT4j25BYswcr0V5C
-00BAz6NUcuTzY0e0iN+H80H/mUr3Xu5r9wJca1LGTspBF1NOTNoAunlSm3cCAwEA
-AaOBwzCBwDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAA
-ATATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQW
-BBSsHXo5y3IXlGZsdERzQJFEwKBDfTAfBgNVHSMEGDAWgBQSDtpREkBWrvQcbcyh
-sD0oYX4zATAuBgNVHR8EJzAlMCOgIaAfhh1odHRwOi8vd3d3LmdldGNybC5jcmwv
-Z2V0Y3JsLzANBgkqhkiG9w0BAQsFAAOBgQBG1omwPssQQPTLd4WeCQyuM/Yj1kOO
-VwFOATVs2+XELAGg6GVrSS302+JKdW51j+11NpIMgJfgaeRdZkgBNR4uOi1okOQh
-Asm8TC3ex3v1rxZdunp0wBQ/H/ox4zMM5Ds8ITtQNeUwXqUj3tPorTWFEsNegTnY
-WmV1jslH8fZ4Fg==
------END CERTIFICATE-----
diff --git a/tests/suite/pkcs11-certs/server.key b/tests/suite/pkcs11-certs/server.key
deleted file mode 100644
index 56e48735a0..0000000000
--- a/tests/suite/pkcs11-certs/server.key
+++ /dev/null
@@ -1,94 +0,0 @@
-Public Key Info:
-	Public Key Algorithm: RSA
-	Key Security Level: Weak (1024 bits)
-
-modulus:
-	00:a5:ff:45:04:06:5a:75:1b:94:d0:01:ab:1f:8c:
-	60:36:1e:55:e6:d1:43:12:b4:db:6b:66:c5:f1:be:
-	d4:48:b4:54:cc:44:e6:fa:a0:56:f3:b2:3a:41:75:
-	83:16:c6:65:bf:2c:b3:ae:92:0d:9a:96:c6:dd:43:
-	6b:dd:c5:4b:81:3e:c3:2c:2d:9c:b7:99:d9:15:3e:
-	23:db:90:58:b3:07:2b:d1:5e:42:d3:40:40:cf:a3:
-	54:72:e4:f3:63:47:b4:88:df:87:f3:41:ff:99:4a:
-	f7:5e:ee:6b:f7:02:5c:6b:52:c6:4e:ca:41:17:53:
-	4e:4c:da:00:ba:79:52:9b:77:
-
-public exponent:
-	01:00:01:
-
-private exponent:
-	55:76:38:45:1b:34:45:28:9f:13:fc:57:ea:d5:2d:
-	cf:8f:0c:b0:da:3a:0b:0e:7c:0d:2e:8b:68:ab:d3:
-	c5:5e:ba:6d:b4:67:aa:cf:14:15:41:44:46:e1:46:
-	4d:5a:75:95:d8:60:e5:d6:a2:14:5d:de:22:9a:8c:
-	95:4f:f7:4f:cd:eb:65:a0:29:35:b1:16:b7:c2:74:
-	f1:a4:45:43:6c:77:59:37:b3:cb:43:60:80:29:5e:
-	b6:99:60:9a:12:4d:2b:54:2e:c3:3a:76:96:7d:72:
-	b1:72:24:f1:2a:2d:ff:99:92:1e:bb:55:f1:58:6e:
-	64:08:36:26:4b:b2:c6:99:
-
-prime1:
-	00:c7:65:44:0f:4e:6b:51:cd:d4:0b:84:9c:a9:30:
-	1b:7b:6d:9a:ca:f7:27:8d:8f:b5:05:81:b8:0d:d2:
-	a2:b3:e3:ab:bb:04:a1:8d:ec:dc:65:38:99:e9:e1:
-	4f:70:47:79:8d:e6:3a:f0:9f:7b:3b:aa:bd:80:1d:
-	4d:0d:2a:00:7d:
-
-prime2:
-	00:d5:1e:d4:82:40:de:a6:ce:1a:59:93:b8:51:c6:
-	55:15:7f:83:d0:11:ac:a1:44:0a:95:f0:e5:96:03:
-	53:5e:2c:27:eb:63:5f:b7:1c:06:64:fb:35:c9:a3:
-	a1:1a:fb:f2:3c:31:a1:51:58:40:5e:24:28:dd:ba:
-	dc:c4:14:22:03:
-
-coefficient:
-	00:9c:b5:66:d6:6d:93:93:da:0f:15:96:48:07:c6:
-	4a:eb:ae:da:2a:fc:d8:b3:03:cb:5e:5e:10:9e:7f:
-	e8:49:96:db:70:6b:ef:d7:5a:4a:a4:f5:2a:da:89:
-	39:b4:51:09:64:4c:75:92:57:ee:4f:9e:4d:55:f9:
-	d0:34:0e:6f:43:
-
-exp1:
-	2a:3c:5f:10:46:f2:20:9f:d2:bc:a5:d8:71:56:09:
-	5c:39:b9:42:28:dc:2d:f6:34:c7:f7:d4:3e:c9:51:
-	41:7d:86:50:d5:08:4b:81:d2:a5:76:39:d3:fa:af:
-	d2:fe:b0:d6:c7:df:d0:3c:57:e4:29:a4:7e:50:b6:
-	93:85:44:19:
-
-exp2:
-	1a:1b:38:b4:eb:f5:5a:41:8d:00:c4:13:a4:10:c3:
-	83:6a:a7:5e:e9:8b:58:05:d9:b6:1c:58:43:54:0c:
-	f6:50:3a:63:9f:3c:ae:55:84:83:02:32:c8:8c:7e:
-	c3:ab:71:34:e6:6f:78:63:73:1f:15:16:dc:72:73:
-	70:a1:76:b9:
-
-
-Public Key ID: AC:1D:7A:39:CB:72:17:94:66:6C:74:44:73:40:91:44:C0:A0:43:7D
-Public key's random art:
-+--[ RSA 1024]----+
-|      ...o.BX+.  |
-|     . .. E oo   |
-|      o  + o     |
-|       o  B      |
-|        S=       |
-|       + o.      |
-|      o =  .     |
-|      .o.o.      |
-|       oo.       |
-+-----------------+
-
------BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCl/0UEBlp1G5TQAasfjGA2HlXm0UMStNtrZsXxvtRItFTMROb6
-oFbzsjpBdYMWxmW/LLOukg2alsbdQ2vdxUuBPsMsLZy3mdkVPiPbkFizByvRXkLT
-QEDPo1Ry5PNjR7SI34fzQf+ZSvde7mv3AlxrUsZOykEXU05M2gC6eVKbdwIDAQAB
-AoGAVXY4RRs0RSifE/xX6tUtz48MsNo6Cw58DS6LaKvTxV66bbRnqs8UFUFERuFG
-TVp1ldhg5daiFF3eIpqMlU/3T83rZaApNbEWt8J08aRFQ2x3WTezy0NggCletplg
-mhJNK1Quwzp2ln1ysXIk8Sot/5mSHrtV8VhuZAg2JkuyxpkCQQDHZUQPTmtRzdQL
-hJypMBt7bZrK9yeNj7UFgbgN0qKz46u7BKGN7NxlOJnp4U9wR3mN5jrwn3s7qr2A
-HU0NKgB9AkEA1R7UgkDeps4aWZO4UcZVFX+D0BGsoUQKlfDllgNTXiwn62NftxwG
-ZPs1yaOhGvvyPDGhUVhAXiQo3brcxBQiAwJAKjxfEEbyIJ/SvKXYcVYJXDm5Qijc
-LfY0x/fUPslRQX2GUNUIS4HSpXY50/qv0v6w1sff0DxX5CmkflC2k4VEGQJAGhs4
-tOv1WkGNAMQTpBDDg2qnXumLWAXZthxYQ1QM9lA6Y588rlWEgwIyyIx+w6txNOZv
-eGNzHxUW3HJzcKF2uQJBAJy1ZtZtk5PaDxWWSAfGSuuu2ir82LMDy15eEJ5/6EmW
-23Br79daSqT1KtqJObRRCWRMdZJX7k+eTVX50DQOb0M=
------END RSA PRIVATE KEY-----
diff --git a/tests/suite/testpkcs11.pkcs15 b/tests/suite/testpkcs11.pkcs15
deleted file mode 100644
index 565282a312..0000000000
--- a/tests/suite/testpkcs11.pkcs15
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) 2013 Nikos Mavrogiannopoulos
-#
-# This file is part of GnuTLS.
-#
-# GnuTLS is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 3 of the License, or (at
-# your option) any later version.
-#
-# GnuTLS is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with GnuTLS; if not, write to the Free Software Foundation,
-# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-
-
-init_card () {
-	PIN="$1"
-	PUK="$2"
-
-	echo -n "* Erasing smart card... "
-	pkcs15-init -E >"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		cat "${TMPFILE}"
-		exit_error
-	fi
-
-	echo -n "* Initializing smart card... "
-	pkcs15-init --create-pkcs15 --profile pkcs15+onepin --use-default-transport-key --so-pin "${PIN}" --pin "${PIN}" --puk "${PUK}" --label "GnuTLS-Test" >"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		cat "${TMPFILE}"
-		exit_error
-	fi
-}
diff --git a/tests/suite/testpkcs11.sc-hsm b/tests/suite/testpkcs11.sc-hsm
deleted file mode 100644
index f3eab685fb..0000000000
--- a/tests/suite/testpkcs11.sc-hsm
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) 2013 Nikos Mavrogiannopoulos
-#
-# This file is part of GnuTLS.
-#
-# GnuTLS is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 3 of the License, or (at
-# your option) any later version.
-#
-# GnuTLS is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with GnuTLS; if not, write to the Free Software Foundation,
-# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-
-
-init_card () {
-	PIN="$1"
-	PUK=3537363231383830
-	export GNUTLS_SO_PIN="${PUK}"
-
-	echo -n "* Erasing smart card... "
-	sc-hsm-tool --initialize --so-pin "${PUK}" --pin "${PIN}" --label=GnuTLS-Test >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit_error
-	fi
-
-	echo -n "* Initializing smart card... "
-	TOKEN=`${P11TOOL} ${ADDITIONAL_PARAM} --list-tokens pkcs11:token=Nikos|grep URL|grep token=GnuTLS-Test|sed 's/\s*URL\: //g'`
-	if test -z "${TOKEN}"; then
-		echo "Could not find initialized card"
-		exit_error
-	fi
-
-	${P11TOOL} ${ADDITIONAL_PARAM} --initialize "${TOKEN}" --set-so-pin "${PUK}" --set-pin "${PIN}" --label "GnuTLS-Test" >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit_error
-	fi
-}
diff --git a/tests/suite/testpkcs11.sh b/tests/suite/testpkcs11.sh
deleted file mode 100755
index 672ae791db..0000000000
--- a/tests/suite/testpkcs11.sh
+++ /dev/null
@@ -1,935 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) 2013 Nikos Mavrogiannopoulos
-#
-# This file is part of GnuTLS.
-#
-# GnuTLS is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 3 of the License, or (at
-# your option) any later version.
-#
-# GnuTLS is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with GnuTLS; if not, write to the Free Software Foundation,
-# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-
-srcdir="${srcdir:-.}"
-P11TOOL="${P11TOOL:-../../src/p11tool${EXEEXT}}"
-CERTTOOL="${CERTTOOL:-../../src/certtool${EXEEXT}}"
-DIFF="${DIFF:-diff -b -B}"
-SERV="${SERV:-../../src/gnutls-serv${EXEEXT}}"
-CLI="${CLI:-../../src/gnutls-cli${EXEEXT}}"
-RETCODE=0
-
-if test "${GNUTLS_FORCE_FIPS_MODE}" = 1;then
-	echo "Cannot run in FIPS140-2 mode"
-	exit 77
-fi
-
-if ! test -x "${P11TOOL}"; then
-	exit 77
-fi
-
-if ! test -x "${CERTTOOL}"; then
-	exit 77
-fi
-
-if ! test -x "${SERV}"; then
-	exit 77
-fi
-
-if ! test -x "${CLI}"; then
-	exit 77
-fi
-
-if ! test -z "${VALGRIND}"; then
-	VALGRIND="${LIBTOOL:-libtool} --mode=execute valgrind --leak-check=full"
-fi
-
-TMPFILE="testpkcs11.debug"
-CERTTOOL_PARAM="--stdout-info"
-
-if test "${WINDIR}" != ""; then
-	exit 77
-fi 
-
-P11TOOL="${VALGRIND} ${P11TOOL} --batch"
-SERV="${SERV} -q"
-
-. ${srcdir}/../scripts/common.sh
-
-rm -f "${TMPFILE}"
-
-exit_error () {
-	echo "check ${TMPFILE} for additional debugging information"
-	echo ""
-	echo ""
-	tail "${TMPFILE}"
-	exit 1
-}
-
-# $1: token
-# $2: PIN
-# $3: filename
-# ${srcdir}/pkcs11-certs/client.key
-write_privkey () {
-	export GNUTLS_PIN="$2"
-	filename="$3"
-	token="$1"
-
-	echo -n "* Writing a client private key... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label gnutls-client2 --load-privkey "${filename}" "${token}" >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit_error
-	fi
-
-	echo -n "* Checking whether object was marked private... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --list-privkeys "${token};object=gnutls-client2" 2>/dev/null | grep 'Label\:' >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo "private object was public"
-		exit_error
-	fi
-	echo ok
-
-	echo -n "* Checking whether object was marked sensitive... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-privkeys "${token};object=gnutls-client2" | grep "CKA_SENSITIVE" >/dev/null 2>&1
-	if test $? != 0; then
-		echo "private object was not sensitive"
-		exit_error
-	fi
-	echo ok
-}
-
-# $1: token
-# $2: PIN
-# $3: filename
-write_serv_privkey () {
-	export GNUTLS_PIN="$2"
-	filename="$3"
-	token="$1"
-
-	echo -n "* Writing the server private key... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label serv-key --load-privkey "${filename}" "${token}" >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit_error
-	fi
-
-}
-
-# $1: token
-# $2: PIN
-# $3: filename
-write_serv_pubkey () {
-	export GNUTLS_PIN="$2"
-	filename="$3"
-	token="$1"
-
-	echo -n "* Writing the server public key... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label serv-pubkey --load-pubkey "${filename}" "${token}" >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit_error
-	fi
-
-	#verify it being written
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all "${token};object=serv-pubkey;type=public" >>"${TMPFILE}" 2>&1
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all "${token};object=serv-pubkey;type=public"|grep "Public key" >/dev/null 2>&1
-	if test $? != 0;then
-		echo "Cannot verify the existence of the written pubkey"
-		exit_error
-	fi
-}
-
-# $1: token
-# $2: PIN
-# $3: filename
-write_serv_cert () {
-	export GNUTLS_PIN="$2"
-	filename="$3"
-	token="$1"
-
-	echo -n "* Writing the server certificate... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --no-mark-private --label serv-cert --load-certificate "${filename}" "${token}" >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit_error
-	fi
-
-}
-
-# $1: token
-# $2: PIN
-test_delete_cert () {
-	export GNUTLS_PIN="$2"
-	filename="$3"
-	token="$1"
-
-	echo -n "* Deleting the server certificate... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --delete "${token};object=serv-cert;object-type=cert" >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit_error
-	fi
-}
-
-# $1: token
-# $2: PIN
-# $3: bits
-generate_rsa_privkey () {
-	export GNUTLS_PIN="$2"
-	token="$1"
-	bits="$3"
-
-	echo -n "* Generating RSA private key ("${bits}")... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --id 000102030405 --label gnutls-client --generate-rsa --bits "${bits}" "${token}" --outfile tmp-client.pub >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit 1
-	fi
-
-	echo -n "* Checking whether generated private key was marked private... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --list-privkeys "${token};object=gnutls-client" 2>/dev/null | grep 'Label\:' >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo "private object was public"
-		exit_error
-	fi
-	echo ok
-
-	echo -n "* Checking whether private key was marked sensitive... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-privkeys "${token};object=gnutls-client" | grep "CKA_SENSITIVE" >/dev/null 2>&1
-	if test $? != 0; then
-		echo "private object was not sensitive"
-		exit_error
-	fi
-	echo ok
-}
-
-# $1: token
-# $2: PIN
-# $3: bits
-generate_temp_rsa_privkey () {
-	export GNUTLS_PIN="$2"
-	token="$1"
-	bits="$3"
-
-	echo -n "* Generating RSA private key ("${bits}")... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --label temp-rsa-"${bits}" --generate-rsa --bits "${bits}" "${token}" --outfile tmp-client.pub >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit 1
-	fi
-
-#  if test ${RETCODE} = 0; then
-#    echo -n "* Testing private key flags... "
-#    ${P11TOOL} ${ADDITIONAL_PARAM} --login --list-keys "${token};object=gnutls-client2;object-type=private" >tmp-client-2.pub 2>>"${TMPFILE}"
-#    if test $? != 0; then
-#      echo failed
-#      exit_error
-#    fi
-#
-#    grep CKA_WRAP tmp-client-2.pub >>"${TMPFILE}" 2>&1
-#    if test $? != 0; then
-#      echo "failed (no CKA_WRAP)"
-#      exit_error
-#    else
-#      echo ok
-#    fi
-#  fi
-}
-
-generate_temp_dsa_privkey () {
-	export GNUTLS_PIN="$2"
-	token="$1"
-	bits="$3"
-
-	echo -n "* Generating DSA private key ("${bits}")... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --label temp-dsa-"${bits}" --generate-dsa --bits "${bits}" "${token}" --outfile tmp-client.pub >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit 1
-	fi
-}
-
-# $1: token
-# $2: PIN
-delete_temp_privkey () {
-	export GNUTLS_PIN="$2"
-	token="$1"
-	type="$3"
-
-	test "${RETCODE}" = "0" || return
-
-	echo -n "* Deleting private key... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --delete "${token};object=temp-${type};object-type=private" >>"${TMPFILE}" 2>&1
-
-	if test $? != 0; then
-		echo failed
-		RETCODE=1
-		return
-	fi
-
-	RETCODE=0
-	echo ok
-}
-
-# $1: token
-# $2: PIN
-# $3: bits
-export_pubkey_of_privkey () {
-	export GNUTLS_PIN="$2"
-	token="$1"
-	bits="$3"
-
-	echo -n "* Exporting public key of generated private key... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --export-pubkey "${token};object=gnutls-client;object-type=private" --outfile tmp-client-2.pub >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo failed
-		exit 1
-	fi
-
-	${DIFF} tmp-client.pub tmp-client-2.pub
-	if test $? != 0; then
-		echo keys differ
-		exit 1
-	fi
-
-	echo ok
-}
-
-# $1: token
-# $2: PIN
-change_id_of_privkey () {
-	export GNUTLS_PIN="$2"
-	token="$1"
-
-	echo -n "* Change the CKA_ID of generated private key... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --set-id "01a1b103" "${token};object=gnutls-client;id=%00%01%02%03%04%05;object-type=private" >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo failed
-		exit_error
-	fi
-
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-privkeys "${token};object=gnutls-client;object-type=private;id=%01%a1%b1%03" 2>&1 | grep 'ID: 01:a1:b1:03' >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo "ID didn't change"
-		exit_error
-	fi
-
-	echo ok
-}
-
-# $1: token
-# $2: PIN
-change_label_of_privkey () {
-	export GNUTLS_PIN="$2"
-	token="$1"
-
-	echo -n "* Change the CKA_LABEL of generated private key... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --set-label "new-label" "${token};object=gnutls-client;object-type=private" >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo failed
-		exit_error
-	fi
-
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-privkeys "${token};object=new-label;object-type=private" 2>&1 |grep 'Label: new-label' >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo "label didn't change"
-		exit_error
-	fi
-
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --set-label "gnutls-client" "${token};object=new-label;object-type=private" >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo failed
-		exit_error
-	fi
-
-	echo ok
-}
-
-# $1: token
-# $2: PIN
-# $3: bits
-generate_temp_ecc_privkey () {
-	export GNUTLS_PIN="$2"
-	token="$1"
-	bits="$3"
-
-	echo -n "* Generating ECC private key (${bits})... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --label "temp-ecc-${bits}" --generate-ecc --bits "${bits}" "${token}" --outfile tmp-client.pub >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit 1
-	fi
-}
-
-# $1: token
-# $2: PIN
-# $3: bits
-# The same as generate_temp_ecc_privkey but no explicit login is performed.
-# p11tool should detect that login is required for the operation.
-generate_temp_ecc_privkey_no_login () {
-	export GNUTLS_PIN="$2"
-	token="$1"
-	bits="$3"
-
-	echo -n "* Generating ECC private key without --login (${bits})... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --label "temp-ecc-no-${bits}" --generate-ecc --bits "${bits}" "${token}" --outfile tmp-client.pub >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit 1
-	fi
-}
-
-# $1: name
-# $2: label prefix
-# $3: generate option
-# $4: token
-# $5: PIN
-# $6: bits
-import_privkey () {
-	export GNUTLS_PIN="$5"
-	name="$1"
-	prefix="$2"
-	gen_option="$3"
-	token="$4"
-	bits="$6"
-
-	outfile="tmp-${prefix}-${bits}.pem"
-
-	echo -n "* Importing ${name} private key (${bits})... "
-
-	"${CERTTOOL}" ${CERTTOOL_PARAM} --generate-privkey "${gen_option}" --pkcs8 --password= --outfile "${outfile}" >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo failed
-		exit 1
-	fi
-
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label "${prefix}-${bits}" --load-privkey "${outfile}" "${token}" >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit 1
-	fi
-}
-
-import_temp_rsa_privkey () {
-	import_privkey RSA temp-rsa --rsa $@
-}
-
-import_temp_ecc_privkey () {
-	import_privkey ECC temp-ecc --ecc $@
-}
-
-import_temp_dsa_privkey () {
-	import_privkey DSA temp-dsa --dsa $@
-}
-
-# $1: token
-# $2: PIN
-# $3: cakey: ${srcdir}/pkcs11-certs/ca.key
-# $4: cacert: ${srcdir}/pkcs11-certs/ca.crt
-#
-# Tests writing a certificate which corresponds to the given key,
-# as well as the CA certificate, and tries to export them.
-write_certificate_test () {
-	export GNUTLS_PIN="$2"
-	token="$1"
-	cakey="$3"
-	cacert="$4"
-	pubkey="$5"
-
-	echo -n "* Generating client certificate... "
-	"${CERTTOOL}" ${CERTTOOL_PARAM} ${ADDITIONAL_PARAM}  --generate-certificate --load-ca-privkey "${cakey}"  --load-ca-certificate "${cacert}"  \
-	--template ${srcdir}/pkcs11-certs/client-tmpl --load-privkey "${token};object=gnutls-client;object-type=private" \
-	--load-pubkey "$pubkey" --outfile tmp-client.crt >>"${TMPFILE}" 2>&1
-
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit_error
-	fi
-
-	echo -n "* Writing client certificate... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --id "01a1b103" --label gnutls-client --load-certificate tmp-client.crt "${token}" >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit_error
-	fi
-
-	echo -n "* Checking whether ID was correctly set... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-certs "${token};object=gnutls-client;object-type=private;id=%01%a1%b1%03" 2>&1 | grep 'ID: 01:a1:b1:03' >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo "ID was not set on copy"
-		exit_error
-	fi
-	echo ok
-
-	if test -n "${BROKEN_SOFTHSM2}";then
-		return
-	fi
-
-	echo -n "* Checking whether object was public... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --list-all-certs "${token};object=gnutls-client;id=%01%a1%b1%03" 2>&1 | grep 'ID: 01:a1:b1:03' >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo "certificate object was not public"
-		exit_error
-	fi
-	echo ok
-
-	if test -n "${BROKEN_SOFTHSM2}";then
-		return
-	fi
-
-	echo -n "* Writing certificate of client's CA... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --mark-trusted --mark-ca --write --label gnutls-ca --load-certificate "${cacert}" "${token}" >>"${TMPFILE}" 2>&1
-	ret=$?
-	if test ${ret} != 0; then
-		echo "Failed with PIN, trying to write with so PIN" >>"${TMPFILE}"
-		${P11TOOL} ${ADDITIONAL_PARAM} --so-login --mark-ca --write --mark-trusted --label gnutls-ca --load-certificate "${cacert}" "${token}" >>"${TMPFILE}" 2>&1
-		ret=$?
-	fi
-
-	if test ${ret} = 0; then
-		echo ok
-	else
-		echo failed
-		exit_error
-	fi
-
-	echo -n "* Testing certificate flags... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all-certs "${token};object=gnutls-ca;object-type=cert" |grep Flags|head -n 1 >tmp-client-2.pub 2>>"${TMPFILE}"
-	if test $? != 0; then
-		echo failed
-		exit_error
-	fi
-
-	grep CKA_TRUSTED tmp-client-2.pub >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo "failed (no CKA_TRUSTED)"
-		#exit_error
-	fi
-
-	grep "CKA_CERTIFICATE_CATEGORY=CA" tmp-client-2.pub >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo "failed (no CKA_CERTIFICATE_CATEGORY=CA)"
-		#exit_error
-	fi
-
-	echo ok
-
-
-	echo -n "* Trying to obtain back the cert... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --export "${token};object=gnutls-ca;object-type=cert" --outfile crt1.tmp >>"${TMPFILE}" 2>&1
-	${DIFF} crt1.tmp "${srcdir}/pkcs11-certs/ca.crt"
-	if test $? != 0; then
-		echo "failed. Exported certificate differs (crt1.tmp)!"
-		exit_error
-	fi
-	rm -f crt1.tmp
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit_error
-	fi
-
-	echo -n "* Trying to obtain the full chain... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --export-chain "${token};object=gnutls-client;object-type=cert"|"${CERTTOOL}" ${CERTTOOL_PARAM}  -i --outfile crt1.tmp >>"${TMPFILE}" 2>&1
-
-	cat tmp-client.crt ${srcdir}/pkcs11-certs/ca.crt|"${CERTTOOL}" ${CERTTOOL_PARAM}  -i >crt2.tmp
-	${DIFF} crt1.tmp crt2.tmp
-	if test $? != 0; then
-		echo "failed. Exported certificate chain differs!"
-		exit_error
-	fi
-	rm -f crt1.tmp crt2.tmp
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit_error
-	fi
-}
-
-# $1: token
-# $2: PIN
-# $3: cakey: ${srcdir}/pkcs11-certs/ca.key
-# $4: cacert: ${srcdir}/pkcs11-certs/ca.crt
-#
-# Tests writing a certificate which corresponds to the given key,
-# and verifies whether the ID is the same. Should utilize the
-# ID of the public key.
-write_certificate_id_test_rsa () {
-	export GNUTLS_PIN="$2"
-	token="$1"
-	cakey="$3"
-	cacert="$4"
-
-	echo -n "* Generating RSA private key on HSM... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --label xxx1-rsa --generate-rsa --bits 1024 "${token}" >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit 1
-	fi
-
-	echo -n "* Checking whether right ID is set on copy... "
-	"${CERTTOOL}" ${CERTTOOL_PARAM} ${ADDITIONAL_PARAM}  --generate-certificate --load-ca-privkey "${cakey}"  --load-ca-certificate "${cacert}"  \
-	--template ${srcdir}/pkcs11-certs/client-tmpl --load-privkey "${token};object=xxx1-rsa;object-type=private" \
-	--outfile tmp-client.crt >>"${TMPFILE}" 2>&1
-
-	if test $? != 0; then
-		echo failed
-		exit_error
-	fi
-
-	id=$(${P11TOOL} ${ADDITIONAL_PARAM} --list-all "${token};object=xxx1-rsa;object-type=public" 2>&1 | grep 'ID: '|sed -e 's/ID://' -e 's/^[ \t]*//' -e 's/[ \t]*$//')
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label tmp-xxx1-rsa --load-certificate tmp-client.crt "${token}" >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo failed
-		exit_error
-	fi
-
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-certs "${token};object=tmp-xxx1-rsa;object-type=cert" 2>&1 | grep "ID: ${id}" >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo "ID '$id' was not set on copy"
-		exit_error
-	fi
-	echo ok
-}
-
-# $1: token
-# $2: PIN
-# $3: cakey: ${srcdir}/pkcs11-certs/ca.key
-# $4: cacert: ${srcdir}/pkcs11-certs/ca.crt
-#
-# Tests writing a certificate which corresponds to the given key,
-# and verifies whether the ID is the same. Should utilize the
-# ID of the private key.
-write_certificate_id_test_rsa2 () {
-	export GNUTLS_PIN="$2"
-	token="$1"
-	cakey="$3"
-	cacert="$4"
-	tmpkey="key.$$.tmp"
-
-	echo -n "* Generating RSA private key... "
-	${CERTTOOL} ${ADDITIONAL_PARAM} --generate-privkey --bits 1024 --outfile ${tmpkey} >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit 1
-	fi
-
-	echo -n "* Checking whether right ID is set on copy... "
-	"${CERTTOOL}" ${CERTTOOL_PARAM} ${ADDITIONAL_PARAM}  --generate-certificate --load-ca-privkey "${cakey}"  --load-ca-certificate "${cacert}"  \
-	--template ${srcdir}/pkcs11-certs/client-tmpl --load-privkey ${tmpkey} \
-	--outfile tmp-client.crt >>"${TMPFILE}" 2>&1
-
-	if test $? != 0; then
-		echo failed
-		exit_error
-	fi
-
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label xxx2-rsa --load-privkey ${tmpkey} "${token}" >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo failed
-		exit_error
-	fi
-
-	id=$(${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all "${token};object=xxx2-rsa;object-type=private" 2>&1 | grep 'ID: '|sed -e 's/ID://' -e 's/^[ \t]*//' -e 's/[ \t]*$//')
-
-	rm -f ${tmpkey}
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label tmp-xxx2-rsa --load-certificate tmp-client.crt "${token}" >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo failed
-		exit_error
-	fi
-
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-certs "${token};object=tmp-xxx2-rsa;object-type=cert" 2>&1 | grep "ID: ${id}" >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo "ID '$id' was not set on copy"
-		exit_error
-	fi
-	echo ok
-}
-
-# $1: token
-# $2: PIN
-# $3: cakey: ${srcdir}/pkcs11-certs/ca.key
-# $4: cacert: ${srcdir}/pkcs11-certs/ca.crt
-#
-# Tests writing a certificate which corresponds to the given key,
-# and verifies whether the ID is the same. Should utilize the
-# ID of the private key.
-write_certificate_id_test_ecdsa () {
-	export GNUTLS_PIN="$2"
-	token="$1"
-	cakey="$3"
-	cacert="$4"
-	tmpkey="key.$$.tmp"
-
-	echo -n "* Generating ECDSA private key... "
-	${CERTTOOL} ${ADDITIONAL_PARAM} --generate-privkey --ecdsa --outfile ${tmpkey} >>"${TMPFILE}" 2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit 1
-	fi
-
-	echo -n "* Checking whether right ID is set on copy... "
-	"${CERTTOOL}" ${CERTTOOL_PARAM} ${ADDITIONAL_PARAM}  --generate-certificate --load-ca-privkey "${cakey}"  --load-ca-certificate "${cacert}"  \
-	--template ${srcdir}/pkcs11-certs/client-tmpl --load-privkey ${tmpkey} \
-	--outfile tmp-client.crt >>"${TMPFILE}" 2>&1
-
-	if test $? != 0; then
-		echo failed
-		exit_error
-	fi
-
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label xxx-ecdsa --load-privkey ${tmpkey} "${token}" >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo failed
-		exit_error
-	fi
-
-	id=$(${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all "${token};object=xxx-ecdsa;object-type=private" 2>&1 | grep 'ID: '|sed -e 's/ID://' -e 's/^[ \t]*//' -e 's/[ \t]*$//')
-
-	rm -f ${tmpkey}
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label tmp-xxx-ecdsa --load-certificate tmp-client.crt "${token}" >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo failed
-		exit_error
-	fi
-
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-certs "${token};object=tmp-xxx-ecdsa;object-type=cert" 2>&1 | grep "ID: ${id}" >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo "ID '$id' was not set on copy"
-		exit_error
-	fi
-	echo ok
-}
-
-test_sign () {
-	export GNUTLS_PIN="$2"
-	token="$1"
-
-	echo -n "* Testing signatures using the private key... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --test-sign "${token};object=serv-key" >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo "failed. Cannot test signatures."
-		exit_error
-	fi
-	echo ok
-
-	echo -n "* Testing RSA-PSS signatures using the private key... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --sign-params rsa-pss --test-sign "${token};object=serv-key" >>"${TMPFILE}" 2>&1
-	rc=$?
-	if test $rc != 0; then
-		if test $rc = 2; then
-			echo "failed. RSA-PSS not supported."
-		else
-			echo "failed. Cannot test signatures."
-			exit_error
-		fi
-	else
-		echo ok
-	fi
-
-	echo -n "* Testing signatures using the private key (with ID)... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --test-sign "${token};id=%ac%1d%7a%39%cb%72%17%94%66%6c%74%44%73%40%91%44%c0%a0%43%7d" >>"${TMPFILE}" 2>&1
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --test-sign "${token};id=%ac%1d%7a%39%cb%72%17%94%66%6c%74%44%73%40%91%44%c0%a0%43%7d" 2>&1|grep "Verifying against public key in the token..."|grep ok >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo "failed. Cannot test signatures with ID."
-		exit_error
-	fi
-	echo ok
-}
-
-# This tests the signing operation as well as the usage of --set-pin
-test_sign_set_pin () {
-	pin="$2"
-	token="$1"
-
-	unset GNUTLS_PIN
-
-	echo -n "* Testing signatures using the private key and --set-pin... "
-	${P11TOOL} ${ADDITIONAL_PARAM} --login --set-pin ${pin} --test-sign "${token};object=serv-key" >>"${TMPFILE}" 2>&1
-	if test $? != 0; then
-		echo "failed. Cannot test signatures."
-		exit_error
-	fi
-	echo ok
-
-	export GNUTLS_PIN=${pin}
-}
-
-# $1: token
-# $2: PIN
-# $3: certfile
-# $4: keyfile
-# $5: cafile
-#
-# Tests using a certificate and key pair using gnutls-serv and gnutls-cli.
-use_certificate_test () {
-	export GNUTLS_PIN="$2"
-	token="$1"
-	certfile="$3"
-	keyfile="$4"
-	cafile="$5"
-	txt="$6"
-
-	echo -n "* Using PKCS #11 with gnutls-cli (${txt})... "
-	# start server
-	eval "${GETPORT}"
-	launch_pkcs11_server $$ "${ADDITIONAL_PARAM}" --echo --priority NORMAL --x509certfile="${certfile}" \
-		--x509keyfile="$keyfile" --x509cafile="${cafile}" \
-		--verify-client-cert --require-client-cert >>"${TMPFILE}" 2>&1
-
-	PID=$!
-	wait_server ${PID}
-
-	# connect to server using SC
-	${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509cafile="${cafile}" </dev/null >>"${TMPFILE}" 2>&1 && \
-		fail ${PID} "Connection should have failed!"
-
-	${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509certfile="${certfile}" \
-	--x509keyfile="$keyfile" --x509cafile="${cafile}" </dev/null >>"${TMPFILE}" 2>&1 || \
-		fail ${PID} "Connection (with files) should have succeeded!"
-
-	${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509certfile="${token};object=gnutls-client;object-type=cert" \
-		--x509keyfile="${token};object=gnutls-client;object-type=private" \
-		--x509cafile="${cafile}" </dev/null >>"${TMPFILE}" 2>&1 || \
-		fail ${PID} "Connection (with SC) should have succeeded!"
-
-	kill ${PID}
-	wait
-
-	echo ok
-}
-
-
-
-echo "Testing PKCS11 support"
-
-# erase SC
-
-type="$1"
-
-if test -z "${type}"; then
-	echo "usage: $0: [pkcs15|softhsm|sc-hsm]"
-	if test -x "/usr/bin/softhsm" || test -x "/usr/bin/softhsm2-util"; then
-		echo "assuming 'softhsm'"
-		echo ""
-		type=softhsm
-	else
-		exit 1
-	fi
-
-fi
-
-. "${srcdir}/testpkcs11.${type}"
-
-export GNUTLS_PIN=12345678
-export GNUTLS_SO_PIN=00000000
-
-init_card "${GNUTLS_PIN}" "${GNUTLS_SO_PIN}"
-
-# find token name
-TOKEN=`${P11TOOL} ${ADDITIONAL_PARAM} --list-tokens pkcs11:token=Nikos|grep URL|grep token=GnuTLS-Test|sed 's/\s*URL\: //g'`
-
-echo "* Token: ${TOKEN}"
-if test "x${TOKEN}" = x; then
-	echo "Could not find generated token"
-	exit_error
-fi
-
-#write a given privkey
-write_privkey "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/client.key"
-
-generate_temp_ecc_privkey "${TOKEN}" "${GNUTLS_PIN}" 256
-delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" ecc-256
-
-generate_temp_ecc_privkey_no_login "${TOKEN}" "${GNUTLS_PIN}" 256
-delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" ecc-no-256
-
-generate_temp_ecc_privkey "${TOKEN}" "${GNUTLS_PIN}" 384
-delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" ecc-384
-
-generate_temp_rsa_privkey "${TOKEN}" "${GNUTLS_PIN}" 2048
-delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" rsa-2048
-
-generate_temp_dsa_privkey "${TOKEN}" "${GNUTLS_PIN}" 3072
-delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" dsa-3072
-
-import_temp_rsa_privkey "${TOKEN}" "${GNUTLS_PIN}" 1024
-delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" rsa-1024
-import_temp_ecc_privkey "${TOKEN}" "${GNUTLS_PIN}" 256
-delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" ecc-256
-import_temp_dsa_privkey "${TOKEN}" "${GNUTLS_PIN}" 2048
-delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" dsa-2048
-
-generate_rsa_privkey "${TOKEN}" "${GNUTLS_PIN}" 1024
-change_id_of_privkey "${TOKEN}" "${GNUTLS_PIN}"
-export_pubkey_of_privkey "${TOKEN}" "${GNUTLS_PIN}"
-change_label_of_privkey "${TOKEN}" "${GNUTLS_PIN}"
-
-write_certificate_test "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/ca.key" "${srcdir}/pkcs11-certs/ca.crt" tmp-client.pub
-write_serv_privkey "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/server.key"
-write_serv_cert "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/server.crt"
-
-write_serv_pubkey "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/server.crt"
-test_sign "${TOKEN}" "${GNUTLS_PIN}"
-
-use_certificate_test "${TOKEN}" "${GNUTLS_PIN}" "${TOKEN};object=serv-cert;object-type=cert" "${TOKEN};object=serv-key;object-type=private" "${srcdir}/pkcs11-certs/ca.crt" "full URLs"
-
-use_certificate_test "${TOKEN}" "${GNUTLS_PIN}" "${TOKEN};object=serv-cert" "${TOKEN};object=serv-key" "${srcdir}/pkcs11-certs/ca.crt" "abbrv URLs"
-
-write_certificate_id_test_rsa "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/ca.key" "${srcdir}/pkcs11-certs/ca.crt"
-write_certificate_id_test_rsa2 "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/ca.key" "${srcdir}/pkcs11-certs/ca.crt"
-write_certificate_id_test_ecdsa "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/ca.key" "${srcdir}/pkcs11-certs/ca.crt"
-
-test_delete_cert "${TOKEN}" "${GNUTLS_PIN}"
-
-test_sign_set_pin "${TOKEN}" "${GNUTLS_PIN}"
-
-if test ${RETCODE} = 0; then
-	echo "* All smart cards tests succeeded"
-fi
-rm -f tmp-client.crt tmp-client.pub tmp-client-2.pub "${TMPFILE}"
-
-exit 0
diff --git a/tests/suite/testpkcs11.softhsm b/tests/suite/testpkcs11.softhsm
deleted file mode 100755
index d79a8528ec..0000000000
--- a/tests/suite/testpkcs11.softhsm
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) 2013 Nikos Mavrogiannopoulos
-#
-# This file is part of GnuTLS.
-#
-# GnuTLS is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 3 of the License, or (at
-# your option) any later version.
-#
-# GnuTLS is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with GnuTLS; if not, write to the Free Software Foundation,
-# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-
-for i in /usr/lib64/pkcs11 /usr/lib/softhsm /usr/lib/x86_64-linux-gnu/softhsm /usr/lib /usr/lib64/softhsm;do
-	if test -f "$i/libsofthsm2.so"; then
-		ADDITIONAL_PARAM="--provider $i/libsofthsm2.so"
-		break
-	else
-		if test -f "$i/libsofthsm.so";then
-			ADDITIONAL_PARAM="--provider $i/libsofthsm.so"
-			break
-		fi
-	fi
-done
-
-init_card () {
-	PIN="$1"
-	PUK="$2"
-
-	if test -x "/usr/bin/softhsm2-util"; then
-		export SOFTHSM2_CONF="softhsm-testpkcs11.$$.config.tmp"
-		SOFTHSM_TOOL="/usr/bin/softhsm2-util"
-		${SOFTHSM_TOOL} --version|grep "2.0.0" >/dev/null 2>&1
-		if test $? = 0; then
-			echo "softhsm2-util 2.0.0 is broken"
-			export BROKEN_SOFTHSM2=1
-		fi
-	fi
-
-	if test -x "/usr/bin/softhsm"; then
-		export SOFTHSM_CONF="softhsm-testpkcs11.$$.config.tmp"
-		SOFTHSM_TOOL="/usr/bin/softhsm"
-	fi
-
-	if test -z "${SOFTHSM_TOOL}"; then
-		echo "Could not find softhsm(2) tool"
-		exit 77
-	fi
-
-	if test -z "${SOFTHSM_CONF}"; then
-		rm -rf ./softhsm-testpkcs11.$$.tmp
-		mkdir -p ./softhsm-testpkcs11.$$.tmp
-		echo "objectstore.backend = file" > "${SOFTHSM2_CONF}"
-		echo "directories.tokendir = ./softhsm-testpkcs11.$$.tmp" >> "${SOFTHSM2_CONF}"
-
-	else
-		rm -rf ./softhsm-testpkcs11.$$.tmp
-		echo "0:./softhsm-testpkcs11.$$.tmp" > "${SOFTHSM_CONF}"
-	fi
-
-
-	echo -n "* Initializing smart card... "
-	${SOFTHSM_TOOL} --init-token --slot 0 --label "GnuTLS-Test" --so-pin "${PUK}" --pin "${PIN}" >/dev/null #2>&1
-	if test $? = 0; then
-		echo ok
-	else
-		echo failed
-		exit_error
-	fi
-}