Fixes for ICE-5910: merged makecerts.py with makewinrtcerts.py, removed WinRT certs

34 files changed, 418 insertions, 1213 deletions

diff --git a/certs/makecerts.py b/certs/makecerts.py
index 753824bfafb..d69c57aff27 100755
--- a/certs/makecerts.py
+++ b/certs/makecerts.py
@@ -8,92 +8,33 @@
 #
 # **********************************************************************
 
-import os, sys, shutil, subprocess
+import os, sys, shutil, glob, socket, subprocess
 
-#
-# Show usage information.
-#
 def usage():
-    print("Usage: " + sys.argv[0] + " [options] [cpp|java|.net]")
+    print("Usage: " + sys.argv[0] + " [options] [ip-address]")
     print("")
     print("Options:")
     print("-h    Show this message.")
-    print("-f    Force updates to files that otherwise would be skipped.")
     print("-d    Debugging output.")
-    print("")
-    print("The certificates for all languages are updated if you do not specify one.")
-
-def newer(file1, file2):
-    file1info = os.stat(file1)
-    file2info = os.stat(file2)
-    return file1info.st_mtime > file2info.st_mtime
-
-def prepareCAHome(dir, force):
-    if force and os.path.exists(dir):
-        shutil.rmtree(dir)
-
-    if not os.path.exists(dir):
-        os.mkdir(dir)
-
-    if not os.path.exists(os.path.join(dir, "serial")):
-        f = open(os.path.join(dir, "serial"), "w")
-        f.write("01")
-        f.close()
-
-    f = open(os.path.join(dir, "index.txt"), "w")
-    f.truncate(0)
-    f.close()
-
-    
-def jksToBks(source, target):
-    cmd = "keytool -importkeystore -srckeystore " + source + " -destkeystore " + target + " -srcstoretype JKS -deststoretype BKS " + \
-          "-srcstorepass password -deststorepass password -provider org.bouncycastle.jce.provider.BouncyCastleProvider -noprompt"
-    if debug:
-        print("[debug]", cmd)
-
+    sys.exit(1)
 
-    p = subprocess.Popen(cmd, shell = True, stdin = subprocess.PIPE, stdout = subprocess.PIPE,
-                        stderr = subprocess.STDOUT, bufsize = 0)
+try:
+    from subprocess import DEVNULL
+except ImportError:
+    DEVNULL = open(os.devnull, 'wb')
 
-    while(True):
+debug = False
+ipAddress = None
 
-        line = p.stdout.readline()            
-        if p.poll() is not None and not line:
-            # The process terminated
-            break
-            
-        sys.stdout.write(line)
-        
-        if line.find("java.lang.ClassNotFoundException: org.bouncycastle.jce.provider.BouncyCastleProvider") != -1:
-            print("")
-            print("WARNING: BouncyCastleProvider not found cannot export certificates for android demos in BKS format.")
-            print("         You can download BKS provider from http://www.bouncycastle.org/download/bcprov-jdk15on-146.jar.")
-            print("         After download copy the JAR to $JAVA_HOME/lib/ext where JAVA_HOME points to your JRE")
-            print("         and run this script again.")
-            print("")
-            sys.exit(1)
-        elif line.find("java.security.InvalidKeyException: Illegal key size") != -1:
-            print("")
-            print("WARNING: You need to install Java Cryptography Extension (JCE) Unlimited Strength.")
-            print("         You can download it from Additional Resources section in Orcale Java Download page at:")
-            print("             http://www.oracle.com/technetwork/java/javase/downloads/index.html.")
-            print("")
-            sys.exit(1)
-            
-    if p.poll() != 0:
-        sys.exist(1)
 #
 # Check arguments
 #
-force = False
 debug = False
-lang = None
+ipAddress = None
 for x in sys.argv[1:]:
     if x == "-h":
         usage()
         sys.exit(0)
-    elif x == "-f":
-        force = True
     elif x == "-d":
         debug = True
     elif x.startswith("-"):
@@ -102,400 +43,330 @@ for x in sys.argv[1:]:
         usage()
         sys.exit(1)
     else:
-        if lang != None or x not in ["cpp", "java", ".net"]:
-            usage()
-            sys.exit(1)
-        lang = x
+        ipAddress = x
+
+if not ipAddress:
+    try:
+        ipAddress = socket.gethostbyname(socket.gethostname())
+    except:
+        ipAddress = "127.0.0.1"
+
+cwd = os.getcwd()
+if not os.path.exists("ImportKey.class") or os.path.basename(cwd) != "certs":
+    print("You must run this script from the certs directory")
+    sys.exit(1)
+
+bksSupport = True
+if subprocess.call("javap org.bouncycastle.jce.provider.BouncyCastleProvider", shell=True, stdout=DEVNULL, stderr=DEVNULL) != 0:
+    print("warning: couldn't find Bouncy Castle provider, Android certificates won't be created")
+    bksSupport = False
+    
+while True:
+    print("The IP address used for the server certificate will be: " + ipAddress)
+    sys.stdout.write("Do you want to keep this IP address? (y/n) [y]")
+    sys.stdout.flush()
+    input = sys.stdin.readline().strip()
+    if input == 'n':
+        sys.stdout.write("IP : ")
+        sys.stdout.flush()
+        ipAddress = sys.stdin.readline().strip()
+    else:
+        break
 
 certs = "."
-caHome = os.path.join(certs, "openssl", "ca")
+caHome = os.path.abspath(os.path.join(certs, "ca")).replace('\\', '/')
 
 #
-# Check for cakey.pem and regenerate it if it doesn't exist or if force is true.
+# Static configuration file data.
 #
-caKey = os.path.join(certs, "cakey.pem")
-caCert = os.path.join(certs, "cacert.pem")
-if not os.path.exists(caKey) or force:
-
-    print("Generating new CA certificate and key...")
-    if os.path.exists(caKey):
-        os.remove(caKey)
-    if os.path.exists(caCert):
-        os.remove(caCert)
-
-    prepareCAHome(caHome, force)
-
-    config = os.path.join(certs, "openssl", "ice_ca.cnf")
-    cmd = "openssl req -config " + config + " -x509 -days 1825 -newkey rsa:1024 -out " + \
-           os.path.join(caHome, "cacert.pem") + " -outform PEM -nodes"
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
-    shutil.copyfile(os.path.join(caHome, "cakey.pem"), caKey)
-    shutil.copyfile(os.path.join(caHome, "cacert.pem"), caCert)
-
-    cmd = "openssl x509 -in " + caCert + " -outform DER -out " + os.path.join(certs, "cacert.der")
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
-
-else:
-    print("Skipping CA certificate and key.")
-
-#
-# C++ server RSA certificate and key.
-#
-cppServerCert = os.path.join(certs, "s_rsa1024_pub.pem")
-cppServerKey = os.path.join(certs, "s_rsa1024_priv.pem")
-if force or not os.path.exists(cppServerCert) or not os.path.exists(cppServerKey) or \
-   (os.path.exists(cppServerCert) and newer(caCert, cppServerCert)):
-
-    print("Generating new C++ server RSA certificate and key...")
-
-    if os.path.exists(cppServerCert):
-        os.remove(cppServerCert)
-    if os.path.exists(cppServerKey):
-        os.remove(cppServerKey)
-
-    prepareCAHome(caHome, force)
-
-    serial = os.path.join(caHome, "serial")
-    f = open(serial, "r")
-    serialNum = f.read().strip()
-    f.close()
-
-    tmpKey = os.path.join(caHome, serialNum + "_key.pem")
-    tmpCert = os.path.join(caHome, serialNum + "_cert.pem")
-    req = os.path.join(caHome, "req.pem")
-    config = os.path.join(certs, "openssl", "server.cnf")
-    cmd = "openssl req -config " + config + " -newkey rsa:1024 -nodes -keyout " + tmpKey + " -keyform PEM" + \
-           " -out " + req
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
+configFiles = {\
+"ca.cnf":"\
+# **********************************************************************\n\
+#\n\
+# Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.\n\
+#\n\
+# This copy of Ice is licensed to you under the terms described in the\n\
+# ICE_LICENSE file included in this distribution.\n\
+#\n\
+# **********************************************************************\n\
+\n\
+# Configuration file for the CA. This file is generated by iceca init.\n\
+# DO NOT EDIT!\n\
+\n\
+###############################################################################\n\
+###  Self Signed Root Certificate\n\
+###############################################################################\n\
+\n\
+[ ca ]\n\
+default_ca = ice\n\
+\n\
+[ ice ]\n\
+default_days     = 1825    # How long certs are valid.\n\
+default_md       = sha256  # The Message Digest type.\n\
+preserve         = no      # Keep passed DN ordering?\n\
+\n\
+[ req ]\n\
+default_bits        = 2048\n\
+default_keyfile     = {0}/cakey.pem\n\
+default_md          = sha256\n\
+prompt              = no\n\
+distinguished_name  = dn\n\
+x509_extensions     = extensions\n\
+\n\
+[ extensions ]\n\
+basicConstraints = CA:true\n\
+\n\
+# PKIX recommendation.\n\
+subjectKeyIdentifier = hash\n\
+authorityKeyIdentifier = keyid:always,issuer:always\n\
+\n\
+[dn]\n\
+countryName            = US\n\
+stateOrProvinceName    = Florida\n\
+localityName           = Jupiter\n\
+organizationName       = ZeroC, Inc.\n\
+organizationalUnitName = Ice\n\
+commonName             = ZeroC Tests and Demos CA\n\
+emailAddress           = info@zeroc.com\n\
+",\
+"ice.cnf":"\
+# **********************************************************************\n\
+#\n\
+# Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.\n\
+#\n\
+# This copy of Ice is licensed to you under the terms described in the\n\
+# ICE_LICENSE file included in this distribution.\n\
+#\n\
+# **********************************************************************\n\
+\n\
+# Configuration file to sign a certificate. This file is generated by iceca init.\n\
+# DO NOT EDIT!!\n\
+\n\
+[ ca ]\n\
+default_ca = ice\n\
+\n\
+[ ice ]\n\
+dir              = {0}              # Where everything is kept.\n\
+private_key      = $dir/cakey.pem   # The CA Private Key.\n\
+certificate      = $dir/cacert.pem  # The CA Certificate.\n\
+database         = $dir/index.txt           # Database index file.\n\
+new_certs_dir    = $dir                     # Default loc for new certs.\n\
+serial           = $dir/serial              # The current serial number.\n\
+certs            = $dir                     # Where issued certs are kept.\n\
+RANDFILE         = $dir/.rand               # Private random number file.\n\
+default_days     = 1825                     # How long certs are valid.\n\
+default_md       = sha256                      # The Message Digest type.\n\
+preserve         = yes                      # Keep passed DN ordering?\n\
+\n\
+policy           = ca_policy\n\
+x509_extensions  = certificate_extensions\n\
+\n\
+[ certificate_extensions ]\n\
+basicConstraints = CA:false\n\
+\n\
+# PKIX recommendation.\n\
+subjectKeyIdentifier = hash\n\
+authorityKeyIdentifier = keyid:always,issuer:always\n\
+subjectAltName         = DNS:{1}, IP:{2}\n\
+\n\
+[ ca_policy ]\n\
+countryName            = match\n\
+stateOrProvinceName    = match\n\
+organizationName       = match\n\
+organizationalUnitName = optional\n\
+emailAddress           = optional\n\
+commonName             = supplied\n\
+\n\
+[ req ]\n\
+default_bits        = 1024\n\
+default_md          = sha256\n\
+prompt              = no\n\
+distinguished_name  = dn\n\
+x509_extensions     = extensions\n\
+\n\
+[ extensions ]\n\
+basicConstraints = CA:false\n\
+\n\
+# PKIX recommendation.\n\
+subjectKeyIdentifier = hash\n\
+authorityKeyIdentifier = keyid:always,issuer:always\n\
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment\n\
+\n\
+[dn]\n\
+countryName            = US\n\
+stateOrProvinceName    = Florida\n\
+localityName           = Jupiter\n\
+organizationName       = ZeroC, Inc.\n\
+organizationalUnitName = Ice\n\
+commonName             = {3}\n\
+emailAddress           = info@zeroc.com\n\
+" }
+
+def generateConf(file, dns = None, ip = None, commonName = None):
+    cnf = open(os.path.join(caHome, file), "w")
+    if dns and ip and commonName:
+        cnf.write(configFiles[file].format(caHome, dns, ip, commonName))
+    else:
+        cnf.write(configFiles[file].format(caHome))
+    cnf.close()
 
-    cmd = "openssl ca -config " + config + " -batch -in " + req
+def run(cmd):
     if debug:
         print("[debug]", cmd)
-    os.system(cmd)
-    shutil.move(os.path.join(caHome, serialNum + ".pem"), tmpCert)
-    shutil.copyfile(tmpKey, cppServerKey)
-    shutil.copyfile(tmpCert, cppServerCert)
-    os.remove(req)
-else:
-    print("Skipping C++ server RSA certificate and key.")
 
-#
-# C++ client RSA certificate and key.
-#
-cppClientCert = os.path.join(certs, "c_rsa1024_pub.pem")
-cppClientKey = os.path.join(certs, "c_rsa1024_priv.pem")
-if force or not os.path.exists(cppClientCert) or not os.path.exists(cppClientKey) or \
-   (os.path.exists(cppClientCert) and newer(caCert, cppClientCert)):
-
-    print("Generating new C++ client RSA certificate and key...")
-
-    if os.path.exists(cppClientCert):
-        os.remove(cppClientCert)
-    if os.path.exists(cppClientKey):
-        os.remove(cppClientKey)
-
-    prepareCAHome(caHome, force)
-
-    serial = os.path.join(caHome, "serial")
-    f = open(serial, "r")
-    serialNum = f.read().strip()
-    f.close()
-
-    tmpKey = os.path.join(caHome, serialNum + "_key.pem")
-    tmpCert = os.path.join(caHome, serialNum + "_cert.pem")
-    req = os.path.join(caHome, "req.pem")
-    config = os.path.join(certs, "openssl", "client.cnf")
-    cmd = "openssl req -config " + config + " -newkey rsa:1024 -nodes -keyout " + tmpKey + " -keyform PEM" + \
-           " -out " + req
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
+    p = subprocess.Popen(cmd,
+                         shell = True,
+                         stdin = subprocess.PIPE,
+                         stdout = subprocess.STDOUT if debug else DEVNULL,
+                         stderr = subprocess.STDERR if debug else DEVNULL,
+                         bufsize = 0)
+    if p.wait() != 0:
+        print("command failed:" + cmd)
+        sys.exit(1)
+    
+def runOpenSSL(command):
+    run("openssl " + command)
 
-    cmd = "openssl ca -config " + config + " -batch -in " + req
+def jksToBks(source, target):
+    cmd = "keytool -importkeystore -srckeystore " + source + " -destkeystore " + target + \
+          " -srcstoretype JKS -deststoretype BKS -srcstorepass password -deststorepass password " + \
+          "-provider org.bouncycastle.jce.provider.BouncyCastleProvider -noprompt"
     if debug:
         print("[debug]", cmd)
-    os.system(cmd)
-    shutil.move(os.path.join(caHome, serialNum + ".pem"), tmpCert)
-    shutil.copyfile(tmpKey, cppClientKey)
-    shutil.copyfile(tmpCert, cppClientCert)
-    os.remove(req)
-else:
-    print("Skipping C++ client RSA certificate and key.")
-
-#
-# C++ DSA parameters.
-#
-dsaParams = os.path.join(certs, "dsaparam1024.pem")
-if (lang == "cpp" or lang == None) and (force or not os.path.exists(dsaParams)):
-
-    print("Generating new C++ DSA parameters...")
-
-    if os.path.exists(dsaParams):
-        os.remove(dsaParams)
 
-    prepareCAHome(caHome, force)
+    p = subprocess.Popen(cmd, shell = True, stdin = subprocess.PIPE, stdout = subprocess.PIPE,
+                        stderr = subprocess.STDOUT, bufsize = 0)
 
-    cmd = "openssl dsaparam -out " + dsaParams + " -outform PEM 1024"
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
-else:
-    print("Skipping C++ DSA parameters.")
+    while(True):
+        line = p.stdout.readline()            
+        if p.poll() is not None and not line:
+            # The process terminated
+            break
+            
+        if line.find("java.lang.ClassNotFoundException: org.bouncycastle.jce.provider.BouncyCastleProvider") != -1:
+            print("")
+            print("WARNING: BouncyCastleProvider not found cannot export certificates for android")
+            print("         demos in BKS format. You can download BKS provider from:")
+            print("")
+            print("            http://www.bouncycastle.org/")
+            print("")
+            print("         After download copy the JAR to $JAVA_HOME/lib/ext where JAVA_HOME")
+            print("         points to your JRE and run this script again.")
+            print("")
+            return False
+        elif line.find("java.security.InvalidKeyException: Illegal key size") != -1:
+            print("")
+            print("WARNING: You need to install Java Cryptography Extension (JCE) Unlimited")
+            print("         Strength. You can download it from Additional Resources section")
+            print("         in Orcale Java Download page at:")
+            print("")
+            print("             http://www.oracle.com/technetwork/java/javase/downloads/index.html")
+            print("")
+            return False
+        return True
+    if p.poll() != 0:
+        sys.exit(1)
 
-#
-# C++ server DSA certificate and key.
-#
-cppServerCertDSA = os.path.join(certs, "s_dsa1024_pub.pem")
-cppServerKeyDSA = os.path.join(certs, "s_dsa1024_priv.pem")
-if (lang == "cpp" or lang == None) and \
-   (force or not os.path.exists(cppServerCertDSA) or not os.path.exists(cppServerKeyDSA) or \
-   (os.path.exists(cppServerCertDSA) and newer(caCert, cppServerCertDSA)) or \
-   (os.path.exists(cppServerCertDSA) and newer(dsaParams, cppServerCertDSA))):
+def generateCert(desc, name, commonName = None):
 
-    print("Generating new C++ server DSA certificate and key...")
+    if not commonName:
+        commonName = desc
+    
+    generateConf("ice.cnf", ipAddress, ipAddress, commonName)
 
-    if os.path.exists(cppServerCertDSA):
-        os.remove(cppServerCertDSA)
-    if os.path.exists(cppServerKeyDSA):
-        os.remove(cppServerKeyDSA)
+    cert = os.path.join(certs, name + "_rsa1024_pub.pem")
+    key = os.path.join(certs, name + "_rsa1024_priv.pem")
+    sys.stdout.write("Generating new " + desc + " certificates... ")
+    sys.stdout.flush()
 
-    prepareCAHome(caHome, force)
+    if os.path.exists(cert):
+        os.remove(cert)
+    if os.path.exists(key):
+        os.remove(key)
 
     serial = os.path.join(caHome, "serial")
     f = open(serial, "r")
     serialNum = f.read().strip()
     f.close()
-
+    
     tmpKey = os.path.join(caHome, serialNum + "_key.pem")
     tmpCert = os.path.join(caHome, serialNum + "_cert.pem")
     req = os.path.join(caHome, "req.pem")
-    config = os.path.join(certs, "openssl", "server.cnf")
-    cmd = "openssl req -config " + config + " -newkey dsa:" + dsaParams + " -nodes -keyout " + tmpKey + \
-          " -keyform PEM -out " + req
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
-
-    cmd = "openssl ca -config " + config + " -batch -in " + req
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
-    shutil.move(os.path.join(caHome, serialNum + ".pem"), tmpCert)
-    shutil.copyfile(tmpKey, cppServerKeyDSA)
-    shutil.copyfile(tmpCert, cppServerCertDSA)
-    os.remove(req)
-else:
-    print("Skipping C++ server DSA certificate and key.")
-
-#
-# C++ client DSA certificate and key.
-#
-cppClientCertDSA = os.path.join(certs, "c_dsa1024_pub.pem")
-cppClientKeyDSA = os.path.join(certs, "c_dsa1024_priv.pem")
-if (lang == "cpp" or lang == None) and \
-   (force or not os.path.exists(cppClientCertDSA) or not os.path.exists(cppClientKeyDSA) or \
-   (os.path.exists(cppClientCertDSA) and newer(caCert, cppClientCertDSA)) or \
-   (os.path.exists(cppClientCertDSA) and newer(dsaParams, cppClientCertDSA))):
-
-    print("Generating new C++ client DSA certificate and key...")
+    config = os.path.join(caHome, "ice.cnf")
 
-    if os.path.exists(cppClientCertDSA):
-        os.remove(cppClientCertDSA)
-    if os.path.exists(cppClientKeyDSA):
-        os.remove(cppClientKeyDSA)
-
-    prepareCAHome(caHome, force)
-
-    serial = os.path.join(caHome, "serial")
-    f = open(serial, "r")
-    serialNum = f.read().strip()
-    f.close()
-
-    tmpKey = os.path.join(caHome, serialNum + "_key.pem")
-    tmpCert = os.path.join(caHome, serialNum + "_cert.pem")
-    req = os.path.join(caHome, "req.pem")
-    config = os.path.join(certs, "openssl", "client.cnf")
-    cmd = "openssl req -config " + config + " -newkey dsa:" + dsaParams + " -nodes -keyout " + tmpKey + \
-          " -keyform PEM -out " + req
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
+    #
+    # Generate PEM certificates
+    #
+    runOpenSSL("req -config " + config + " -newkey rsa:1024 -nodes -keyout " + tmpKey + " -keyform PEM -out " + req)
+    runOpenSSL("ca -config " + config + " -batch -in " + req)
 
-    cmd = "openssl ca -config " + config + " -batch -in " + req
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
     shutil.move(os.path.join(caHome, serialNum + ".pem"), tmpCert)
-    shutil.copyfile(tmpKey, cppClientKeyDSA)
-    shutil.copyfile(tmpCert, cppClientCertDSA)
+    shutil.copyfile(tmpKey, key)
+    shutil.copyfile(tmpCert, cert)
     os.remove(req)
-else:
-    print("Skipping C++ client DSA certificate and key.")
-
-#
-# .NET server RSA certificate and key.
-#
-csServer = os.path.join(certs, "s_rsa1024.pfx")
-if (lang == ".net" or lang == None) and (force or not os.path.exists(csServer) or newer(cppServerCert, csServer)):
-
-    print("Generating new .NET server RSA certificate and key...")
-
-    if os.path.exists(csServer):
-        os.remove(csServer)
-
-    cmd = "openssl pkcs12 -in " + cppServerCert + " -inkey " + cppServerKey + " -export -out " + csServer + \
-          " -certpbe PBE-SHA1-RC4-40 -keypbe PBE-SHA1-RC4-40 -passout pass:password"
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
-else:
-    print("Skipping .NET server certificate and key.")
-
-#
-# .NET client RSA certificate and key.
-#
-csClient = os.path.join(certs, "c_rsa1024.pfx")
-if (lang == ".net" or lang == None) and (force or not os.path.exists(csClient) or \
-   (os.path.exists(csClient) and newer(cppClientCert, csClient))):
-
-    print("Generating new .NET client RSA certificate and key...")
-
-    if os.path.exists(csClient):
-        os.remove(csClient)
-
-    cmd = "openssl pkcs12 -in " + cppClientCert + " -inkey " + cppClientKey + " -export -out " + csClient + \
-          " -certpbe PBE-SHA1-RC4-40 -keypbe PBE-SHA1-RC4-40 -passout pass:password"
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
-else:
-    print("Skipping .NET client certificate and key.")
-
-#
-# Java truststore.
-#
-truststore = "certs.jks"
-if (lang == "java" or lang == None) and (force or not os.path.exists(truststore) or \
-   (os.path.exists(truststore) and newer(caCert, truststore))):
-
-    print("Generating Java truststore...")
-
-    if os.path.exists(truststore):
-        os.remove(truststore)
-
-    cacert = os.path.join(certs, "cacert.der")
-
-    cmd = "keytool -import -alias cacert -file " + cacert + " -keystore " + truststore + \
-          " -storepass password -noprompt"
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
-else:
-    print("Skipping Java truststore.")
-
-#
-# Java server keystore.
-#
-serverKeystore = "server.jks"
-if (lang == "java" or lang == None) and (force or not os.path.exists(serverKeystore) or \
-   (os.path.exists(serverKeystore) and newer(cppServerCert, serverKeystore))):
-
-    print("Generating Java server keystore...")
-
-    if os.path.exists(serverKeystore):
-        os.remove(serverKeystore)
 
     #
-    # Convert OpenSSL key/certificate pairs into PKCS12 format and then
-    # import them into a Java keystore.
+    # Generate PKCS12 certificates
     #
-    tmpFile = os.path.join(certs, "server.p12")
-    cmd = "openssl pkcs12 -in " + cppServerCert + " -inkey " + cppServerKey + " -export -out " + tmpFile + \
-          " -name rsakey -passout pass:password -certfile " + caCert
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
-    cmd = "java -classpath . ImportKey " + tmpFile + " rsakey " + caCert + " " + serverKeystore + " password"
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
-    os.remove(tmpFile)
-else:
-    print("Skipping Java server keystore.")
-    
-    
-if not os.path.exists("server.bks") or newer(serverKeystore, "server.bks"):
-
-    if os.path.exists("server.bks"):
-        os.remove("server.bks")
+    runOpenSSL("pkcs12 -in " + cert + " -inkey " + key + " -export -out " + name + "_rsa1024.pfx" + \
+               " -certpbe PBE-SHA1-RC4-40 -keypbe PBE-SHA1-RC4-40" + \
+               " -passout pass:password -name " + desc)
 
-    print("Converting Java server truststore to BKS...")
-    
-    jksToBks("server.jks", "server.bks")
-    
     #
-    # Replace server.bks files in android demo and test directories
+    # Generate Java keystore
     #
-    for d in ['../java/test/android', '../java/demo/android']:
-        for root, dirnames, filenames in os.walk(d):
-            for f in filenames:
-                if f == "server.bks":
-                    shutil.copyfile("server.bks", os.path.join(root, f))
-
-#
-# Java client keystore.
-#
-clientKeystore = "client.jks"
-if (lang == "java" or lang == None) and (force or not os.path.exists(clientKeystore) or \
-   (os.path.exists(clientKeystore) and newer(cppClientCert, clientKeystore))):
-
-    print("Generating Java client keystore...")
-
-    if os.path.exists(clientKeystore):
-        os.remove(clientKeystore)
+    tmpFile = desc + ".p12"
+    runOpenSSL("pkcs12 -in " + cert + " -inkey " + key + " -export -out " + tmpFile + \
+               " -name rsakey -passout pass:password -certfile cacert.pem")
+    run("java -classpath . ImportKey " + tmpFile + " rsakey cacert.pem " + desc + ".jks password")
+    os.remove(tmpFile)
 
     #
-    # Convert OpenSSL key/certificate pairs into PKCS12 format and then
-    # import them into a Java keystore.
+    # Generate BKS for Android if supported
     #
-    tmpFile = os.path.join(certs, "client.p12")
-    cmd = "openssl pkcs12 -in " + cppClientCert + " -inkey " + cppClientKey + " -export -out " + tmpFile + \
-          " -name rsakey -passout pass:password -certfile " + caCert
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
-    cmd = "java -classpath . ImportKey " + tmpFile + " rsakey " + caCert + " " + clientKeystore + " password"
-    if debug:
-        print("[debug]", cmd)
-    os.system(cmd)
-    os.remove(tmpFile)
-else:
-    print("Skipping Java client keystore.")
+    if bksSupport:
+        jksToBks(desc + ".jks", desc + ".bks")
     
-if not os.path.exists("client.bks") or newer(clientKeystore, "client.bks"):
+    if not debug:
+        print("ok")
 
-    if os.path.exists("client.bks"):
-        os.remove("client.bks")
 
-    print("Converting Java client truststore to BKS...")
-    
-    jksToBks("client.jks", "client.bks")
-    
-    #
-    # Replace client.bks files in android demo and test directories
-    #
-    for d in ['../java/test/android', '../java/demo/android']:
-        for root, dirnames, filenames in os.walk(d):
-            for f in filenames:
-                if f == "client.bks":
-                    shutil.copyfile("client.bks", os.path.join(root, f))
 #
-# Done.
+# Generate the CA certificate and database
+#
+if os.path.exists(caHome):
+    shutil.rmtree(caHome)
+
+sys.stdout.write("Generating new CA certificate and key... ")
+sys.stdout.flush()
+os.mkdir(caHome)
+
+f = open(os.path.join(caHome, "serial"), "w")
+f.write("01")
+f.close()
+
+f = open(os.path.join(caHome, "index.txt"), "w")
+f.truncate(0)
+f.close()
+
+generateConf("ca.cnf")
+
+config = os.path.join(caHome, "ca.cnf")
+caCert = os.path.join(caHome, "cacert.pem")
+runOpenSSL("req -config " + config + " -x509 -days 1825 -newkey rsa:1024 -out " + caCert + " -outform PEM -nodes")
+runOpenSSL("x509 -in " + caCert + " -outform DER -out " + os.path.join(certs, "cacert.der")) # Convert to DER
+shutil.copyfile(caCert, os.path.join(certs, "cacert.pem"))
+if os.path.exists("certs.jks"):
+    os.remove("certs.jks")
+if javaSupport:
+    run("keytool -import -alias cacert -file cacert.der -keystore certs.jks -storepass password -noprompt")
+if not debug:
+    print("ok")
+
+#
+# Generate the client and the server certificates
 #
-print("Done.")
+generateCert("server", "s", ipAddress) # commonName = ipAddress
+generateCert("client", "c")
+
+os.chdir("..")
diff --git a/certs/makewinrtcerts.py b/certs/makewinrtcerts.py
deleted file mode 100755
index 60a42ae36f0..00000000000
--- a/certs/makewinrtcerts.py
+++ /dev/null
@@ -1,270 +0,0 @@
-#!/usr/bin/env python
-# **********************************************************************
-#
-# Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
-#
-# This copy of Ice is licensed to you under the terms described in the
-# ICE_LICENSE file included in this distribution.
-#
-# **********************************************************************
-
-import os, sys, shutil, glob, socket
-
-def usage():
-    print("usage: " + sys.argv[0] + " [ip address]")
-    sys.exit(1)
-
-debug = True
-ipAddress = None
-if len(sys.argv) == 2:
-    ipAddress = sys.argv[1]
-
-if not ipAddress:
-    try:
-        ipAddress = socket.gethostbyname(socket.gethostname())
-    except:
-        ipAddress = "127.0.0.1"
-
-cwd = os.getcwd()
-if not os.path.exists("makewinrtcerts.py") or os.path.basename(cwd) != "certs":
-    print("You must run this script from the certs demo directory")
-    sys.exit(1)
-
-if os.path.exists("winrt"):
-    shutil.rmtree("winrt")
-os.mkdir("winrt")
-
-os.environ["ICE_CA_HOME"] = os.path.abspath("winrt")
-
-os.chdir("winrt")
-
-while True:
-    print("The IP address used for the server certificate will be: " + ipAddress)
-
-    sys.stdout.write("Do you want to keep this IP address? (y/n) [y]")
-    sys.stdout.flush()
-    input = sys.stdin.readline().strip()
-    if input == 'n':
-        sys.stdout.write("IP : ")
-        sys.stdout.flush()
-        ipAddress = sys.stdin.readline().strip()
-    else:
-        break
-
-certs = "."
-caHome = os.path.join(certs, "ca")
-
-caKey = os.path.join(certs, "cakey.pem")
-caCert = os.path.join(certs, "cacert.pem")
-
-print("Generating new CA certificate and key...")
-os.mkdir(caHome)
-
-f = open(os.path.join(caHome, "serial"), "w")
-f.write("01")
-f.close()
-
-f = open(os.path.join(caHome, "index.txt"), "w")
-f.truncate(0)
-f.close()
-
-#
-# Static configuration file data.
-#
-config = {\
-"ca.cnf":"\
-# **********************************************************************\n\
-#\n\
-# Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.\n\
-#\n\
-# This copy of Ice is licensed to you under the terms described in the\n\
-# ICE_LICENSE file included in this distribution.\n\
-#\n\
-# **********************************************************************\n\
-\n\
-# Configuration file for the CA. This file is generated by iceca init.\n\
-# DO NOT EDIT!\n\
-\n\
-###############################################################################\n\
-###  Self Signed Root Certificate\n\
-###############################################################################\n\
-\n\
-[ ca ]\n\
-default_ca = ice\n\
-\n\
-[ ice ]\n\
-default_days     = 1825    # How long certs are valid.\n\
-default_md       = md5     # The Message Digest type.\n\
-preserve         = no      # Keep passed DN ordering?\n\
-\n\
-[ req ]\n\
-default_bits        = 2048\n\
-default_keyfile     = $ENV::ICE_CA_HOME/ca/cakey.pem\n\
-default_md          = md5\n\
-prompt              = no\n\
-distinguished_name  = dn\n\
-x509_extensions     = extensions\n\
-\n\
-[ extensions ]\n\
-basicConstraints = CA:true\n\
-\n\
-# PKIX recommendation.\n\
-subjectKeyIdentifier = hash\n\
-authorityKeyIdentifier = keyid:always,issuer:always\n\
-\n\
-[dn]\n\
-countryName            = US\n\
-stateOrProvinceName    = Florida\n\
-localityName           = Palm Beach Gardens\n\
-organizationName       = ZeroC, Inc.\n\
-organizationalUnitName = Ice\n\
-commonName             = ZeroC WinRT Test CA\n\
-emailAddress           = info@zeroc.com\n\
-",\
-"server.cnf":"\
-# **********************************************************************\n\
-#\n\
-# Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.\n\
-#\n\
-# This copy of Ice is licensed to you under the terms described in the\n\
-# ICE_LICENSE file included in this distribution.\n\
-#\n\
-# **********************************************************************\n\
-\n\
-# Configuration file to sign a certificate. This file is generated by iceca init.\n\
-# DO NOT EDIT!!\n\
-\n\
-[ ca ]\n\
-default_ca = ice\n\
-\n\
-[ ice ]\n\
-dir              = $ENV::ICE_CA_HOME/ca # Where everything is kept.\n\
-private_key      = $dir/cakey.pem   # The CA Private Key.\n\
-certificate      = $dir/cacert.pem  # The CA Certificate.\n\
-database         = $dir/index.txt           # Database index file.\n\
-new_certs_dir    = $dir                     # Default loc for new certs.\n\
-serial           = $dir/serial              # The current serial number.\n\
-certs            = $dir                     # Where issued certs are kept.\n\
-RANDFILE         = $dir/.rand               # Private random number file.\n\
-default_days     = 1825                     # How long certs are valid.\n\
-default_md       = md5                      # The Message Digest type.\n\
-preserve         = yes                      # Keep passed DN ordering?\n\
-\n\
-policy           = ca_policy\n\
-x509_extensions  = certificate_extensions\n\
-\n\
-[ certificate_extensions ]\n\
-basicConstraints = CA:false\n\
-\n\
-# PKIX recommendation.\n\
-subjectKeyIdentifier = hash\n\
-authorityKeyIdentifier = keyid:always,issuer:always\n\
-subjectAltName         = DNS:%s, IP:%s\n\
-\n\
-[ ca_policy ]\n\
-countryName            = match\n\
-stateOrProvinceName    = match\n\
-organizationName       = match\n\
-organizationalUnitName = optional\n\
-emailAddress           = optional\n\
-commonName             = supplied\n\
-\n\
-[ req ]\n\
-default_bits        = 1024\n\
-default_md          = md5\n\
-prompt              = no\n\
-distinguished_name  = dn\n\
-x509_extensions     = extensions\n\
-\n\
-[ extensions ]\n\
-basicConstraints = CA:false\n\
-\n\
-# PKIX recommendation.\n\
-subjectKeyIdentifier = hash\n\
-authorityKeyIdentifier = keyid:always,issuer:always\n\
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment\n\
-\n\
-[dn]\n\
-countryName            = US\n\
-stateOrProvinceName    = Florida\n\
-localityName           = Palm Beach Gardens\n\
-organizationName       = ZeroC, Inc.\n\
-organizationalUnitName = Ice\n\
-commonName             = %s\n\
-emailAddress           = info@zeroc.com\n\
-" % (ipAddress, ipAddress, ipAddress) }
-
-sys.stdout.write("Generating configuration files... ")
-
-for file in ["ca.cnf", "server.cnf"]:
-    sys.stdout.write(" " + file)
-    sys.stdout.flush()
-    cnf = open(os.path.join(caHome, file), "w")
-    cnf.write(config[file])
-    cnf.close()
-    print("")
-
-config = os.path.join(caHome, "ca.cnf")
-cmd = "openssl req -config " + config + " -x509 -days 1825 -newkey rsa:1024 -out " + \
-    os.path.join(caHome, "cacert.pem") + " -outform PEM -nodes"
-if debug:
-    print("[debug]", cmd)
-os.system(cmd)
-shutil.copyfile(os.path.join(caHome, "cakey.pem"), caKey)
-shutil.copyfile(os.path.join(caHome, "cacert.pem"), caCert)
-
-cmd = "openssl x509 -in " + caCert + " -outform DER -out " + os.path.join(certs, "cacert.der")
-os.system(cmd)
-
-#
-# C++ server RSA certificate and key.
-#
-cppServerCert = os.path.join(certs, "s_rsa1024_pub.pem")
-cppServerKey = os.path.join(certs, "s_rsa1024_priv.pem")
-print("Generating new C++ server RSA certificate and key...")
-
-if os.path.exists(cppServerCert):
-    os.remove(cppServerCert)
-if os.path.exists(cppServerKey):
-    os.remove(cppServerKey)
-    
-serial = os.path.join(caHome, "serial")
-f = open(serial, "r")
-serialNum = f.read().strip()
-f.close()
-
-tmpKey = os.path.join(caHome, serialNum + "_key.pem")
-tmpCert = os.path.join(caHome, serialNum + "_cert.pem")
-req = os.path.join(caHome, "req.pem")
-config = os.path.join(caHome, "server.cnf")
-cmd = "openssl req -config " + config + " -newkey rsa:1024 -nodes -keyout " + tmpKey + " -keyform PEM" + \
-    " -out " + req
-if debug:
-    print("[debug]", cmd)
-os.system(cmd)
-
-cmd = "openssl ca -config " + config + " -batch -in " + req
-if debug:
-    print("[debug]", cmd)
-os.system(cmd)
-shutil.move(os.path.join(caHome, serialNum + ".pem"), tmpCert)
-shutil.copyfile(tmpKey, cppServerKey)
-shutil.copyfile(tmpCert, cppServerCert)
-os.remove(req)
-
-#
-# .NET server RSA certificate and key.
-#
-csServer = os.path.join(certs, "s_rsa1024.pfx")
-print("Generating new .NET server RSA certificate and key...")
-cmd = "openssl pkcs12 -in " + cppServerCert + " -inkey " + cppServerKey + " -export -out " + csServer + \
-    " -certpbe PBE-SHA1-RC4-40 -keypbe PBE-SHA1-RC4-40 -passout pass:password"
-if debug:
-    print("[debug]", cmd)
-os.system(cmd)
-
-#
-# Done.
-#
-print("Done.")
-os.chdir("..")
diff --git a/certs/openssl/client.cnf b/certs/openssl/client.cnf
deleted file mode 100644
index aa1e347f05c..00000000000
--- a/certs/openssl/client.cnf
+++ /dev/null
@@ -1,85 +0,0 @@
-# **********************************************************************
-#
-# Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
-#
-# This copy of Ice is licensed to you under the terms described in the
-# ICE_LICENSE file included in this distribution.
-#
-# **********************************************************************
-
-#
-# ZeroC base OpenSSL configuration file.
-#
-
-###############################################################################
-###  CA Configuration
-###############################################################################
-
-[ ca ]
-default_ca = ice
-
-
-[ ice ]
-dir              = openssl/ca  # Where everything is kept.
-private_key      = cakey.pem   # The CA Private Key.
-certificate      = cacert.pem  # The CA Certificate.
-database         = $dir/index.txt           # Database index file.
-new_certs_dir    = $dir                     # Default loc for new certs.
-serial           = $dir/serial              # The current serial number.
-
-certs            = $dir                     # Where issued certs are kept.
-RANDFILE         = $dir/.rand               # Private random number file.
-
-default_days     = 1825                     # How long certs are valid.
-default_md       = sha256                   # The Message Digest type.
-preserve         = yes                      # Keep passed DN ordering?
-
-policy           = ca_policy
-x509_extensions  = certificate_extensions
-
-
-[ ca_policy ]
-countryName            = match
-stateOrProvinceName    = match
-organizationName       = match
-organizationalUnitName = optional
-emailAddress           = optional
-commonName             = supplied
-
-
-[ certificate_extensions ]
-basicConstraints = CA:false
-
-# PKIX recommendation.
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always,issuer:always
-
-subjectAltName = DNS:client, IP:127.0.0.1
-
-[ req ]
-default_bits        = 1024
-default_keyfile     = c_rsa1024_priv.pem
-default_md          = sha256
-prompt              = no
-distinguished_name  = root_ca_distinguished_name
-x509_extensions     = root_ca_extensions
-
-
-[ root_ca_distinguished_name ]
-countryName            = US
-stateOrProvinceName    = Florida
-localityName           = Palm Beach Gardens
-organizationName       = ZeroC, Inc.
-organizationalUnitName = Ice
-commonName             = Client
-emailAddress           = info@zeroc.com
-
-
-[ root_ca_extensions ]
-basicConstraints = CA:false
-
-# PKIX recommendation.
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always,issuer:always
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-
diff --git a/certs/openssl/ice_ca.cnf b/certs/openssl/ice_ca.cnf
deleted file mode 100644
index 7dc4796c971..00000000000
--- a/certs/openssl/ice_ca.cnf
+++ /dev/null
@@ -1,52 +0,0 @@
-# **********************************************************************
-#
-# Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
-#
-# This copy of Ice is licensed to you under the terms described in the
-# ICE_LICENSE file included in this distribution.
-#
-# **********************************************************************
-
-#
-# ZeroC base OpenSSL configuration file.
-#
-
-###############################################################################
-###  Self Signed Root Certificate
-###############################################################################
-
-[ ca ]
-default_ca = ice
-
-
-[ ice ]
-default_days     = 1825    # How long certs are valid.
-default_md       = sha256  # The Message Digest type.
-preserve         = no      # Keep passed DN ordering?
-
-
-[ req ]
-default_bits        = 2048
-default_keyfile     = openssl/ca/cakey.pem
-default_md          = sha256
-prompt              = no
-distinguished_name  = root_ca_distinguished_name
-x509_extensions     = root_ca_extensions
-
-
-[ root_ca_distinguished_name ]
-countryName            = US
-stateOrProvinceName    = Florida
-localityName           = Palm Beach Gardens
-organizationName       = ZeroC, Inc.
-organizationalUnitName = Ice
-commonName             = ZeroC Test CA
-emailAddress           = info@zeroc.com
-
-
-[ root_ca_extensions ]
-basicConstraints = CA:true
-
-# PKIX recommendation.
-subjectKeyIdentifier   = hash
-authorityKeyIdentifier = keyid:always,issuer:always
diff --git a/certs/openssl/server.cnf b/certs/openssl/server.cnf
deleted file mode 100644
index 437e6df0994..00000000000
--- a/certs/openssl/server.cnf
+++ /dev/null
@@ -1,85 +0,0 @@
-# **********************************************************************
-#
-# Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
-#
-# This copy of Ice is licensed to you under the terms described in the
-# ICE_LICENSE file included in this distribution.
-#
-# **********************************************************************
-
-#
-# ZeroC base OpenSSL configuration file.
-#
-
-###############################################################################
-###  CA Configuration
-###############################################################################
-
-[ ca ]
-default_ca = ice
-
-
-[ ice ]
-dir              = openssl/ca  # Where everything is kept.
-private_key      = cakey.pem   # The CA Private Key.
-certificate      = cacert.pem  # The CA Certificate.
-database         = $dir/index.txt           # Database index file.
-new_certs_dir    = $dir                     # Default loc for new certs.
-serial           = $dir/serial              # The current serial number.
-
-certs            = $dir                     # Where issued certs are kept.
-RANDFILE         = $dir/.rand               # Private random number file.
-
-default_days     = 1825                     # How long certs are valid.
-default_md       = sha256                   # The Message Digest type.
-preserve         = yes                      # Keep passed DN ordering?
-
-policy           = ca_policy
-x509_extensions  = certificate_extensions
-
-
-[ ca_policy ]
-countryName            = match
-stateOrProvinceName    = match
-organizationName       = match
-organizationalUnitName = optional
-emailAddress           = optional
-commonName             = supplied
-
-
-[ certificate_extensions ]
-basicConstraints = CA:false
-
-# PKIX recommendation.
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always,issuer:always
-
-subjectAltName = DNS:127.0.0.1, IP:127.0.0.1
-
-[ req ]
-default_bits        = 1024
-default_keyfile     = s_rsa1024_priv.pem
-default_md          = sha256
-prompt              = no
-distinguished_name  = root_ca_distinguished_name
-x509_extensions     = root_ca_extensions
-
-
-[ root_ca_distinguished_name ]
-countryName            = US
-stateOrProvinceName    = Florida
-localityName           = Palm Beach Gardens
-organizationName       = ZeroC, Inc.
-organizationalUnitName = Ice
-commonName             = 127.0.0.1
-emailAddress           = info@zeroc.com
-
-
-[ root_ca_extensions ]
-basicConstraints = CA:false
-
-# PKIX recommendation.
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always,issuer:always
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-
diff --git a/certs/winrt/cacert.pem b/certs/winrt/cacert.pem
deleted file mode 100644
index 1252d51ea11..00000000000
--- a/certs/winrt/cacert.pem
+++ /dev/null
@@ -1,23 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDwjCCAyugAwIBAgIJAONZLMYck98dMA0GCSqGSIb3DQEBBAUAMIGdMQswCQYD
-VQQGEwJVUzEQMA4GA1UECBMHRmxvcmlkYTEbMBkGA1UEBxMSUGFsbSBCZWFjaCBH
-YXJkZW5zMRQwEgYDVQQKEwtaZXJvQywgSW5jLjEMMAoGA1UECxMDSWNlMRwwGgYD
-VQQDExNaZXJvQyBXaW5SVCBUZXN0IENBMR0wGwYJKoZIhvcNAQkBFg5pbmZvQHpl
-cm9jLmNvbTAeFw0xMzA5MDQxMzM5MDBaFw0xODA5MDMxMzM5MDBaMIGdMQswCQYD
-VQQGEwJVUzEQMA4GA1UECBMHRmxvcmlkYTEbMBkGA1UEBxMSUGFsbSBCZWFjaCBH
-YXJkZW5zMRQwEgYDVQQKEwtaZXJvQywgSW5jLjEMMAoGA1UECxMDSWNlMRwwGgYD
-VQQDExNaZXJvQyBXaW5SVCBUZXN0IENBMR0wGwYJKoZIhvcNAQkBFg5pbmZvQHpl
-cm9jLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEArWzIwh+NEU9JR6A8
-Xan0wsi2DDw8/stWd4c2cXhlSfeKCLk6w2d5ogeuN0xkHG/dJ0uKZ58jDOBJJ1NV
-rJqAbuWTUeWIipSZeMCnwNf57EW2cqnDkjuwrMqzW8dE9AILvoCi93mBRu5Il+Zo
-mX0b4RbiaW96Qvvk2KxUiXFEExECAwEAAaOCAQYwggECMAwGA1UdEwQFMAMBAf8w
-HQYDVR0OBBYEFJxhu+8SY+hWHjo2s973hxPiQSVgMIHSBgNVHSMEgcowgceAFJxh
-u+8SY+hWHjo2s973hxPiQSVgoYGjpIGgMIGdMQswCQYDVQQGEwJVUzEQMA4GA1UE
-CBMHRmxvcmlkYTEbMBkGA1UEBxMSUGFsbSBCZWFjaCBHYXJkZW5zMRQwEgYDVQQK
-EwtaZXJvQywgSW5jLjEMMAoGA1UECxMDSWNlMRwwGgYDVQQDExNaZXJvQyBXaW5S
-VCBUZXN0IENBMR0wGwYJKoZIhvcNAQkBFg5pbmZvQHplcm9jLmNvbYIJAONZLMYc
-k98dMA0GCSqGSIb3DQEBBAUAA4GBADlxtF4h7tHG7KTUPawW56GCLYc5r9wbOkkC
-dhFg0w6ce3E5RqvqcG6GspuD6SwUeOYaIfB0wWYg27FCVzFTKmh0PbaDoSuC7ei2
-oFvnJHOm4mRAVCJbJgp9tLN0Ihep4cjrEGYZs+gIfPJHVomnimy6tg3HG2C4FwBb
-9stlzFpL
------END CERTIFICATE-----
diff --git a/certs/winrt/s_rsa1024.pfx b/certs/winrt/s_rsa1024.pfx
deleted file mode 100644
index d93248333bf..00000000000
--- a/certs/winrt/s_rsa1024.pfx
+++ /dev/null
diff --git a/certs/winrt/s_rsa1024_priv.pem b/certs/winrt/s_rsa1024_priv.pem
deleted file mode 100644
index c1dbfcde9da..00000000000
--- a/certs/winrt/s_rsa1024_priv.pem
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBANgBvvdFamykcY1e
-sFJviFB0qkIcbknR8b/4dtOCYL2ZRLG2wqiJOpbjiX7ghqs04b7Y6i4DLefoOCBV
-x5IY7fV7Hy1cmwzaElWQWiIpSyVqgTrlOoKGvlCyNGBfZXT+ehRaVeXw24bdiSg0
-JV2mDYf8n6kigEfWe9Mh+DHyjEtBAgMBAAECgYBKio+0FShcxYLKHlsKl6Ka4SfA
-GL+WifS7Iqse4mcwBqxGB6O1NWYam/re5eyTOHSOv5xQtJgq52A3CGMOb7vt0HU/
-f0IGVJ1l4xF4LCfFeAejkx7KQnEG8F/IeEGmv5tc3n5Qe5zMdilp+yXVldEFGadK
-WJuTmmoHYpk0LL9jYQJBAO7cFnuHnKBMmwyU5MYrgIyFU5/tG9AoXe+0Q4yggdZe
-rEDkLvGVQpyTJyu1fwndVGgY4tdRR2hedK7QjtHCJVcCQQDngdhBI1AYCyf9qk7k
-KmbWxbXjBeRj3xn0UgKnAdB1sGj74xoK/KTu8RzIJRADEzDVUHyVMNsNsze69WST
-2F0nAkBMMBdbv53N46FxGez+6NFQARbzZAYDF10fIDiLmobPgdMfv6jZlepxVt6f
-qnyjAN3zdjykwWAtgjNlr1Bex7ZxAkBd/7jA6gexW4ZHVwllV1oeRnTN0yyi6Ilv
-TIVLLk9oGdLmw5VldKO7aScYlQPlW7tuQZn0Mbwf2e78+Hp4FVftAkEApjY+1c48
-DI5+oR88qsfRTVc2Dvttt2oHFeWKvHGv8H3faIQQGrpAnCKUZFPlO1XAX427Zxq5
-7vKz29tZqUe+Kg==
------END PRIVATE KEY-----
diff --git a/certs/winrt/s_rsa1024_pub.pem b/certs/winrt/s_rsa1024_pub.pem
deleted file mode 100644
index 2b6c2a7d26f..00000000000
--- a/certs/winrt/s_rsa1024_pub.pem
+++ /dev/null
@@ -1,67 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 1 (0x1)
-    Signature Algorithm: md5WithRSAEncryption
-        Issuer: C=US, ST=Florida, L=Palm Beach Gardens, O=ZeroC, Inc., OU=Ice, CN=ZeroC WinRT Test CA/emailAddress=info@zeroc.com
-        Validity
-            Not Before: Sep  4 13:39:00 2013 GMT
-            Not After : Sep  3 13:39:00 2018 GMT
-        Subject: C=US, ST=Florida, O=ZeroC, Inc., OU=Ice/emailAddress=info@zeroc.com, CN=127.0.0.1
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (1024 bit)
-                Modulus:
-                    00:d8:01:be:f7:45:6a:6c:a4:71:8d:5e:b0:52:6f:
-                    88:50:74:aa:42:1c:6e:49:d1:f1:bf:f8:76:d3:82:
-                    60:bd:99:44:b1:b6:c2:a8:89:3a:96:e3:89:7e:e0:
-                    86:ab:34:e1:be:d8:ea:2e:03:2d:e7:e8:38:20:55:
-                    c7:92:18:ed:f5:7b:1f:2d:5c:9b:0c:da:12:55:90:
-                    5a:22:29:4b:25:6a:81:3a:e5:3a:82:86:be:50:b2:
-                    34:60:5f:65:74:fe:7a:14:5a:55:e5:f0:db:86:dd:
-                    89:28:34:25:5d:a6:0d:87:fc:9f:a9:22:80:47:d6:
-                    7b:d3:21:f8:31:f2:8c:4b:41
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            X509v3 Subject Key Identifier: 
-                F0:C8:1C:CE:A3:21:3D:4C:E8:B5:8F:5E:C9:B4:9B:00:3C:C9:5F:4C
-            X509v3 Authority Key Identifier: 
-                keyid:9C:61:BB:EF:12:63:E8:56:1E:3A:36:B3:DE:F7:87:13:E2:41:25:60
-                DirName:/C=US/ST=Florida/L=Palm Beach Gardens/O=ZeroC, Inc./OU=Ice/CN=ZeroC WinRT Test CA/emailAddress=info@zeroc.com
-                serial:E3:59:2C:C6:1C:93:DF:1D
-
-            X509v3 Subject Alternative Name: 
-                DNS:127.0.0.1, IP Address:127.0.0.1
-    Signature Algorithm: md5WithRSAEncryption
-         87:6b:25:11:83:d4:4d:b3:7e:d1:e2:ef:4c:38:15:24:33:47:
-         12:8a:d9:a6:ec:a8:3c:60:31:6b:b8:ad:5b:38:68:ba:c9:dd:
-         8a:04:50:50:8f:00:6e:17:bb:31:dd:1e:fb:42:28:3d:9b:ef:
-         1e:2c:8d:a4:80:f0:88:90:96:40:be:89:80:a1:1b:ac:c3:15:
-         be:b0:1d:c0:88:6d:99:25:cc:c4:de:0e:33:f6:ae:95:1b:ea:
-         bf:93:c3:ef:72:1a:0b:4f:cf:50:02:17:b7:58:46:4d:e7:f9:
-         04:41:5d:57:4f:fc:cc:af:6c:29:d3:1b:4e:61:93:2d:36:48:
-         e4:6b
------BEGIN CERTIFICATE-----
-MIIDqzCCAxSgAwIBAgIBATANBgkqhkiG9w0BAQQFADCBnTELMAkGA1UEBhMCVVMx
-EDAOBgNVBAgTB0Zsb3JpZGExGzAZBgNVBAcTElBhbG0gQmVhY2ggR2FyZGVuczEU
-MBIGA1UEChMLWmVyb0MsIEluYy4xDDAKBgNVBAsTA0ljZTEcMBoGA1UEAxMTWmVy
-b0MgV2luUlQgVGVzdCBDQTEdMBsGCSqGSIb3DQEJARYOaW5mb0B6ZXJvYy5jb20w
-HhcNMTMwOTA0MTMzOTAwWhcNMTgwOTAzMTMzOTAwWjB2MQswCQYDVQQGEwJVUzEQ
-MA4GA1UECBMHRmxvcmlkYTEUMBIGA1UEChMLWmVyb0MsIEluYy4xDDAKBgNVBAsT
-A0ljZTEdMBsGCSqGSIb3DQEJARYOaW5mb0B6ZXJvYy5jb20xEjAQBgNVBAMTCTEy
-Ny4wLjAuMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2AG+90VqbKRxjV6w
-Um+IUHSqQhxuSdHxv/h204JgvZlEsbbCqIk6luOJfuCGqzThvtjqLgMt5+g4IFXH
-khjt9XsfLVybDNoSVZBaIilLJWqBOuU6goa+ULI0YF9ldP56FFpV5fDbht2JKDQl
-XaYNh/yfqSKAR9Z70yH4MfKMS0ECAwEAAaOCAR8wggEbMAkGA1UdEwQCMAAwHQYD
-VR0OBBYEFPDIHM6jIT1M6LWPXsm0mwA8yV9MMIHSBgNVHSMEgcowgceAFJxhu+8S
-Y+hWHjo2s973hxPiQSVgoYGjpIGgMIGdMQswCQYDVQQGEwJVUzEQMA4GA1UECBMH
-RmxvcmlkYTEbMBkGA1UEBxMSUGFsbSBCZWFjaCBHYXJkZW5zMRQwEgYDVQQKEwta
-ZXJvQywgSW5jLjEMMAoGA1UECxMDSWNlMRwwGgYDVQQDExNaZXJvQyBXaW5SVCBU
-ZXN0IENBMR0wGwYJKoZIhvcNAQkBFg5pbmZvQHplcm9jLmNvbYIJAONZLMYck98d
-MBoGA1UdEQQTMBGCCTEyNy4wLjAuMYcEfwAAATANBgkqhkiG9w0BAQQFAAOBgQCH
-ayURg9RNs37R4u9MOBUkM0cSitmm7Kg8YDFruK1bOGi6yd2KBFBQjwBuF7sx3R77
-Qig9m+8eLI2kgPCIkJZAvomAoRuswxW+sB3AiG2ZJczE3g4z9q6VG+q/k8PvchoL
-T89QAhe3WEZN5/kEQV1XT/zMr2wp0xtOYZMtNkjkaw==
------END CERTIFICATE-----
diff --git a/cpp/demo/Glacier2/chat/config.glacier2 b/cpp/demo/Glacier2/chat/config.glacier2
index df8cf551dd5..e1bc1dd5f24 100644
--- a/cpp/demo/Glacier2/chat/config.glacier2
+++ b/cpp/demo/Glacier2/chat/config.glacier2
@@ -6,13 +6,26 @@ Glacier2.InstanceName=DemoGlacier2
 #
 # The client-visible endpoint of Glacier2. This should be an endpoint
 # visible from the public Internet, and it should be secure.
+#  
+# When no -h <host> option is specified in the endpoints, the default
+# value from the Ice.Default.Host property is used. If this property
+# isn't set, the endpoints will listen on all available network
+# interfaces.
 # 
-Glacier2.Client.Endpoints=tcp -p 4063 -h 127.0.0.1:ssl -p 4064 -h 127.0.0.1:ws -p 5063 -h 127.0.0.1:wss -p 5064 -h 127.0.0.1
+Glacier2.Client.Endpoints=tcp -p 4063:ssl -p 4064:ws -p 5063:wss -p 5064
 
 #
-# We need to disable VerifyPeer for secure WebSocket (WSS) and Windows Store App clients.
+# Only listen on the localhost interface by default. You can comment
+# out this property to allow listening on all available interfaces.
 #
-IceSSL.VerifyPeer=0
+Ice.Default.Host=127.0.0.1
+
+#
+# For secure WebSocket (WSS) clients and Windows Store App clients,
+# you should disable this property. JavaScript browser clients and
+# Windows Store App clients don't use client-side authentication.
+#
+#IceSSL.VerifyPeer=0
 
 #
 # The server-visible endpoint of Glacier2. This endpoint is only
@@ -66,13 +79,6 @@ IceSSL.Keychain=glacier2.keychain
 IceSSL.KeychainPassword=password
 
 #
-# Uncomment the properties below if you want run the demo with the
-# Windows Store App chat client. 
-#
-#Glacier2.Client.Endpoints=ssl -p 4064
-#IceSSL.DefaultDir=../../../../certs/winrt
-
-#
 # IceMX configuration.
 #
 #Ice.Admin.Endpoints=tcp -h localhost -p 10004
diff --git a/cpp/demo/Glacier2/winrt/chat/Package.appxmanifest b/cpp/demo/Glacier2/winrt/chat/Package.appxmanifest
index 7ad321278b9..8f5d7754192 100644
--- a/cpp/demo/Glacier2/winrt/chat/Package.appxmanifest
+++ b/cpp/demo/Glacier2/winrt/chat/Package.appxmanifest
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Package xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:m2="http://schemas.microsoft.com/appx/2013/manifest">
   <Identity Name="46e81031-9c5b-4caa-92cb-57fbccb3dc93" Publisher="CN=ZeroC Glacier2 Chat App" Version="1.1.0.0" />
   <Properties>
@@ -32,10 +32,10 @@
   <Extensions>
     <Extension Category="windows.certificates">
       <Certificates>
-        <Certificate StoreName="Root" Content="cacert.pem" />
-        <Certificate StoreName="CA" Content="cacert.pem" />
+        <Certificate StoreName="Root" Content="cacert.der" />
+        <Certificate StoreName="CA" Content="cacert.der" />
         <TrustFlags ExclusiveTrust="true" />
       </Certificates>
     </Extension>
   </Extensions>
-</Package>
\ No newline at end of file
+</Package>
diff --git a/cpp/demo/Glacier2/winrt/chat/README.txt b/cpp/demo/Glacier2/winrt/chat/README.txt
index 23ff2b90267..68e4a4959e3 100644
--- a/cpp/demo/Glacier2/winrt/chat/README.txt
+++ b/cpp/demo/Glacier2/winrt/chat/README.txt
@@ -9,11 +9,11 @@ uncomment the IceSSL.VerifyPeer=0 property. If you run the client from
 a remote device such as the Surface, you will also need to regenerate
 the server certificate to ensure the certificate common name is set to
 the IP address of the server. To regenerate the certificate, you can
-run the makewinrtcerts.py Python script from the certs directory at
-the top of this distribution. For example:
+run the makecerts.py Python script from the certs directory at the top
+of this distribution. For example:
 
   > cd certs
-  > makewinrtcerts.py 192.168.1.53
+  > makecerts.py 192.168.1.53
 
 This will regenerate a server certificate with a common name set to
 192.168.1.53. This can either be set to an IP address or DNS name, the
diff --git a/cpp/demo/Glacier2/winrt/chat/chat.vcxproj b/cpp/demo/Glacier2/winrt/chat/chat.vcxproj
index 17c0770cf08..19d6b5c1d53 100644
--- a/cpp/demo/Glacier2/winrt/chat/chat.vcxproj
+++ b/cpp/demo/Glacier2/winrt/chat/chat.vcxproj
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|ARM">
@@ -193,7 +193,7 @@
     <AppxManifest Include="Package.appxmanifest">
       <SubType>Designer</SubType>
     </AppxManifest>
-    <None Include="..\..\..\..\..\certs\winrt\cacert.pem">
+    <None Include="..\..\..\..\..\certs\cacert.der">
       <DeploymentContent>true</DeploymentContent>
     </None>
     <None Include="Chat.ice" />
@@ -242,4 +242,4 @@
       <UserProperties ZerocIce_ProjectVersion="3.6" ZerocIce_Enabled="True" />
     </VisualStudio>
   </ProjectExtensions>
-</Project>
\ No newline at end of file
+</Project>
diff --git a/cpp/demo/Glacier2/winrt/chat/chat.vcxproj.filters b/cpp/demo/Glacier2/winrt/chat/chat.vcxproj.filters
index 8e44081f10a..df920f4c9fc 100644
--- a/cpp/demo/Glacier2/winrt/chat/chat.vcxproj.filters
+++ b/cpp/demo/Glacier2/winrt/chat/chat.vcxproj.filters
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup>
     <Filter Include="Common">
@@ -44,7 +44,7 @@
   </ItemGroup>
   <ItemGroup>
     <None Include="Chat.ice" />
-    <None Include="..\..\..\..\..\certs\winrt\cacert.pem" />
+    <None Include="..\..\..\..\..\certs\cacert.der" />
     <None Include="chat_TemporaryKey.pfx" />
   </ItemGroup>
   <ItemGroup>
@@ -58,4 +58,4 @@
   <ItemGroup>
     <AppxManifest Include="Package.appxmanifest" />
   </ItemGroup>
-</Project>
\ No newline at end of file
+</Project>
diff --git a/cpp/demo/Ice/hello/config.server b/cpp/demo/Ice/hello/config.server
index 9381d16a1f2..bb96a7a798b 100644
--- a/cpp/demo/Ice/hello/config.server
+++ b/cpp/demo/Ice/hello/config.server
@@ -3,17 +3,25 @@
 # "Hello". The following line sets the endpoints for this
 # adapter.
 #
+# When no -h <host> option is specified in the endpoints, the default
+# value from the Ice.Default.Host property is used. If this property
+# isn't set, the endpoints will listen on all available network
+# interfaces.
+# 
 Hello.Endpoints=tcp -p 10000:udp -p 10000:ssl -p 10001:ws -p 10002:wss -p 10003
 
 #
-# Only listen on the localhost interface by default.
+# Only listen on the localhost interface by default. You can comment
+# out this property to allow listening on all available interfaces.
 #
 Ice.Default.Host=localhost
 
 #
-# We need to disable VerifyPeer for secure WebSocket (WSS) and Windows Store App clients.
+# For secure WebSocket (WSS) clients and Windows Store App clients,
+# you should disable this property. JavaScript browser clients and
+# Windows Store App clients don't use client-side authentication.
 #
-IceSSL.VerifyPeer=0
+#IceSSL.VerifyPeer=0
 
 #
 # Warn about connection exceptions
@@ -58,14 +66,6 @@ IceSSL.Keychain=server.keychain
 IceSSL.KeychainPassword=password
 
 #
-# Uncomment the properties below if you want run the demo with the
-# Windows Store App hello client.
-#
-#Ice.Default.Host=
-#Hello.Endpoints=tcp -p 10000:udp -p 10000:ssl -p 10001
-#IceSSL.DefaultDir=../../../../certs/winrt
-
-#
 # IceMX configuration
 #
 #Ice.Admin.Endpoints=tcp -p 10004
diff --git a/cpp/demo/Ice/latency/config.server b/cpp/demo/Ice/latency/config.server
index 58bdc036da1..198f27bb539 100644
--- a/cpp/demo/Ice/latency/config.server
+++ b/cpp/demo/Ice/latency/config.server
@@ -5,14 +5,17 @@
 Latency.Endpoints=tcp -p 10000:ssl -p 10001:ws -p 10002:wss -p 10003
 
 #
-# Only listen on the localhost interface by default.
+# Only listen on the localhost interface by default. You can comment
+# out this property to allow listening on all available interfaces.
 #
 Ice.Default.Host=localhost
 
 #
-# We need to disable VerifyPeer for secure WebSocket (WSS) clients.
+# For secure WebSocket (WSS) clients you should disable this
+# property. JavaScript browser clients don't use client-side
+# authentication.
 #
-IceSSL.VerifyPeer=0
+#IceSSL.VerifyPeer=0
 
 #
 # Warn about connection exceptions
diff --git a/cpp/demo/Ice/throughput/config.server b/cpp/demo/Ice/throughput/config.server
index 532326d86f7..babd85df454 100644
--- a/cpp/demo/Ice/throughput/config.server
+++ b/cpp/demo/Ice/throughput/config.server
@@ -6,14 +6,17 @@
 Throughput.Endpoints=tcp -p 10000:ssl -p 10001:ws -p 10002:wss -p 10003
 
 #
-# Only listen on the localhost interface by default.
+# Only listen on the localhost interface by default. You can comment
+# out this property to allow listening on all available interfaces.
 #
 Ice.Default.Host=localhost
 
 #
-# We need to disable VerifyPeer for secure WebSocket (WSS) clients.
+# For secure WebSocket (WSS) clients you should disable this
+# property. JavaScript browser clients don't use client-side
+# authentication.
 #
-IceSSL.VerifyPeer=0
+#IceSSL.VerifyPeer=0
 
 #
 # Warn about connection exceptions
diff --git a/cpp/demo/Ice/winrt/hello/Package.appxmanifest b/cpp/demo/Ice/winrt/hello/Package.appxmanifest
index 18092e29240..8ac5ff54ead 100644
--- a/cpp/demo/Ice/winrt/hello/Package.appxmanifest
+++ b/cpp/demo/Ice/winrt/hello/Package.appxmanifest
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Package xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:m2="http://schemas.microsoft.com/appx/2013/manifest">
   <Identity Name="be9e42f6-f89b-4671-8754-e408ccec94f0" Publisher="CN=ZeroC Hello App" Version="1.1.0.0" />
   <Properties>
@@ -33,10 +33,10 @@
   <Extensions>
     <Extension Category="windows.certificates">
       <Certificates>
-        <Certificate StoreName="Root" Content="cacert.pem" />
-        <Certificate StoreName="CA" Content="cacert.pem" />
+        <Certificate StoreName="Root" Content="cacert.der" />
+        <Certificate StoreName="CA" Content="cacert.der" />
         <TrustFlags ExclusiveTrust="true" />
       </Certificates>
     </Extension>
   </Extensions>
-</Package>
\ No newline at end of file
+</Package>
diff --git a/cpp/demo/Ice/winrt/hello/README.txt b/cpp/demo/Ice/winrt/hello/README.txt
index 64fafbac233..08a63dfd18d 100644
--- a/cpp/demo/Ice/winrt/hello/README.txt
+++ b/cpp/demo/Ice/winrt/hello/README.txt
@@ -9,12 +9,12 @@ configuration file config.server to uncomment the IceSSL.VerifyPeer=0
 property. If you run the client from a remote device such as the
 Surface, you will also need to regenerate the server certificate to
 ensure the certificate common name is set to the IP address of the
-server. To regenerate the certificate, you can run the
-makewinrtcerts.py Python script from the certs directory at the top of
-this distribution. For example:
+server. To regenerate the certificate, you can run the makecerts.py
+Python script from the certs directory at the top of this
+distribution. For example:
 
   > cd certs
-  > makewinrtcerts.py 192.168.1.53
+  > makecerts.py 192.168.1.53
 
 This will regenerate a server certificate with a common name set to
 192.168.1.53. This can either be set to an IP address or DNS name, the
diff --git a/cpp/demo/Ice/winrt/hello/hello.vcxproj b/cpp/demo/Ice/winrt/hello/hello.vcxproj
index aed2bd55634..0cd018b568f 100644
--- a/cpp/demo/Ice/winrt/hello/hello.vcxproj
+++ b/cpp/demo/Ice/winrt/hello/hello.vcxproj
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|ARM">
@@ -181,7 +181,7 @@
     <AppxManifest Include="Package.appxmanifest">
       <SubType>Designer</SubType>
     </AppxManifest>
-    <None Include="..\..\..\..\..\certs\winrt\cacert.pem">
+    <None Include="..\..\..\..\..\certs\cacert.der">
       <DeploymentContent>true</DeploymentContent>
     </None>
     <None Include="Hello.ice" />
@@ -224,4 +224,4 @@
       <UserProperties ZerocIce_ProjectVersion="3.6" ZerocIce_Enabled="True" />
     </VisualStudio>
   </ProjectExtensions>
-</Project>
\ No newline at end of file
+</Project>
diff --git a/cpp/demo/Ice/winrt/hello/hello.vcxproj.filters b/cpp/demo/Ice/winrt/hello/hello.vcxproj.filters
index 6c42a0f7286..b932aad7f5b 100644
--- a/cpp/demo/Ice/winrt/hello/hello.vcxproj.filters
+++ b/cpp/demo/Ice/winrt/hello/hello.vcxproj.filters
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup>
     <Filter Include="Common">
@@ -40,7 +40,7 @@
   </ItemGroup>
   <ItemGroup>
     <None Include="Hello.ice" />
-    <None Include="..\..\..\..\..\certs\winrt\cacert.pem" />
+    <None Include="..\..\..\..\..\certs\cacert.der" />
     <None Include="hello_TemporaryKey.pfx" />
   </ItemGroup>
   <ItemGroup>
@@ -50,6 +50,6 @@
     <Text Include="README.txt" />
   </ItemGroup>
   <ItemGroup>
-    <AppxManifest Include="Package-8.1.appxmanifest" />
+    <AppxManifest Include="Package.appxmanifest" />
   </ItemGroup>
-</Project>
\ No newline at end of file
+</Project>
diff --git a/cpp/demo/IceDiscovery/hello/config.server b/cpp/demo/IceDiscovery/hello/config.server
index 668edbddfba..b00a0113dd7 100644
--- a/cpp/demo/IceDiscovery/hello/config.server
+++ b/cpp/demo/IceDiscovery/hello/config.server
@@ -33,14 +33,6 @@ IceSSL.Keychain=server.keychain
 IceSSL.KeychainPassword=password
 
 #
-# Uncomment the properties below if you want run the demo with the
-# Windows Store App hello client.
-#
-#Hello.Endpoints=tcp -p 10000:udp -p 10000:ssl -p 10001
-#IceSSL.VerifyPeer=0
-#IceSSL.DefaultDir=../../../../certs/winrt
-
-#
 # IceMX configuration.
 #
 #Ice.Admin.Endpoints=tcp -h localhost -p 10002
diff --git a/cpp/demo/demo-winrt-8.0.sln b/cpp/demo/demo-winrt-8.0.sln
deleted file mode 100644
index 8ed37773e1c..00000000000
--- a/cpp/demo/demo-winrt-8.0.sln
+++ /dev/null
@@ -1,87 +0,0 @@
-
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 2012
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "bidir", "Ice\winrt\bidir\bidir.vcxproj", "{4EF04DDD-1B81-4DC7-ADF2-290E22008616}"
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "hello", "Ice\winrt\hello\hello.vcxproj", "{DC1A22CC-0AD9-40CF-9159-952962F71520}"
-EndProject
-Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Ice", "Ice", "{2EA0DDEB-E230-4ABE-8257-3418A534FD0F}"
-EndProject
-Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Glacier2", "Glacier2", "{B4B6E47C-00B7-439B-A3D7-04A80F4643B8}"
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "chat", "Glacier2\winrt\chat\chat.vcxproj", "{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		Debug|ARM = Debug|ARM
-		Debug|Win32 = Debug|Win32
-		Debug|x64 = Debug|x64
-		Release|ARM = Release|ARM
-		Release|Win32 = Release|Win32
-		Release|x64 = Release|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Debug|ARM.ActiveCfg = Debug|ARM
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Debug|ARM.Build.0 = Debug|ARM
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Debug|ARM.Deploy.0 = Debug|ARM
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Debug|Win32.ActiveCfg = Debug|Win32
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Debug|Win32.Build.0 = Debug|Win32
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Debug|Win32.Deploy.0 = Debug|Win32
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Debug|x64.ActiveCfg = Debug|x64
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Debug|x64.Build.0 = Debug|x64
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Debug|x64.Deploy.0 = Debug|x64
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Release|ARM.ActiveCfg = Release|ARM
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Release|ARM.Build.0 = Release|ARM
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Release|ARM.Deploy.0 = Release|ARM
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Release|Win32.ActiveCfg = Release|Win32
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Release|Win32.Build.0 = Release|Win32
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Release|Win32.Deploy.0 = Release|Win32
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Release|x64.ActiveCfg = Release|x64
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Release|x64.Build.0 = Release|x64
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616}.Release|x64.Deploy.0 = Release|x64
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Debug|ARM.ActiveCfg = Debug|ARM
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Debug|ARM.Build.0 = Debug|ARM
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Debug|ARM.Deploy.0 = Debug|ARM
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Debug|Win32.ActiveCfg = Debug|Win32
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Debug|Win32.Build.0 = Debug|Win32
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Debug|Win32.Deploy.0 = Debug|Win32
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Debug|x64.ActiveCfg = Debug|x64
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Debug|x64.Build.0 = Debug|x64
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Debug|x64.Deploy.0 = Debug|x64
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Release|ARM.ActiveCfg = Release|ARM
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Release|ARM.Build.0 = Release|ARM
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Release|ARM.Deploy.0 = Release|ARM
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Release|Win32.ActiveCfg = Release|Win32
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Release|Win32.Build.0 = Release|Win32
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Release|Win32.Deploy.0 = Release|Win32
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Release|x64.ActiveCfg = Release|x64
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Release|x64.Build.0 = Release|x64
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC}.Release|x64.Deploy.0 = Release|x64
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Debug|ARM.ActiveCfg = Debug|ARM
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Debug|ARM.Build.0 = Debug|ARM
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Debug|ARM.Deploy.0 = Debug|ARM
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Debug|Win32.ActiveCfg = Debug|Win32
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Debug|Win32.Build.0 = Debug|Win32
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Debug|Win32.Deploy.0 = Debug|Win32
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Debug|x64.ActiveCfg = Debug|x64
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Debug|x64.Build.0 = Debug|x64
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Debug|x64.Deploy.0 = Debug|x64
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Release|ARM.ActiveCfg = Release|ARM
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Release|ARM.Build.0 = Release|ARM
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Release|ARM.Deploy.0 = Release|ARM
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Release|Win32.ActiveCfg = Release|Win32
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Release|Win32.Build.0 = Release|Win32
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Release|Win32.Deploy.0 = Release|Win32
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Release|x64.ActiveCfg = Release|x64
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Release|x64.Build.0 = Release|x64
-		{DC1A22CC-0AD9-40CF-9159-952962F71520}.Release|x64.Deploy.0 = Release|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-	GlobalSection(NestedProjects) = preSolution
-		{4EF04DDD-1B81-4DC7-ADF2-290E22008616} = {2EA0DDEB-E230-4ABE-8257-3418A534FD0F}
-		{C56BDB5E-9829-49D6-B5EB-9089AD7E89CC} = {B4B6E47C-00B7-439B-A3D7-04A80F4643B8}
-		{DC1A22CC-0AD9-40CF-9159-952962F71520} = {2EA0DDEB-E230-4ABE-8257-3418A534FD0F}
-	EndGlobalSection
-EndGlobal
diff --git a/cpp/include/Ice/LoggerUtil.h b/cpp/include/Ice/LoggerUtil.h
index 1414bb37f03..5133c4404b6 100644
--- a/cpp/include/Ice/LoggerUtil.h
+++ b/cpp/include/Ice/LoggerUtil.h
@@ -36,10 +36,10 @@ ICE_API LoggerOutputBase& loggerInsert(LoggerOutputBase& out, const IceUtil::Exc
 template<typename T>
 struct IsException
 {
-    static char test(IceUtil::Exception*);
-    static long test(...);
+    static char testex(IceUtil::Exception*);
+    static long testex(...);
 
-    static const bool value = sizeof(test(static_cast<T*>(0))) == sizeof(char);
+    static const bool value = sizeof(testex(static_cast<T*>(0))) == sizeof(char);
 };
 
 template<typename T, bool = false>
diff --git a/cpp/include/IceGrid/.headers b/cpp/include/IceGrid/.headers
index 973e1bf0a8f..a10f5bdac20 100644
--- a/cpp/include/IceGrid/.headers
+++ b/cpp/include/IceGrid/.headers
@@ -2,11 +2,13 @@ SDK_HEADERS = \
  $(SDK_INCLUDE_PATH)\$(INCLUDE_DIR)\Admin.h \
  $(SDK_INCLUDE_PATH)\$(INCLUDE_DIR)\Config.h \
  $(SDK_INCLUDE_PATH)\$(INCLUDE_DIR)\Descriptor.h \
+ $(SDK_INCLUDE_PATH)\$(INCLUDE_DIR)\Discovery.h \
  $(SDK_INCLUDE_PATH)\$(INCLUDE_DIR)\Exception.h \
  $(SDK_INCLUDE_PATH)\$(INCLUDE_DIR)\FileParser.h \
  $(SDK_INCLUDE_PATH)\$(INCLUDE_DIR)\IceGrid.h \
  $(SDK_INCLUDE_PATH)\$(INCLUDE_DIR)\Locator.h \
  $(SDK_INCLUDE_PATH)\$(INCLUDE_DIR)\Observer.h \
+ $(SDK_INCLUDE_PATH)\$(INCLUDE_DIR)\PluginFacade.h \
  $(SDK_INCLUDE_PATH)\$(INCLUDE_DIR)\Query.h \
  $(SDK_INCLUDE_PATH)\$(INCLUDE_DIR)\Registry.h \
  $(SDK_INCLUDE_PATH)\$(INCLUDE_DIR)\ReplicaGroupFilter.h \
diff --git a/cpp/test/Ice/info/AllTests.cpp b/cpp/test/Ice/info/AllTests.cpp
index 6be9365150a..f951c92aa9c 100644
--- a/cpp/test/Ice/info/AllTests.cpp
+++ b/cpp/test/Ice/info/AllTests.cpp
@@ -32,7 +32,9 @@ allTests(const Ice::CommunicatorPtr& communicator)
         test(ipEndpoint->host == "tcphost");
         test(ipEndpoint->port == 10000);
         test(ipEndpoint->timeout == 1200);
+#if !defined(ICE_OS_WINRT)
         test(ipEndpoint->sourceAddress == "10.10.10.10");
+#endif
         test(ipEndpoint->compress);
         test(!ipEndpoint->datagram());
         test((ipEndpoint->type() == Ice::TCPEndpointType && !ipEndpoint->secure()) ||
@@ -48,7 +50,9 @@ allTests(const Ice::CommunicatorPtr& communicator)
         test(udpEndpoint);
         test(udpEndpoint->host == "udphost");
         test(udpEndpoint->port == 10001);
+#if !defined(ICE_OS_WINRT)
         test(udpEndpoint->sourceAddress == "10.10.10.10");
+#endif
         test(udpEndpoint->mcastInterface == "eth0");
         test(udpEndpoint->mcastTtl == 5);
         test(udpEndpoint->timeout == -1);
diff --git a/cpp/test/WinRT/TestSuite/Package.appxmanifest b/cpp/test/WinRT/TestSuite/Package.appxmanifest
index 419ec7a2af1..54e7c753e07 100644
--- a/cpp/test/WinRT/TestSuite/Package.appxmanifest
+++ b/cpp/test/WinRT/TestSuite/Package.appxmanifest
@@ -1,24 +1,28 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Package xmlns="http://schemas.microsoft.com/appx/2010/manifest">
-  <Identity Name="9cf3ce93-b7f1-414e-b2bd-7181121c15ac" Publisher="CN=ZeroC" Version="1.0.0.0" />
+<Package xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:m2="http://schemas.microsoft.com/appx/2013/manifest">
+  <Identity Name="9cf3ce93-b7f1-414e-b2bd-7181121c15ac" Publisher="CN=ZeroC" Version="1.1.0.0" />
   <Properties>
     <DisplayName>Ice Test Suite</DisplayName>
     <PublisherDisplayName>ZeroC</PublisherDisplayName>
     <Logo>Assets\StoreLogo.png</Logo>
   </Properties>
   <Prerequisites>
-    <OSMinVersion>6.2.0</OSMinVersion>
-    <OSMaxVersionTested>6.2.0</OSMaxVersionTested>
+    <OSMinVersion>6.3</OSMinVersion>
+    <OSMaxVersionTested>6.3</OSMaxVersionTested>
   </Prerequisites>
   <Resources>
     <Resource Language="x-generate" />
   </Resources>
   <Applications>
     <Application Id="App" Executable="$targetnametoken$.exe" EntryPoint="TestSuite.App">
-      <VisualElements DisplayName="Ice Test Suite" Logo="Assets\Logo.png" SmallLogo="Assets\SmallLogo.png" Description="TestSuite" ForegroundText="light" BackgroundColor="#464646">
-        <DefaultTile ShowName="allLogos" />
-        <SplashScreen Image="Assets\SplashScreen.png" />
-      </VisualElements>
+      <m2:VisualElements DisplayName="Ice Test Suite" Description="TestSuite" BackgroundColor="#464646" ForegroundText="light" Square150x150Logo="Assets\Logo.png" Square30x30Logo="Assets\SmallLogo.png">
+        <m2:DefaultTile>
+          <m2:ShowNameOnTiles>
+            <m2:ShowOn Tile="square150x150Logo" />
+          </m2:ShowNameOnTiles>
+        </m2:DefaultTile>
+        <m2:SplashScreen Image="Assets\SplashScreen.png" />
+      </m2:VisualElements>
     </Application>
   </Applications>
   <Capabilities>
@@ -28,8 +32,8 @@
   <Extensions>
     <Extension Category="windows.certificates">
       <Certificates>
-        <Certificate StoreName="Root" Content="cacert.pem" />
-        <Certificate StoreName="CA" Content="cacert.pem" />
+        <Certificate StoreName="Root" Content="cacert.der" />
+        <Certificate StoreName="CA" Content="cacert.der" />
         <TrustFlags ExclusiveTrust="true" />
       </Certificates>
     </Extension>
diff --git a/cpp/test/WinRT/TestSuite/TestSuite.vcxproj b/cpp/test/WinRT/TestSuite/TestSuite.vcxproj
index e826de5f680..018a1112ab0 100644
--- a/cpp/test/WinRT/TestSuite/TestSuite.vcxproj
+++ b/cpp/test/WinRT/TestSuite/TestSuite.vcxproj
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|ARM">
       <Configuration>Debug</Configuration>
@@ -30,70 +30,71 @@
     <ProjectGuid>{3ce71594-e3a4-4c38-9d0f-46e2a2076f6c}</ProjectGuid>
     <RootNamespace>TestSuite</RootNamespace>
     <DefaultLanguage>en-US</DefaultLanguage>
-    <VCTargetsPath Condition="'$(VCTargetsPath11)' != '' and '$(VSVersion)' == '' and '$(VisualStudioVersion)' == ''">$(VCTargetsPath11)</VCTargetsPath>
-    <MinimumVisualStudioVersion>11.0</MinimumVisualStudioVersion>
+    <MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
     <AppContainerApplication>true</AppContainerApplication>
+    <ApplicationType>Windows Store</ApplicationType>
+    <ApplicationTypeRevision>8.1</ApplicationTypeRevision>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
-    <PlatformToolset>v110</PlatformToolset>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
-    <PlatformToolset>v110</PlatformToolset>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
-    <PlatformToolset>v110</PlatformToolset>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
-    <PlatformToolset>v110</PlatformToolset>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
-    <PlatformToolset>v110</PlatformToolset>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
     <WholeProgramOptimization>true</WholeProgramOptimization>
-    <PlatformToolset>v110</PlatformToolset>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">
   </ImportGroup>
   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-    <Import Project="$(Registry:HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\Windows\v8.0\ExtensionSDKS\Ice\3.6@)\DesignTime\CommonConfiguration\Neutral\Ice.props" />
+    <Import Project="$([MSBuild]::GetRegistryValue(`HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\$(TargetPlatformIdentifier)\v$(TargetPlatformVersion)\ExtensionSDKS\Ice\3.6`, ``))\DesignTime\CommonConfiguration\Neutral\Ice.props" Condition="exists('$([MSBuild]::GetRegistryValue(`HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\$(TargetPlatformIdentifier)\v$(TargetPlatformVersion)\ExtensionSDKS\Ice\3.6`, ``))\DesignTime\CommonConfiguration\Neutral\Ice.props')" />
   </ImportGroup>
   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-    <Import Project="$(Registry:HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\Windows\v8.0\ExtensionSDKS\Ice\3.6@)\DesignTime\CommonConfiguration\Neutral\Ice.props" />
+    <Import Project="$([MSBuild]::GetRegistryValue(`HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\$(TargetPlatformIdentifier)\v$(TargetPlatformVersion)\ExtensionSDKS\Ice\3.6`, ``))\DesignTime\CommonConfiguration\Neutral\Ice.props" Condition="exists('$([MSBuild]::GetRegistryValue(`HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\$(TargetPlatformIdentifier)\v$(TargetPlatformVersion)\ExtensionSDKS\Ice\3.6`, ``))\DesignTime\CommonConfiguration\Neutral\Ice.props')" />
   </ImportGroup>
   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-    <Import Project="$(Registry:HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\Windows\v8.0\ExtensionSDKS\Ice\3.6@)\DesignTime\CommonConfiguration\Neutral\Ice.props" />
+    <Import Project="$([MSBuild]::GetRegistryValue(`HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\$(TargetPlatformIdentifier)\v$(TargetPlatformVersion)\ExtensionSDKS\Ice\3.6`, ``))\DesignTime\CommonConfiguration\Neutral\Ice.props" Condition="exists('$([MSBuild]::GetRegistryValue(`HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\$(TargetPlatformIdentifier)\v$(TargetPlatformVersion)\ExtensionSDKS\Ice\3.6`, ``))\DesignTime\CommonConfiguration\Neutral\Ice.props')" />
   </ImportGroup>
   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-    <Import Project="$(Registry:HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\Windows\v8.0\ExtensionSDKS\Ice\3.6@)\DesignTime\CommonConfiguration\Neutral\Ice.props" />
+    <Import Project="$([MSBuild]::GetRegistryValue(`HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\$(TargetPlatformIdentifier)\v$(TargetPlatformVersion)\ExtensionSDKS\Ice\3.6`, ``))\DesignTime\CommonConfiguration\Neutral\Ice.props" Condition="exists('$([MSBuild]::GetRegistryValue(`HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\$(TargetPlatformIdentifier)\v$(TargetPlatformVersion)\ExtensionSDKS\Ice\3.6`, ``))\DesignTime\CommonConfiguration\Neutral\Ice.props')" />
   </ImportGroup>
   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-    <Import Project="$(Registry:HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\Windows\v8.0\ExtensionSDKS\Ice\3.6@)\DesignTime\CommonConfiguration\Neutral\Ice.props" />
+    <Import Project="$([MSBuild]::GetRegistryValue(`HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\$(TargetPlatformIdentifier)\v$(TargetPlatformVersion)\ExtensionSDKS\Ice\3.6`, ``))\DesignTime\CommonConfiguration\Neutral\Ice.props" Condition="exists('$([MSBuild]::GetRegistryValue(`HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\$(TargetPlatformIdentifier)\v$(TargetPlatformVersion)\ExtensionSDKS\Ice\3.6`, ``))\DesignTime\CommonConfiguration\Neutral\Ice.props')" />
   </ImportGroup>
   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
-    <Import Project="$(Registry:HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\Windows\v8.0\ExtensionSDKS\Ice\3.6@)\DesignTime\CommonConfiguration\Neutral\Ice.props" />
+    <Import Project="$([MSBuild]::GetRegistryValue(`HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\$(TargetPlatformIdentifier)\v$(TargetPlatformVersion)\ExtensionSDKS\Ice\3.6`, ``))\DesignTime\CommonConfiguration\Neutral\Ice.props" Condition="exists('$([MSBuild]::GetRegistryValue(`HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SDKs\$(TargetPlatformIdentifier)\v$(TargetPlatformVersion)\ExtensionSDKS\Ice\3.6`, ``))\DesignTime\CommonConfiguration\Neutral\Ice.props')" />
   </ImportGroup>
   <PropertyGroup Label="UserMacros" />
   <PropertyGroup>
@@ -373,7 +374,7 @@
     <None Include="..\..\Ice\udp\Ice_udp_server.dll">
       <DeploymentContent>true</DeploymentContent>
     </None>
-    <None Include="..\..\..\..\certs\winrt\cacert.pem">
+    <None Include="..\..\..\..\certs\cacert.der">
       <DeploymentContent>true</DeploymentContent>
     </None>
     <None Include="TestSuite_TemporaryKey.pfx" />
@@ -408,7 +409,7 @@
   </ImportGroup>
   <ProjectExtensions>
     <VisualStudio>
-      <UserProperties ZerocIce_Enabled="True" ZerocIce_Streaming="False" ZerocIce_ProjectVersion="1" />
+      <UserProperties ZerocIce_Streaming="False" ZerocIce_ProjectVersion="3.6" ZerocIce_Enabled="True" />
     </VisualStudio>
   </ProjectExtensions>
 </Project>
\ No newline at end of file
diff --git a/cpp/test/WinRT/TestSuite/TestSuite.vcxproj.filters b/cpp/test/WinRT/TestSuite/TestSuite.vcxproj.filters
index 17d799266e4..d03de5397c3 100644
--- a/cpp/test/WinRT/TestSuite/TestSuite.vcxproj.filters
+++ b/cpp/test/WinRT/TestSuite/TestSuite.vcxproj.filters
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup>
     <Filter Include="Common">
@@ -167,7 +167,7 @@
     <None Include="..\..\Ice\udp\Ice_udp_server.dll">
       <Filter>Tests</Filter>
     </None>
-    <None Include="..\..\..\..\certs\winrt\cacert.pem" />
+    <None Include="..\..\..\..\certs\cacert.der" />
     <None Include="..\..\Ice\operations\Ice_operations_collocated.dll" />
     <None Include="..\..\Ice\operations\Ice_operations_server.dll" />
     <None Include="..\..\Ice\operations\Ice_operations_serveramd.dll" />
@@ -236,4 +236,4 @@
   <ItemGroup>
     <Page Include="MainPage.xaml" />
   </ItemGroup>
-</Project>
\ No newline at end of file
+</Project>
diff --git a/js/demo/Glacier2/chat/index.html b/js/demo/Glacier2/chat/index.html
index 097ce1aef93..5c0549f9aad 100644
--- a/js/demo/Glacier2/chat/index.html
+++ b/js/demo/Glacier2/chat/index.html
@@ -119,7 +119,9 @@
            very simple chat client.</p>
 
         <p>First follow the instructions from the C++ Glacier2 chat demo README to
-           start the server.</p>
+           start the server. You will also need to edit the Glacier2 configuration
+           file config.glacier2 to uncomment the IceSSL.VerifyPeer=0 property if
+           you want to establish a secure connection with the WSS protocol.</p>
         <div class="panel callout radius">
             <ul>
                 <li>To use the C++ server you'll need a C++ compiler compatible with your
diff --git a/js/demo/Ice/hello/index.html b/js/demo/Ice/hello/index.html
index 1a7a0b9120c..1c341fc30d8 100644
--- a/js/demo/Ice/hello/index.html
+++ b/js/demo/Ice/hello/index.html
@@ -103,7 +103,9 @@
                To run the demo, first you need to start an Ice hello server from
                another language mapping (Java, C++, C#, or Python). Please refer to
                the README in the server subdirectory for more information on starting
-               the server.
+               the server. You will also need to edit the hello server configuration
+               file config.server to uncomment the IceSSL.VerifyPeer=0 property if
+               you want to establish a secure connection with the WSS protocol.
             </p>
 
             <p>You can change the invocation mode using the <strong>"Mode"</strong>
diff --git a/js/demo/Ice/latency/index.html b/js/demo/Ice/latency/index.html
index b14d7c32fbf..acffcecd29d 100644
--- a/js/demo/Ice/latency/index.html
+++ b/js/demo/Ice/latency/index.html
@@ -66,7 +66,9 @@
            To run the demo, first you need to start an Ice latency server from
            another language mapping (Java, C++, C#, or Python). Please refer to
            the README in the server subdirectory for more information on starting
-           the server.
+           the server. You will also need to edit the hello server configuration
+           file config.server to uncomment the IceSSL.VerifyPeer=0 property if
+           you want to establish a secure connection with the WSS protocol.
         </p>
 
         <p>Then you can use the <strong>"Run"</strong> button to run this client.</p>
diff --git a/js/demo/Ice/throughput/index.html b/js/demo/Ice/throughput/index.html
index 136c816ac2d..3bd6f0d7086 100644
--- a/js/demo/Ice/throughput/index.html
+++ b/js/demo/Ice/throughput/index.html
@@ -97,7 +97,9 @@
            To run the demo, first you need to start an Ice throughput server from
            another language mapping (Java, C++, C#, or Python). Please refer to
            the README in the server subdirectory for more information on starting
-           the server.
+           the server. You will also need to edit the hello server configuration
+           file config.server to uncomment the IceSSL.VerifyPeer=0 property if
+           you want to establish a secure connection with the WSS protocol.
         </p>
 
         <p>You can change the data type using the <strong>"Data"</strong> select
diff --git a/scripts/TestUtil.py b/scripts/TestUtil.py
index 0efb2e00a95..b6abdeb6ba3 100755
--- a/scripts/TestUtil.py
+++ b/scripts/TestUtil.py
@@ -881,14 +881,10 @@ def getCommandLineProperties(exe, config):
     if config.protocol == "ssl" or config.protocol == "wss":
         sslenv = {}
         sslenv["icesslcs"] = quoteArgument("\\\"" + os.path.join(getIceDir("cs"), "Assemblies", "IceSSL.dll") + "\\\"")
-        if winrt:
-            sslenv["certsdir"] = quoteArgument(os.path.abspath(os.path.join(toplevel, "certs", "winrt")))
-            sslenv["verifyPeer"] = "0"
-        elif config.protocol == "wss":
-            sslenv["certsdir"] = quoteArgument(os.path.abspath(os.path.join(toplevel, "certs")))
+        sslenv["certsdir"] = quoteArgument(os.path.abspath(os.path.join(toplevel, "certs")))
+        if winrt or config.protocol == "wss":
             sslenv["verifyPeer"] = "0"
         else:
-            sslenv["certsdir"] = quoteArgument(os.path.abspath(os.path.join(toplevel, "certs")))
             sslenv["verifyPeer"] = "2"
         components.append(sslConfigTree[config.lang]["plugin"] % sslenv)
         components.append(sslConfigTree[config.lang][config.type] % sslenv)