Fixed (ICE-7621) - Refactor IceSSL API to support multiple implementations

1 files changed, 20 insertions, 1795 deletions

diff --git a/cpp/src/IceSSL/Util.cpp b/cpp/src/IceSSL/Util.cpp
index 52cd3c5144c..08f97a0c6fb 100755
--- a/cpp/src/IceSSL/Util.cpp
+++ b/cpp/src/IceSSL/Util.cpp
@@ -21,15 +21,9 @@
 #include <Ice/Network.h>
 #include <Ice/Object.h>
 #include <Ice/StringConverter.h>
-#include <fstream>
+#include <Ice/UniqueRef.h>
 
-#ifdef ICE_USE_OPENSSL
-#   include <openssl/err.h>
-//
-// Avoid old style cast warnings from OpenSSL macros
-//
-#  pragma GCC diagnostic ignored "-Wold-style-cast"
-#endif
+#include <fstream>
 
 using namespace std;
 using namespace Ice;
@@ -37,16 +31,23 @@ using namespace IceInternal;
 using namespace IceUtil;
 using namespace IceSSL;
 
-#ifdef ICE_OS_UWP
-using namespace concurrency;
-using namespace Platform;
-using namespace Windows::Foundation;
-using namespace Windows::Foundation::Collections;
-using namespace Windows::Storage;
-using namespace Windows::Storage::Streams;
-using namespace Windows::Security::Cryptography;
-using namespace Windows::Security::Cryptography::Core;
-using namespace Windows::Security::Cryptography::Certificates;
+#if defined(__APPLE__)
+
+std::string
+IceSSL::fromCFString(CFStringRef v)
+{
+    string s;
+    if(v)
+    {
+        CFIndex size = CFStringGetMaximumSizeForEncoding(CFStringGetLength(v), kCFStringEncodingUTF8);
+        vector<char> buffer;
+        buffer.resize(size + 1);
+        CFStringGetCString(v, &buffer[0], buffer.size(), kCFStringEncodingUTF8);
+        s.assign(&buffer[0]);
+    }
+    return s;
+}
+
 #endif
 
 #ifdef ICE_CPP11_MAPPING
@@ -73,14 +74,8 @@ IceSSL::PasswordPrompt::getPassword()
 }
 #endif
 
-
-#if !defined(ICE_USE_OPENSSL)
-
-namespace
-{
-
 bool
-parseBytes(const string& arg, vector<unsigned char>& buffer)
+IceSSL::parseBytes(const string& arg, vector<unsigned char>& buffer)
 {
     string v = IceUtilInternal::toUpper(arg);
 
@@ -118,1776 +113,6 @@ parseBytes(const string& arg, vector<unsigned char>& buffer)
     return true;
 }
 
-}
-
-#endif
-
-#if defined(ICE_USE_OPENSSL)
-
-namespace
-{
-
-#  ifndef OPENSSL_NO_DH
-#    if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-
-// The following arrays are predefined Diffie Hellman group parameters.
-// These are known strong primes, distributed with the OpenSSL library
-// in the files dh512.pem, dh1024.pem, dh2048.pem and dh4096.pem.
-// They are not keys themselves, but the basis for generating DH keys
-// on the fly.
-
-unsigned char dh512_p[] =
-{
-    0xF5,0x2A,0xFF,0x3C,0xE1,0xB1,0x29,0x40,0x18,0x11,0x8D,0x7C,
-    0x84,0xA7,0x0A,0x72,0xD6,0x86,0xC4,0x03,0x19,0xC8,0x07,0x29,
-    0x7A,0xCA,0x95,0x0C,0xD9,0x96,0x9F,0xAB,0xD0,0x0A,0x50,0x9B,
-    0x02,0x46,0xD3,0x08,0x3D,0x66,0xA4,0x5D,0x41,0x9F,0x9C,0x7C,
-    0xBD,0x89,0x4B,0x22,0x19,0x26,0xBA,0xAB,0xA2,0x5E,0xC3,0x55,
-    0xE9,0x2A,0x05,0x5F,
-};
-
-unsigned char dh512_g[] = { 0x02 };
-
-unsigned char dh1024_p[] =
-{
-    0xF4,0x88,0xFD,0x58,0x4E,0x49,0xDB,0xCD,0x20,0xB4,0x9D,0xE4,
-    0x91,0x07,0x36,0x6B,0x33,0x6C,0x38,0x0D,0x45,0x1D,0x0F,0x7C,
-    0x88,0xB3,0x1C,0x7C,0x5B,0x2D,0x8E,0xF6,0xF3,0xC9,0x23,0xC0,
-    0x43,0xF0,0xA5,0x5B,0x18,0x8D,0x8E,0xBB,0x55,0x8C,0xB8,0x5D,
-    0x38,0xD3,0x34,0xFD,0x7C,0x17,0x57,0x43,0xA3,0x1D,0x18,0x6C,
-    0xDE,0x33,0x21,0x2C,0xB5,0x2A,0xFF,0x3C,0xE1,0xB1,0x29,0x40,
-    0x18,0x11,0x8D,0x7C,0x84,0xA7,0x0A,0x72,0xD6,0x86,0xC4,0x03,
-    0x19,0xC8,0x07,0x29,0x7A,0xCA,0x95,0x0C,0xD9,0x96,0x9F,0xAB,
-    0xD0,0x0A,0x50,0x9B,0x02,0x46,0xD3,0x08,0x3D,0x66,0xA4,0x5D,
-    0x41,0x9F,0x9C,0x7C,0xBD,0x89,0x4B,0x22,0x19,0x26,0xBA,0xAB,
-    0xA2,0x5E,0xC3,0x55,0xE9,0x2F,0x78,0xC7,
-};
-
-unsigned char dh1024_g[] = { 0x02 };
-
-unsigned char dh2048_p[] =
-{
-    0xF6,0x42,0x57,0xB7,0x08,0x7F,0x08,0x17,0x72,0xA2,0xBA,0xD6,
-    0xA9,0x42,0xF3,0x05,0xE8,0xF9,0x53,0x11,0x39,0x4F,0xB6,0xF1,
-    0x6E,0xB9,0x4B,0x38,0x20,0xDA,0x01,0xA7,0x56,0xA3,0x14,0xE9,
-    0x8F,0x40,0x55,0xF3,0xD0,0x07,0xC6,0xCB,0x43,0xA9,0x94,0xAD,
-    0xF7,0x4C,0x64,0x86,0x49,0xF8,0x0C,0x83,0xBD,0x65,0xE9,0x17,
-    0xD4,0xA1,0xD3,0x50,0xF8,0xF5,0x59,0x5F,0xDC,0x76,0x52,0x4F,
-    0x3D,0x3D,0x8D,0xDB,0xCE,0x99,0xE1,0x57,0x92,0x59,0xCD,0xFD,
-    0xB8,0xAE,0x74,0x4F,0xC5,0xFC,0x76,0xBC,0x83,0xC5,0x47,0x30,
-    0x61,0xCE,0x7C,0xC9,0x66,0xFF,0x15,0xF9,0xBB,0xFD,0x91,0x5E,
-    0xC7,0x01,0xAA,0xD3,0x5B,0x9E,0x8D,0xA0,0xA5,0x72,0x3A,0xD4,
-    0x1A,0xF0,0xBF,0x46,0x00,0x58,0x2B,0xE5,0xF4,0x88,0xFD,0x58,
-    0x4E,0x49,0xDB,0xCD,0x20,0xB4,0x9D,0xE4,0x91,0x07,0x36,0x6B,
-    0x33,0x6C,0x38,0x0D,0x45,0x1D,0x0F,0x7C,0x88,0xB3,0x1C,0x7C,
-    0x5B,0x2D,0x8E,0xF6,0xF3,0xC9,0x23,0xC0,0x43,0xF0,0xA5,0x5B,
-    0x18,0x8D,0x8E,0xBB,0x55,0x8C,0xB8,0x5D,0x38,0xD3,0x34,0xFD,
-    0x7C,0x17,0x57,0x43,0xA3,0x1D,0x18,0x6C,0xDE,0x33,0x21,0x2C,
-    0xB5,0x2A,0xFF,0x3C,0xE1,0xB1,0x29,0x40,0x18,0x11,0x8D,0x7C,
-    0x84,0xA7,0x0A,0x72,0xD6,0x86,0xC4,0x03,0x19,0xC8,0x07,0x29,
-    0x7A,0xCA,0x95,0x0C,0xD9,0x96,0x9F,0xAB,0xD0,0x0A,0x50,0x9B,
-    0x02,0x46,0xD3,0x08,0x3D,0x66,0xA4,0x5D,0x41,0x9F,0x9C,0x7C,
-    0xBD,0x89,0x4B,0x22,0x19,0x26,0xBA,0xAB,0xA2,0x5E,0xC3,0x55,
-    0xE9,0x32,0x0B,0x3B,
-};
-
-unsigned char dh2048_g[] = { 0x02 };
-
-unsigned char dh4096_p[] =
-{
-    0xFA,0x14,0x72,0x52,0xC1,0x4D,0xE1,0x5A,0x49,0xD4,0xEF,0x09,
-    0x2D,0xC0,0xA8,0xFD,0x55,0xAB,0xD7,0xD9,0x37,0x04,0x28,0x09,
-    0xE2,0xE9,0x3E,0x77,0xE2,0xA1,0x7A,0x18,0xDD,0x46,0xA3,0x43,
-    0x37,0x23,0x90,0x97,0xF3,0x0E,0xC9,0x03,0x50,0x7D,0x65,0xCF,
-    0x78,0x62,0xA6,0x3A,0x62,0x22,0x83,0xA1,0x2F,0xFE,0x79,0xBA,
-    0x35,0xFF,0x59,0xD8,0x1D,0x61,0xDD,0x1E,0x21,0x13,0x17,0xFE,
-    0xCD,0x38,0x87,0x9E,0xF5,0x4F,0x79,0x10,0x61,0x8D,0xD4,0x22,
-    0xF3,0x5A,0xED,0x5D,0xEA,0x21,0xE9,0x33,0x6B,0x48,0x12,0x0A,
-    0x20,0x77,0xD4,0x25,0x60,0x61,0xDE,0xF6,0xB4,0x4F,0x1C,0x63,
-    0x40,0x8B,0x3A,0x21,0x93,0x8B,0x79,0x53,0x51,0x2C,0xCA,0xB3,
-    0x7B,0x29,0x56,0xA8,0xC7,0xF8,0xF4,0x7B,0x08,0x5E,0xA6,0xDC,
-    0xA2,0x45,0x12,0x56,0xDD,0x41,0x92,0xF2,0xDD,0x5B,0x8F,0x23,
-    0xF0,0xF3,0xEF,0xE4,0x3B,0x0A,0x44,0xDD,0xED,0x96,0x84,0xF1,
-    0xA8,0x32,0x46,0xA3,0xDB,0x4A,0xBE,0x3D,0x45,0xBA,0x4E,0xF8,
-    0x03,0xE5,0xDD,0x6B,0x59,0x0D,0x84,0x1E,0xCA,0x16,0x5A,0x8C,
-    0xC8,0xDF,0x7C,0x54,0x44,0xC4,0x27,0xA7,0x3B,0x2A,0x97,0xCE,
-    0xA3,0x7D,0x26,0x9C,0xAD,0xF4,0xC2,0xAC,0x37,0x4B,0xC3,0xAD,
-    0x68,0x84,0x7F,0x99,0xA6,0x17,0xEF,0x6B,0x46,0x3A,0x7A,0x36,
-    0x7A,0x11,0x43,0x92,0xAD,0xE9,0x9C,0xFB,0x44,0x6C,0x3D,0x82,
-    0x49,0xCC,0x5C,0x6A,0x52,0x42,0xF8,0x42,0xFB,0x44,0xF9,0x39,
-    0x73,0xFB,0x60,0x79,0x3B,0xC2,0x9E,0x0B,0xDC,0xD4,0xA6,0x67,
-    0xF7,0x66,0x3F,0xFC,0x42,0x3B,0x1B,0xDB,0x4F,0x66,0xDC,0xA5,
-    0x8F,0x66,0xF9,0xEA,0xC1,0xED,0x31,0xFB,0x48,0xA1,0x82,0x7D,
-    0xF8,0xE0,0xCC,0xB1,0xC7,0x03,0xE4,0xF8,0xB3,0xFE,0xB7,0xA3,
-    0x13,0x73,0xA6,0x7B,0xC1,0x0E,0x39,0xC7,0x94,0x48,0x26,0x00,
-    0x85,0x79,0xFC,0x6F,0x7A,0xAF,0xC5,0x52,0x35,0x75,0xD7,0x75,
-    0xA4,0x40,0xFA,0x14,0x74,0x61,0x16,0xF2,0xEB,0x67,0x11,0x6F,
-    0x04,0x43,0x3D,0x11,0x14,0x4C,0xA7,0x94,0x2A,0x39,0xA1,0xC9,
-    0x90,0xCF,0x83,0xC6,0xFF,0x02,0x8F,0xA3,0x2A,0xAC,0x26,0xDF,
-    0x0B,0x8B,0xBE,0x64,0x4A,0xF1,0xA1,0xDC,0xEE,0xBA,0xC8,0x03,
-    0x82,0xF6,0x62,0x2C,0x5D,0xB6,0xBB,0x13,0x19,0x6E,0x86,0xC5,
-    0x5B,0x2B,0x5E,0x3A,0xF3,0xB3,0x28,0x6B,0x70,0x71,0x3A,0x8E,
-    0xFF,0x5C,0x15,0xE6,0x02,0xA4,0xCE,0xED,0x59,0x56,0xCC,0x15,
-    0x51,0x07,0x79,0x1A,0x0F,0x25,0x26,0x27,0x30,0xA9,0x15,0xB2,
-    0xC8,0xD4,0x5C,0xCC,0x30,0xE8,0x1B,0xD8,0xD5,0x0F,0x19,0xA8,
-    0x80,0xA4,0xC7,0x01,0xAA,0x8B,0xBA,0x53,0xBB,0x47,0xC2,0x1F,
-    0x6B,0x54,0xB0,0x17,0x60,0xED,0x79,0x21,0x95,0xB6,0x05,0x84,
-    0x37,0xC8,0x03,0xA4,0xDD,0xD1,0x06,0x69,0x8F,0x4C,0x39,0xE0,
-    0xC8,0x5D,0x83,0x1D,0xBE,0x6A,0x9A,0x99,0xF3,0x9F,0x0B,0x45,
-    0x29,0xD4,0xCB,0x29,0x66,0xEE,0x1E,0x7E,0x3D,0xD7,0x13,0x4E,
-    0xDB,0x90,0x90,0x58,0xCB,0x5E,0x9B,0xCD,0x2E,0x2B,0x0F,0xA9,
-    0x4E,0x78,0xAC,0x05,0x11,0x7F,0xE3,0x9E,0x27,0xD4,0x99,0xE1,
-    0xB9,0xBD,0x78,0xE1,0x84,0x41,0xA0,0xDF,
-};
-
-unsigned char dh4096_g[] = { 0x02 };
-
-#    else
-//
-// With OpenSSL 1.1.0 is no longer possible to acess the DH p and g
-// data members to set the DH params. We still use the same default
-// parameters but they were converted to DER format using
-// i2d_DHparams and can be restored using d2i_DHparams
-
-unsigned char dh512[] =
-{
-    0x30,0x46,0x02,0x41,0x00,0xF5,0x2A,0xFF,0x3C,0xE1,0xB1,0x29,
-    0x40,0x18,0x11,0x8D,0x7C,0x84,0xA7,0x0A,0x72,0xD6,0x86,0xC4,
-    0x03,0x19,0xC8,0x07,0x29,0x7A,0xCA,0x95,0x0C,0xD9,0x96,0x9F,
-    0xAB,0xD0,0x0A,0x50,0x9B,0x02,0x46,0xD3,0x08,0x3D,0x66,0xA4,
-    0x5D,0x41,0x9F,0x9C,0x7C,0xBD,0x89,0x4B,0x22,0x19,0x26,0xBA,
-    0xAB,0xA2,0x5E,0xC3,0x55,0xE9,0x2A,0x05,0x5F,0x02,0x01,0x02,
-};
-
-unsigned char dh1024[] =
-{
-    0x30,0x81,0x87,0x02,0x81,0x81,0x00,0xF4,0x88,0xFD,0x58,0x4E,
-    0x49,0xDB,0xCD,0x20,0xB4,0x9D,0xE4,0x91,0x07,0x36,0x6B,0x33,
-    0x6C,0x38,0x0D,0x45,0x1D,0x0F,0x7C,0x88,0xB3,0x1C,0x7C,0x5B,
-    0x2D,0x8E,0xF6,0xF3,0xC9,0x23,0xC0,0x43,0xF0,0xA5,0x5B,0x18,
-    0x8D,0x8E,0xBB,0x55,0x8C,0xB8,0x5D,0x38,0xD3,0x34,0xFD,0x7C,
-    0x17,0x57,0x43,0xA3,0x1D,0x18,0x6C,0xDE,0x33,0x21,0x2C,0xB5,
-    0x2A,0xFF,0x3C,0xE1,0xB1,0x29,0x40,0x18,0x11,0x8D,0x7C,0x84,
-    0xA7,0x0A,0x72,0xD6,0x86,0xC4,0x03,0x19,0xC8,0x07,0x29,0x7A,
-    0xCA,0x95,0x0C,0xD9,0x96,0x9F,0xAB,0xD0,0x0A,0x50,0x9B,0x02,
-    0x46,0xD3,0x08,0x3D,0x66,0xA4,0x5D,0x41,0x9F,0x9C,0x7C,0xBD,
-    0x89,0x4B,0x22,0x19,0x26,0xBA,0xAB,0xA2,0x5E,0xC3,0x55,0xE9,
-    0x2F,0x78,0xC7,0x02,0x01,0x02,
-};
-
-unsigned char dh2048[] =
-{
-    0x30,0x82,0x01,0x08,0x02,0x82,0x01,0x01,0x00,0xF6,0x42,0x57,
-    0xB7,0x08,0x7F,0x08,0x17,0x72,0xA2,0xBA,0xD6,0xA9,0x42,0xF3,
-    0x05,0xE8,0xF9,0x53,0x11,0x39,0x4F,0xB6,0xF1,0x6E,0xB9,0x4B,
-    0x38,0x20,0xDA,0x01,0xA7,0x56,0xA3,0x14,0xE9,0x8F,0x40,0x55,
-    0xF3,0xD0,0x07,0xC6,0xCB,0x43,0xA9,0x94,0xAD,0xF7,0x4C,0x64,
-    0x86,0x49,0xF8,0x0C,0x83,0xBD,0x65,0xE9,0x17,0xD4,0xA1,0xD3,
-    0x50,0xF8,0xF5,0x59,0x5F,0xDC,0x76,0x52,0x4F,0x3D,0x3D,0x8D,
-    0xDB,0xCE,0x99,0xE1,0x57,0x92,0x59,0xCD,0xFD,0xB8,0xAE,0x74,
-    0x4F,0xC5,0xFC,0x76,0xBC,0x83,0xC5,0x47,0x30,0x61,0xCE,0x7C,
-    0xC9,0x66,0xFF,0x15,0xF9,0xBB,0xFD,0x91,0x5E,0xC7,0x01,0xAA,
-    0xD3,0x5B,0x9E,0x8D,0xA0,0xA5,0x72,0x3A,0xD4,0x1A,0xF0,0xBF,
-    0x46,0x00,0x58,0x2B,0xE5,0xF4,0x88,0xFD,0x58,0x4E,0x49,0xDB,
-    0xCD,0x20,0xB4,0x9D,0xE4,0x91,0x07,0x36,0x6B,0x33,0x6C,0x38,
-    0x0D,0x45,0x1D,0x0F,0x7C,0x88,0xB3,0x1C,0x7C,0x5B,0x2D,0x8E,
-    0xF6,0xF3,0xC9,0x23,0xC0,0x43,0xF0,0xA5,0x5B,0x18,0x8D,0x8E,
-    0xBB,0x55,0x8C,0xB8,0x5D,0x38,0xD3,0x34,0xFD,0x7C,0x17,0x57,
-    0x43,0xA3,0x1D,0x18,0x6C,0xDE,0x33,0x21,0x2C,0xB5,0x2A,0xFF,
-    0x3C,0xE1,0xB1,0x29,0x40,0x18,0x11,0x8D,0x7C,0x84,0xA7,0x0A,
-    0x72,0xD6,0x86,0xC4,0x03,0x19,0xC8,0x07,0x29,0x7A,0xCA,0x95,
-    0x0C,0xD9,0x96,0x9F,0xAB,0xD0,0x0A,0x50,0x9B,0x02,0x46,0xD3,
-    0x08,0x3D,0x66,0xA4,0x5D,0x41,0x9F,0x9C,0x7C,0xBD,0x89,0x4B,
-    0x22,0x19,0x26,0xBA,0xAB,0xA2,0x5E,0xC3,0x55,0xE9,0x32,0x0B,
-    0x3B,0x02,0x01,0x02,
-};
-
-unsigned char dh4096[] =
-{
-    0x30,0x82,0x02,0x08,0x02,0x82,0x02,0x01,0x00,0xFA,0x14,0x72,
-    0x52,0xC1,0x4D,0xE1,0x5A,0x49,0xD4,0xEF,0x09,0x2D,0xC0,0xA8,
-    0xFD,0x55,0xAB,0xD7,0xD9,0x37,0x04,0x28,0x09,0xE2,0xE9,0x3E,
-    0x77,0xE2,0xA1,0x7A,0x18,0xDD,0x46,0xA3,0x43,0x37,0x23,0x90,
-    0x97,0xF3,0x0E,0xC9,0x03,0x50,0x7D,0x65,0xCF,0x78,0x62,0xA6,
-    0x3A,0x62,0x22,0x83,0xA1,0x2F,0xFE,0x79,0xBA,0x35,0xFF,0x59,
-    0xD8,0x1D,0x61,0xDD,0x1E,0x21,0x13,0x17,0xFE,0xCD,0x38,0x87,
-    0x9E,0xF5,0x4F,0x79,0x10,0x61,0x8D,0xD4,0x22,0xF3,0x5A,0xED,
-    0x5D,0xEA,0x21,0xE9,0x33,0x6B,0x48,0x12,0x0A,0x20,0x77,0xD4,
-    0x25,0x60,0x61,0xDE,0xF6,0xB4,0x4F,0x1C,0x63,0x40,0x8B,0x3A,
-    0x21,0x93,0x8B,0x79,0x53,0x51,0x2C,0xCA,0xB3,0x7B,0x29,0x56,
-    0xA8,0xC7,0xF8,0xF4,0x7B,0x08,0x5E,0xA6,0xDC,0xA2,0x45,0x12,
-    0x56,0xDD,0x41,0x92,0xF2,0xDD,0x5B,0x8F,0x23,0xF0,0xF3,0xEF,
-    0xE4,0x3B,0x0A,0x44,0xDD,0xED,0x96,0x84,0xF1,0xA8,0x32,0x46,
-    0xA3,0xDB,0x4A,0xBE,0x3D,0x45,0xBA,0x4E,0xF8,0x03,0xE5,0xDD,
-    0x6B,0x59,0x0D,0x84,0x1E,0xCA,0x16,0x5A,0x8C,0xC8,0xDF,0x7C,
-    0x54,0x44,0xC4,0x27,0xA7,0x3B,0x2A,0x97,0xCE,0xA3,0x7D,0x26,
-    0x9C,0xAD,0xF4,0xC2,0xAC,0x37,0x4B,0xC3,0xAD,0x68,0x84,0x7F,
-    0x99,0xA6,0x17,0xEF,0x6B,0x46,0x3A,0x7A,0x36,0x7A,0x11,0x43,
-    0x92,0xAD,0xE9,0x9C,0xFB,0x44,0x6C,0x3D,0x82,0x49,0xCC,0x5C,
-    0x6A,0x52,0x42,0xF8,0x42,0xFB,0x44,0xF9,0x39,0x73,0xFB,0x60,
-    0x79,0x3B,0xC2,0x9E,0x0B,0xDC,0xD4,0xA6,0x67,0xF7,0x66,0x3F,
-    0xFC,0x42,0x3B,0x1B,0xDB,0x4F,0x66,0xDC,0xA5,0x8F,0x66,0xF9,
-    0xEA,0xC1,0xED,0x31,0xFB,0x48,0xA1,0x82,0x7D,0xF8,0xE0,0xCC,
-    0xB1,0xC7,0x03,0xE4,0xF8,0xB3,0xFE,0xB7,0xA3,0x13,0x73,0xA6,
-    0x7B,0xC1,0x0E,0x39,0xC7,0x94,0x48,0x26,0x00,0x85,0x79,0xFC,
-    0x6F,0x7A,0xAF,0xC5,0x52,0x35,0x75,0xD7,0x75,0xA4,0x40,0xFA,
-    0x14,0x74,0x61,0x16,0xF2,0xEB,0x67,0x11,0x6F,0x04,0x43,0x3D,
-    0x11,0x14,0x4C,0xA7,0x94,0x2A,0x39,0xA1,0xC9,0x90,0xCF,0x83,
-    0xC6,0xFF,0x02,0x8F,0xA3,0x2A,0xAC,0x26,0xDF,0x0B,0x8B,0xBE,
-    0x64,0x4A,0xF1,0xA1,0xDC,0xEE,0xBA,0xC8,0x03,0x82,0xF6,0x62,
-    0x2C,0x5D,0xB6,0xBB,0x13,0x19,0x6E,0x86,0xC5,0x5B,0x2B,0x5E,
-    0x3A,0xF3,0xB3,0x28,0x6B,0x70,0x71,0x3A,0x8E,0xFF,0x5C,0x15,
-    0xE6,0x02,0xA4,0xCE,0xED,0x59,0x56,0xCC,0x15,0x51,0x07,0x79,
-    0x1A,0x0F,0x25,0x26,0x27,0x30,0xA9,0x15,0xB2,0xC8,0xD4,0x5C,
-    0xCC,0x30,0xE8,0x1B,0xD8,0xD5,0x0F,0x19,0xA8,0x80,0xA4,0xC7,
-    0x01,0xAA,0x8B,0xBA,0x53,0xBB,0x47,0xC2,0x1F,0x6B,0x54,0xB0,
-    0x17,0x60,0xED,0x79,0x21,0x95,0xB6,0x05,0x84,0x37,0xC8,0x03,
-    0xA4,0xDD,0xD1,0x06,0x69,0x8F,0x4C,0x39,0xE0,0xC8,0x5D,0x83,
-    0x1D,0xBE,0x6A,0x9A,0x99,0xF3,0x9F,0x0B,0x45,0x29,0xD4,0xCB,
-    0x29,0x66,0xEE,0x1E,0x7E,0x3D,0xD7,0x13,0x4E,0xDB,0x90,0x90,
-    0x58,0xCB,0x5E,0x9B,0xCD,0x2E,0x2B,0x0F,0xA9,0x4E,0x78,0xAC,
-    0x05,0x11,0x7F,0xE3,0x9E,0x27,0xD4,0x99,0xE1,0xB9,0xBD,0x78,
-    0xE1,0x84,0x41,0xA0,0xDF,0x02,0x01,0x02,
-};
-#    endif
-
-}
-
-//
-// Convert a predefined parameter set into a DH value.
-//
-#    if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
-static DH*
-convertDH(const unsigned char* buf, int len)
-{
-    return d2i_DHparams(0, &buf, len);
-}
-#    else
-static DH*
-convertDH(unsigned char* p, int plen, unsigned char* g, int glen)
-{
-    assert(p != 0);
-    assert(g != 0);
-
-    DH* dh = DH_new();
-
-    if(dh != 0)
-    {
-        dh->p = BN_bin2bn(p, plen, 0);
-        dh->g = BN_bin2bn(g, glen, 0);
-
-        if((dh->p == 0) || (dh->g == 0))
-        {
-            DH_free(dh);
-            dh = 0;
-        }
-    }
-    return dh;
-}
-#    endif
-
-IceSSL::DHParams::DHParams() :
-    _dh512(0), _dh1024(0), _dh2048(0), _dh4096(0)
-{
-}
-
-IceSSL::DHParams::~DHParams()
-{
-    for(ParamList::iterator p = _params.begin(); p != _params.end(); ++p)
-    {
-        DH_free(p->second);
-    }
-    DH_free(_dh512);
-    DH_free(_dh1024);
-    DH_free(_dh2048);
-    DH_free(_dh4096);
-}
-
-bool
-IceSSL::DHParams::add(int keyLength, const string& file)
-{
-    BIO* bio = BIO_new(BIO_s_file());
-    if(BIO_read_filename(bio, file.c_str()) <= 0)
-    {
-        BIO_free(bio);
-        return false;
-    }
-    DH* dh = PEM_read_bio_DHparams(bio, 0, 0, 0);
-    BIO_free(bio);
-    if(!dh)
-    {
-        return false;
-    }
-    ParamList::iterator p = _params.begin();
-    while(p != _params.end() && keyLength > p->first)
-    {
-        ++p;
-    }
-    _params.insert(p, KeyParamPair(keyLength, dh));
-    return true;
-}
-
-DH*
-IceSSL::DHParams::get(int keyLength)
-{
-    //
-    // First check the set of parameters specified by the user.
-    // Return the first set whose key length is at least keyLength.
-    //
-    for(ParamList::iterator p = _params.begin(); p != _params.end(); ++p)
-    {
-        if(p->first >= keyLength)
-        {
-            return p->second;
-        }
-    }
-
-    //
-    // No match found. Use one of the predefined parameter sets instead.
-    //
-    IceUtil::Mutex::Lock sync(*this);
-#    if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
-    if(keyLength >= 4096)
-    {
-        if(!_dh4096)
-        {
-            _dh4096 = convertDH(dh4096, (int) sizeof(dh4096));
-        }
-        return _dh4096;
-    }
-    else if(keyLength >= 2048)
-    {
-        if(!_dh2048)
-        {
-            _dh2048 = convertDH(dh2048, (int) sizeof(dh2048));
-        }
-        return _dh2048;
-    }
-    else if(keyLength >= 1024)
-    {
-        if(!_dh1024)
-        {
-            _dh1024 = convertDH(dh1024, (int) sizeof(dh1024));
-        }
-        return _dh1024;
-    }
-    else
-    {
-        if(!_dh512)
-        {
-            _dh512 = convertDH(dh512, (int) sizeof(dh512));
-        }
-        return _dh512;
-    }
-#    else
-    if(keyLength >= 4096)
-    {
-        if(!_dh4096)
-        {
-            _dh4096 = convertDH(dh4096_p, (int) sizeof(dh4096_p), dh4096_g, (int) sizeof(dh4096_g));
-        }
-        return _dh4096;
-    }
-    else if(keyLength >= 2048)
-    {
-        if(!_dh2048)
-        {
-            _dh2048 = convertDH(dh2048_p, (int) sizeof(dh2048_p), dh2048_g, (int) sizeof(dh2048_g));
-        }
-        return _dh2048;
-    }
-    else if(keyLength >= 1024)
-    {
-        if(!_dh1024)
-        {
-            _dh1024 = convertDH(dh1024_p, (int) sizeof(dh1024_p), dh1024_g, (int) sizeof(dh1024_g));
-        }
-        return _dh1024;
-    }
-    else
-    {
-        if(!_dh512)
-        {
-            _dh512 = convertDH(dh512_p, (int) sizeof(dh512_p), dh512_g, (int) sizeof(dh512_g));
-        }
-        return _dh512;
-    }
-#    endif
-}
-
-#  endif
-
-string
-IceSSL::getSslErrors(bool verbose)
-{
-    ostringstream ostr;
-
-    const char* file;
-    const char* data;
-    int line;
-    int flags;
-    unsigned long err;
-    int count = 0;
-    while((err = ERR_get_error_line_data(&file, &line, &data, &flags)) != 0)
-    {
-        if(count > 0)
-        {
-            ostr << endl;
-        }
-
-        if(verbose)
-        {
-            if(count > 0)
-            {
-                ostr << endl;
-            }
-
-            char buf[200];
-            ERR_error_string_n(err, buf, sizeof(buf));
-
-            ostr << "error # = " << err << endl;
-            ostr << "message = " << buf << endl;
-            ostr << "location = " << file << ", " << line;
-            if(flags & ERR_TXT_STRING)
-            {
-                ostr << endl;
-                ostr << "data = " << data;
-            }
-        }
-        else
-        {
-            const char* reason = ERR_reason_error_string(err);
-            ostr << (reason == ICE_NULLPTR ? "unknown reason" : reason);
-            if(flags & ERR_TXT_STRING)
-            {
-                ostr << ": " << data;
-            }
-        }
-
-        ++count;
-    }
-
-    ERR_clear_error();
-
-    return ostr.str();
-}
-
-#elif defined(ICE_USE_SECURE_TRANSPORT)
-
-string
-IceSSL::errorToString(CFErrorRef err)
-{
-    ostringstream os;
-    if(err)
-    {
-        UniqueRef<CFStringRef> s(CFErrorCopyDescription(err));
-        os << "(error: " << CFErrorGetCode(err) << " description: " << fromCFString(s.get()) << ")";
-    }
-    return os.str();
-}
-
-string
-IceSSL::errorToString(OSStatus status)
-{
-    ostringstream os;
-    os << "(error: " << status;
-#if defined(ICE_USE_SECURE_TRANSPORT_MACOS)
-    UniqueRef<CFStringRef> s(SecCopyErrorMessageString(status, 0));
-    if(s)
-    {
-        os << " description: " << fromCFString(s.get());
-    }
-#endif
-    os << ")";
-    return os.str();
-}
-
-std::string
-IceSSL::fromCFString(CFStringRef v)
-{
-    string s;
-    if(v)
-    {
-        CFIndex size = CFStringGetMaximumSizeForEncoding(CFStringGetLength(v), kCFStringEncodingUTF8);
-        vector<char> buffer;
-        buffer.resize(size + 1);
-        CFStringGetCString(v, &buffer[0], buffer.size(), kCFStringEncodingUTF8);
-        s.assign(&buffer[0]);
-    }
-    return s;
-}
-
-#if defined(ICE_USE_SECURE_TRANSPORT_MACOS)
-CFDictionaryRef
-IceSSL::getCertificateProperty(SecCertificateRef cert, CFTypeRef key)
-{
-    UniqueRef<CFDictionaryRef> property;
-    UniqueRef<CFArrayRef> keys(CFArrayCreate(ICE_NULLPTR, &key , 1, &kCFTypeArrayCallBacks));
-    UniqueRef<CFErrorRef> err;
-    UniqueRef<CFDictionaryRef> values(SecCertificateCopyValues(cert, keys.get(), &err.get()));
-    if(err)
-    {
-        ostringstream os;
-        os << "IceSSL: error getting property for certificate:\n" << errorToString(err);
-        throw CertificateReadException(__FILE__, __LINE__, os.str());
-    }
-
-    assert(values);
-    property.retain(static_cast<CFDictionaryRef>(CFDictionaryGetValue(values.get(), key)));
-    return property.release();
-}
-#endif
-
-namespace
-{
-
-CFMutableDataRef
-readCertFile(const string& file)
-{
-    ifstream is(IceUtilInternal::streamFilename(file).c_str(), ios::in | ios::binary);
-    if(!is.good())
-    {
-        throw CertificateReadException(__FILE__, __LINE__, "error opening file " + file);
-    }
-
-    is.seekg(0, is.end);
-    size_t size = is.tellg();
-    is.seekg(0, is.beg);
-
-    UniqueRef<CFMutableDataRef> data(CFDataCreateMutable(kCFAllocatorDefault, size));
-    CFDataSetLength(data.get(), size);
-    is.read(reinterpret_cast<char*>(CFDataGetMutableBytePtr(data.get())), size);
-    if(!is.good())
-    {
-        throw CertificateReadException(__FILE__, __LINE__, "error reading file " + file);
-    }
-    return data.release();
-}
-
-#if defined(ICE_USE_SECURE_TRANSPORT_MACOS)
-//
-// Check the certificate basic constraints to check if the certificate is marked as a CA.
-//
-bool
-isCA(SecCertificateRef cert)
-{
-    UniqueRef<CFDictionaryRef> property(getCertificateProperty(cert, kSecOIDBasicConstraints));
-    if(property)
-    {
-        CFArrayRef propertyValues = static_cast<CFArrayRef>(CFDictionaryGetValue(property.get(), kSecPropertyKeyValue));
-        for(int i = 0, size = CFArrayGetCount(propertyValues); i < size; ++i)
-        {
-            CFDictionaryRef dict = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(propertyValues, i));
-            CFStringRef label = static_cast<CFStringRef>(CFDictionaryGetValue(dict, kSecPropertyKeyLabel));
-            if(CFEqual(label, CFSTR("Certificate Authority")))
-            {
-                return CFEqual(static_cast<CFStringRef>(CFDictionaryGetValue(dict, kSecPropertyKeyValue)), CFSTR("Yes"));
-            }
-        }
-    }
-    return false;
-}
-
-//
-// Load keychain items (Certificates or Private Keys) from a file. On return items param contain
-// the list of items, the caller must release it.
-//
-CFArrayRef
-loadKeychainItems(const string& file, SecExternalItemType type, SecKeychainRef keychain, const string& passphrase,
-                  const PasswordPromptPtr& prompt, int retryMax)
-{
-    UniqueRef<CFMutableDataRef> data(readCertFile(file));
-
-    SecItemImportExportKeyParameters params;
-    memset(&params, 0, sizeof(params));
-    params.version =  SEC_KEY_IMPORT_EXPORT_PARAMS_VERSION;
-    params.flags |= kSecKeyNoAccessControl;
-    if(!passphrase.empty())
-    {
-        params.passphrase = toCFString(passphrase);
-    }
-
-    UniqueRef<CFArrayRef> items;
-    SecExternalItemType importType = type;
-    SecExternalFormat format = type == kSecItemTypeUnknown ? kSecFormatPKCS12 : kSecFormatUnknown;
-    UniqueRef<CFStringRef> path(toCFString(file));
-    OSStatus err = SecItemImport(data.get(), path.get(), &format, &importType, 0, &params, keychain, &items.get());
-
-    //
-    // If passphrase failure and no password was configured, we obtain
-    // the password from the given prompt or configure the import to
-    // prompt the user with an alert dialog.
-    //
-    UniqueRef<CFStringRef> passphraseHolder;
-    UniqueRef<CFStringRef> alertPromptHolder;
-    if(passphrase.empty() &&
-       (err == errSecPassphraseRequired || err == errSecInvalidData || err == errSecPkcs12VerifyFailure))
-    {
-        if(!prompt)
-        {
-            params.flags |= kSecKeySecurePassphrase;
-            ostringstream os;
-            os << "Enter the password for\n" << file;
-            alertPromptHolder.reset(toCFString(os.str()));
-            params.alertPrompt = alertPromptHolder.get();
-        }
-
-        int count = 0;
-        while((err == errSecPassphraseRequired || err == errSecInvalidData || err == errSecPkcs12VerifyFailure) &&
-              count < retryMax)
-        {
-            if(prompt)
-            {
-                passphraseHolder.reset(toCFString(prompt->getPassword()));
-                params.passphrase = passphraseHolder.get();
-            }
-            err = SecItemImport(data.get(), path.get(), &format, &importType, 0, &params, keychain, &items.get());
-            ++count;
-        }
-    }
-
-    if(err != noErr)
-    {
-        ostringstream os;
-        os << "IceSSL: error reading " << (type == kSecItemTypePrivateKey ? "private key" : "certificate");
-        os << " `" << file << "':\n" << errorToString(err);
-        throw CertificateReadException(__FILE__, __LINE__, os.str());
-    }
-
-    if(type != kSecItemTypeUnknown && importType != kSecItemTypeAggregate && importType != type)
-    {
-        ostringstream os;
-        os << "IceSSL: error reading " << (type == kSecItemTypePrivateKey ? "private key" : "certificate");
-        os << " `" << file << "' doesn't contain the expected item";
-        throw CertificateReadException(__FILE__, __LINE__, os.str());
-    }
-
-    return items.release();
-}
-
-SecKeychainRef
-openKeychain(const std::string& path, const std::string& keychainPassword)
-{
-    string keychainPath = path;
-    UniqueRef<SecKeychainRef> keychain;
-    OSStatus err = 0;
-    if(keychainPath.empty())
-    {
-        if((err = SecKeychainCopyDefault(&keychain.get())))
-        {
-            throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: unable to retrieve default keychain:\n" + errorToString(err));
-        }
-    }
-    else
-    {
-        //
-        // KeyChain path is relative to the current working directory.
-        //
-        if(!IceUtilInternal::isAbsolutePath(keychainPath))
-        {
-            string cwd;
-            if(IceUtilInternal::getcwd(cwd) == 0)
-            {
-                keychainPath = string(cwd) + '/' + keychainPath;
-            }
-        }
-
-        if((err = SecKeychainOpen(keychainPath.c_str(), &keychain.get())))
-        {
-            throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unable to open keychain: `" +
-                                                keychainPath + "'\n" + errorToString(err));
-        }
-    }
-
-    SecKeychainStatus status;
-    err = SecKeychainGetStatus(keychain.get(), &status);
-    if(err == noErr)
-    {
-        const char* pass = keychainPassword.empty() ? 0 : keychainPassword.c_str();
-        if((err = SecKeychainUnlock(keychain.get(), keychainPassword.size(), pass, pass != 0)))
-        {
-            throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: unable to unlock keychain:\n" + errorToString(err));
-        }
-    }
-    else if(err == errSecNoSuchKeychain)
-    {
-        const char* pass = keychainPassword.empty() ? 0 : keychainPassword.c_str();
-        keychain.reset(0);
-        if((err = SecKeychainCreate(keychainPath.c_str(), keychainPassword.size(), pass, pass == 0, 0, &keychain.get())))
-        {
-            throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: unable to create keychain:\n" + errorToString(err));
-        }
-    }
-    else
-    {
-        throw PluginInitializationException(__FILE__, __LINE__,
-                                            "IceSSL: unable to open keychain:\n" + errorToString(err));
-    }
-
-    //
-    // Set keychain settings to avoid keychain lock.
-    //
-    SecKeychainSettings settings;
-    settings.version = SEC_KEYCHAIN_SETTINGS_VERS1;
-    settings.lockOnSleep = FALSE;
-    settings.useLockInterval = FALSE;
-    settings.lockInterval = INT_MAX;
-    if((err = SecKeychainSetSettings(keychain.get(), &settings)))
-    {
-        throw PluginInitializationException(__FILE__, __LINE__,
-                                            "IceSSL: error setting keychain settings:\n" + errorToString(err));
-    }
-
-    return keychain.release();
-}
-
-//
-// Imports a certificate private key and optionally add it to a keychain.
-//
-SecIdentityRef
-loadPrivateKey(const string& file, SecCertificateRef cert, SecKeychainRef keychain, const string& password,
-               const PasswordPromptPtr& prompt, int retryMax)
-{
-    //
-    // Check if we already imported the certificate
-    //
-    UniqueRef<CFDataRef> hash;
-    UniqueRef<CFDictionaryRef> subjectKeyProperty(getCertificateProperty(cert, kSecOIDSubjectKeyIdentifier));
-    if(subjectKeyProperty)
-    {
-        CFArrayRef values = static_cast<CFArrayRef>(CFDictionaryGetValue(subjectKeyProperty.get(),
-                                                                         kSecPropertyKeyValue));
-        for(int i = 0; i < CFArrayGetCount(values); ++i)
-        {
-            CFDictionaryRef dict = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(values, i));
-            if(CFEqual(CFDictionaryGetValue(dict, kSecPropertyKeyLabel), CFSTR("Key Identifier")))
-            {
-                hash.retain(static_cast<CFDataRef>(CFDictionaryGetValue(dict, kSecPropertyKeyValue)));
-                break;
-            }
-        }
-    }
-
-    const void* values[] = { keychain };
-    UniqueRef<CFArrayRef> searchList(CFArrayCreate(kCFAllocatorDefault, values, 1, &kCFTypeArrayCallBacks));
-
-    UniqueRef<CFMutableDictionaryRef> query(CFDictionaryCreateMutable(0,
-                                                                      0,
-                                                                      &kCFTypeDictionaryKeyCallBacks,
-                                                                      &kCFTypeDictionaryValueCallBacks));
-
-    CFDictionarySetValue(query.get(), kSecClass, kSecClassCertificate);
-    CFDictionarySetValue(query.get(), kSecMatchLimit, kSecMatchLimitOne);
-    CFDictionarySetValue(query.get(), kSecMatchSearchList, searchList.get());
-    CFDictionarySetValue(query.get(), kSecAttrSubjectKeyID, hash.get());
-    CFDictionarySetValue(query.get(), kSecReturnRef, kCFBooleanTrue);
-
-    UniqueRef<CFTypeRef> value(0);
-    OSStatus err = SecItemCopyMatching(query.get(), &value.get());
-    UniqueRef<SecCertificateRef> item(static_cast<SecCertificateRef>(const_cast<void*>(value.release())));
-    if(err == noErr)
-    {
-        //
-        // If the certificate has already been imported, create the
-        // identity. The key should also have been imported.
-        //
-        UniqueRef<SecIdentityRef> identity;
-        err = SecIdentityCreateWithCertificate(keychain, item.get(), &identity.get());
-        if(err != noErr)
-        {
-            ostringstream os;
-            os << "IceSSL: error creating certificate identity:\n" << errorToString(err);
-            throw CertificateReadException(__FILE__, __LINE__, os.str());
-        }
-        return identity.release();
-    }
-    else if(err != errSecItemNotFound)
-    {
-        ostringstream os;
-        os << "IceSSL: error searching for keychain items:\n" << errorToString(err);
-        throw CertificateReadException(__FILE__, __LINE__, os.str());
-    }
-
-    //
-    // If the certificate isn't already in the keychain, load the
-    // private key into the keychain and add the certificate.
-    //
-    UniqueRef<CFArrayRef> items(loadKeychainItems(file, kSecItemTypePrivateKey, keychain, password, prompt, retryMax));
-    int count = CFArrayGetCount(items.get());
-    UniqueRef<SecKeyRef> key;
-    for(int i = 0; i < count; ++i)
-    {
-        SecKeychainItemRef item = 
-            static_cast<SecKeychainItemRef>(const_cast<void*>(CFArrayGetValueAtIndex(items.get(), 0)));
-        if(SecKeyGetTypeID() == CFGetTypeID(item))
-        {
-            key.retain(reinterpret_cast<SecKeyRef>(item));
-            break;
-        }
-    }
-    if(!key)
-    {
-        throw CertificateReadException(__FILE__, __LINE__, "IceSSL: no key in file `" + file + "'");
-    }
-
-    //
-    // Add the certificate to the keychain
-    //
-    query.reset(CFDictionaryCreateMutable(kCFAllocatorDefault,
-                                          0,
-                                          &kCFTypeDictionaryKeyCallBacks,
-                                          &kCFTypeDictionaryValueCallBacks));
-
-    CFDictionarySetValue(query.get(), kSecUseKeychain, keychain);
-    CFDictionarySetValue(query.get(), kSecClass, kSecClassCertificate);
-    CFDictionarySetValue(query.get(), kSecValueRef, cert);
-    CFDictionarySetValue(query.get(), kSecReturnRef, kCFBooleanTrue);
-
-    value.reset(0);
-    err = SecItemAdd(query.get(), static_cast<CFTypeRef*>(&value.get()));
-    UniqueRef<CFArrayRef> added(static_cast<CFArrayRef>(value.release()));
-    if(err != noErr)
-    {
-        ostringstream os;
-        os << "IceSSL: failure adding certificate to keychain\n" << errorToString(err);
-        throw CertificateReadException(__FILE__, __LINE__, os.str());
-    }
-    item.retain(static_cast<SecCertificateRef>(const_cast<void*>(CFArrayGetValueAtIndex(added.get(), 0))));
-
-    //
-    // Create the association between the private  key and the certificate,
-    // kSecKeyLabel attribute should match the subject key identifier.
-    //
-    vector<SecKeychainAttribute> attributes;
-    if(hash)
-    {
-        SecKeychainAttribute attr;
-        attr.tag = kSecKeyLabel;
-        attr.data = const_cast<UInt8*>(CFDataGetBytePtr(hash.get()));
-        attr.length = CFDataGetLength(hash.get());
-        attributes.push_back(attr);
-    }
-
-    //
-    // kSecKeyPrintName attribute correspond to the keychain display
-    // name.
-    //
-    string label;
-    UniqueRef<CFStringRef> commonName(0);
-    if(SecCertificateCopyCommonName(item.get(), &commonName.get()) == noErr)
-    {
-        label = fromCFString(commonName.get());
-        SecKeychainAttribute attr;
-        attr.tag = kSecKeyPrintName;
-        attr.data = const_cast<char*>(label.c_str());
-        attr.length = label.size();
-        attributes.push_back(attr);
-    }
-
-    SecKeychainAttributeList attrs;
-    attrs.attr = &attributes[0];
-    attrs.count = attributes.size();
-    SecKeychainItemModifyAttributesAndData(reinterpret_cast<SecKeychainItemRef>(key.get()), &attrs, 0, 0);
-
-    UniqueRef<SecIdentityRef> identity;
-    err = SecIdentityCreateWithCertificate(keychain, item.get(), &identity.get());
-    if(err != noErr)
-    {
-        ostringstream os;
-        os << "IceSSL: error creating certificate identity:\n" << errorToString(err);
-        throw CertificateReadException(__FILE__, __LINE__, os.str());
-    }
-    return identity.release();
-}
-#else
-
-CFArrayRef
-loadCerts(const string& file)
-{
-    UniqueRef<CFArrayRef> certs(CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks));
-    if(file.find(".pem") != string::npos)
-    {
-        vector<char> buffer;
-        readFile(file, buffer);
-        string strbuf(buffer.begin(), buffer.end());
-        string::size_type size, startpos, endpos = 0;
-        bool first = true;
-        while(true)
-        {
-            startpos = strbuf.find("-----BEGIN CERTIFICATE-----", endpos);
-            if(startpos != string::npos)
-            {
-                startpos += sizeof("-----BEGIN CERTIFICATE-----");
-                endpos = strbuf.find("-----END CERTIFICATE-----", startpos);
-                if(endpos == string::npos)
-                {
-                    InitializationException ex(__FILE__, __LINE__);
-                    ex.reason = "IceSSL: certificate " + file + " is not a valid PEM-encoded certificate";
-                    throw ex;
-                }
-                size = endpos - startpos;
-            }
-            else if(first)
-            {
-                startpos = 0;
-                endpos = string::npos;
-                size = strbuf.size();
-            }
-            else
-            {
-                break;
-            }
-
-            vector<unsigned char> data(IceInternal::Base64::decode(string(&buffer[startpos], size)));
-            UniqueRef<CFDataRef> certdata(CFDataCreate(kCFAllocatorDefault, &data[0], data.size()));
-            UniqueRef<SecCertificateRef> cert(SecCertificateCreateWithData(0, certdata.get()));
-            if(!cert)
-            {
-                InitializationException ex(__FILE__, __LINE__);
-                ex.reason = "IceSSL: certificate " + file + " is not a valid PEM-encoded certificate";
-                throw ex;
-            }
-            CFArrayAppendValue(const_cast<CFMutableArrayRef>(certs.get()), cert.get());
-            first = false;
-        }
-    }
-    else
-    {
-        UniqueRef<CFDataRef> data(readCertFile(file));
-        UniqueRef<SecCertificateRef> cert(SecCertificateCreateWithData(0, data.get()));
-        if(!cert)
-        {
-            InitializationException ex(__FILE__, __LINE__);
-            ex.reason = "IceSSL: certificate " + file + " is not a valid DER-encoded certificate";
-            throw ex;
-        }
-        CFArrayAppendValue(const_cast<CFMutableArrayRef>(certs.get()), cert.get());
-    }
-    return certs.release();
-}
-#endif
-
-}
-
-//
-// Imports a certificate (it might contain an identity or certificate depending on the format).
-//
-CFArrayRef
-IceSSL::loadCertificateChain(const string& file, const string& keyFile, const std::string& keychainPath,
-                             const string& keychainPassword, const string& password, const PasswordPromptPtr& prompt,
-                             int retryMax)
-{
-    UniqueRef<CFArrayRef> chain;
-#if defined(ICE_USE_SECURE_TRANSPORT_IOS)
-    UniqueRef<CFDataRef> cert(readCertFile(file));
-
-    UniqueRef<CFMutableDictionaryRef> settings(CFDictionaryCreateMutable(0,
-                                                                         1,
-                                                                         &kCFTypeDictionaryKeyCallBacks,
-                                                                         &kCFTypeDictionaryValueCallBacks));
-    UniqueRef<CFArrayRef> items;
-    OSStatus err;
-    int count = 0;
-    do
-    {
-        UniqueRef<CFStringRef> pass(toCFString(password.empty() && prompt ? prompt->getPassword() : password));
-        CFDictionarySetValue(settings.get(), kSecImportExportPassphrase, pass.get());
-        err = SecPKCS12Import(cert.get(), settings.get(), &items.get());
-        ++count;
-    }
-    while(password.empty() && prompt && err == errSecAuthFailed && count < retryMax);
-
-    if(err != noErr)
-    {
-        ostringstream os;
-        os << "IceSSL: unable to import certificate from file " << file << " (error = " << err << ")";
-        throw InitializationException(__FILE__, __LINE__, os.str());
-    }
-
-    for(int i = 0; i < CFArrayGetCount(items.get()); ++i)
-    {
-        CFDictionaryRef dict = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(items.get(), i));
-        SecIdentityRef identity = static_cast<SecIdentityRef>(
-            const_cast<void*>(CFDictionaryGetValue(dict, kSecImportItemIdentity)));
-        if(identity)
-        {
-            CFArrayRef certs = static_cast<CFArrayRef>(CFDictionaryGetValue(dict, kSecImportItemCertChain));
-            chain.reset(CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, certs));
-            CFArraySetValueAtIndex(const_cast<CFMutableArrayRef>(chain.get()), 0, identity);
-        }
-    }
-
-    if(!chain)
-    {
-        ostringstream os;
-        os << "IceSSL: couldn't find identity in file " << file;
-        throw InitializationException(__FILE__, __LINE__, os.str());
-    }
-#else
-    UniqueRef<SecKeychainRef> keychain(openKeychain(keychainPath, keychainPassword));
-    if(keyFile.empty())
-    {
-        chain.reset(loadKeychainItems(file, kSecItemTypeUnknown, keychain.get(), password, prompt, retryMax));
-    }
-    else
-    {
-        //
-        // Load the certificate, don't load into the keychain as it
-        // might already have been imported.
-        //
-        UniqueRef<CFArrayRef> items(loadKeychainItems(file, kSecItemTypeCertificate, 0, password, prompt, retryMax));
-        SecCertificateRef cert = 
-            static_cast<SecCertificateRef>(const_cast<void*>(CFArrayGetValueAtIndex(items.get(), 0)));
-        if(SecCertificateGetTypeID() != CFGetTypeID(cert))
-        {
-            ostringstream os;
-            os << "IceSSL: couldn't find certificate in `" << file << "'";
-            throw CertificateReadException(__FILE__, __LINE__, os.str());
-        }
-
-        //
-        // Load the private key for the given certificate. This will
-        // add the certificate/key to the keychain if they aren't
-        // already present in the keychain.
-        //
-        UniqueRef<SecIdentityRef> identity(loadPrivateKey(keyFile, cert, keychain.get(), password, prompt, retryMax));
-        chain.reset(CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, items.get()));
-        CFArraySetValueAtIndex(const_cast<CFMutableArrayRef>(chain.get()), 0, identity.get());
-    }
-#endif
-    return chain.release();
-}
-
-SecCertificateRef
-IceSSL::loadCertificate(const string& file)
-{
-    UniqueRef<SecCertificateRef> cert;
-#if defined(ICE_USE_SECURE_TRANSPORT_IOS)
-    UniqueRef<CFArrayRef> certs(loadCerts(file));
-    assert(CFArrayGetCount(certs.get()) > 0);
-    cert.retain((SecCertificateRef)CFArrayGetValueAtIndex(certs.get(), 0));
-#else
-    UniqueRef<CFArrayRef> items(loadKeychainItems(file, kSecItemTypeCertificate, 0, "", 0, 0));
-    cert.retain((SecCertificateRef)CFArrayGetValueAtIndex(items.get(), 0));
-#endif
-    return cert.release();
-}
-
-CFArrayRef
-IceSSL::loadCACertificates(const string& file)
-{
-#if defined(ICE_USE_SECURE_TRANSPORT_IOS)
-    return loadCerts(file);
-#else
-    UniqueRef<CFArrayRef> items(loadKeychainItems(file, kSecItemTypeCertificate, 0, "", 0, 0));
-    UniqueRef<CFArrayRef> certificateAuthorities(CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks));
-    int count = CFArrayGetCount(items.get());
-    for(CFIndex i = 0; i < count; ++i)
-    {
-        SecCertificateRef cert = 
-            static_cast<SecCertificateRef>(const_cast<void*>(CFArrayGetValueAtIndex(items.get(), i)));
-        assert(SecCertificateGetTypeID() == CFGetTypeID(cert));
-        if(isCA(cert))
-        {
-            CFArrayAppendValue(const_cast<CFMutableArrayRef>(certificateAuthorities.get()), cert);
-        }
-    }
-    return certificateAuthorities.release();
-#endif
-}
-
-CFArrayRef
-IceSSL::findCertificateChain(const std::string& keychainPath, const std::string& keychainPassword, const string& value)
-{
-    //
-    //  Search the keychain using key:value pairs. The following keys are supported:
-    //
-    //   Label
-    //   Serial
-    //   Subject
-    //   SubjectKeyId
-    //
-    //   A value must be enclosed in single or double quotes if it contains whitespace.
-    //
-    UniqueRef<CFMutableDictionaryRef> query(CFDictionaryCreateMutable(0,
-                                                                      0,
-                                                                      &kCFTypeDictionaryKeyCallBacks,
-                                                                      &kCFTypeDictionaryValueCallBacks));
-
-#if defined(ICE_USE_SECURE_TRANSPORT_MACOS)
-    UniqueRef<SecKeychainRef> keychain(openKeychain(keychainPath, keychainPassword));
-    const void* values[] = { keychain.get() };
-    UniqueRef<CFArrayRef> searchList(CFArrayCreate(kCFAllocatorDefault, values, 1, &kCFTypeArrayCallBacks));
-    CFDictionarySetValue(query.get(), kSecMatchSearchList, searchList.get());
-#endif
-    CFDictionarySetValue(query.get(), kSecMatchLimit, kSecMatchLimitOne);
-    CFDictionarySetValue(query.get(), kSecClass, kSecClassCertificate);
-    CFDictionarySetValue(query.get(), kSecReturnRef, kCFBooleanTrue);
-    CFDictionarySetValue(query.get(), kSecMatchCaseInsensitive, kCFBooleanTrue);
-
-    size_t start = 0;
-    size_t pos;
-    bool valid = false;
-    while((pos = value.find(':', start)) != string::npos)
-    {
-        string field = IceUtilInternal::toUpper(IceUtilInternal::trim(value.substr(start, pos - start)));
-        string arg;
-        if(field != "LABEL" && field != "SERIAL" && field != "SUBJECT" && field != "SUBJECTKEYID")
-        {
-            throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unknown key in `" + value + "'");
-        }
-
-        start = pos + 1;
-        while(start < value.size() && (value[start] == ' ' || value[start] == '\t'))
-        {
-            ++start;
-        }
-
-        if(start == value.size())
-        {
-            throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: missing argument in `" + value + "'");
-        }
-
-        if(value[start] == '"' || value[start] == '\'')
-        {
-            size_t end = start;
-            ++end;
-            while(end < value.size())
-            {
-                if(value[end] == value[start] && value[end - 1] != '\\')
-                {
-                    break;
-                }
-                ++end;
-            }
-            if(end == value.size() || value[end] != value[start])
-            {
-                throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unmatched quote in `" + value + "'");
-            }
-            ++start;
-            arg = value.substr(start, end - start);
-            start = end + 1;
-        }
-        else
-        {
-            size_t end = value.find_first_of(" \t", start);
-            if(end == string::npos)
-            {
-                arg = value.substr(start);
-                start = value.size();
-            }
-            else
-            {
-                arg = value.substr(start, end - start);
-                start = end + 1;
-            }
-        }
-
-        if(field == "SUBJECT" || field == "LABEL")
-        {
-            UniqueRef<CFStringRef> v(toCFString(arg));
-            CFDictionarySetValue(query.get(), field == "LABEL" ? kSecAttrLabel : kSecMatchSubjectContains, v.get());
-            valid = true;
-        }
-        else if(field == "SUBJECTKEYID" || field == "SERIAL")
-        {
-            vector<unsigned char> buffer;
-            if(!parseBytes(arg, buffer))
-            {
-                throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: invalid value `" + value + "'");
-            }
-            UniqueRef<CFDataRef> v(CFDataCreate(kCFAllocatorDefault, &buffer[0], buffer.size()));
-            CFDictionarySetValue(query.get(), field == "SUBJECTKEYID" ? kSecAttrSubjectKeyID : kSecAttrSerialNumber,
-                                 v.get());
-            valid = true;
-        }
-    }
-
-    if(!valid)
-    {
-        throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: invalid value `" + value + "'");
-    }
-
-    UniqueRef<SecCertificateRef> cert;
-    OSStatus err = SecItemCopyMatching(query.get(), (CFTypeRef*)&cert.get());
-    if(err != noErr)
-    {
-        throw PluginInitializationException(__FILE__, __LINE__,
-                                            "IceSSL: find certificate `" + value + "' failed:\n" + errorToString(err));
-    }
-
-    //
-    // Retrieve the certificate chain
-    //
-    UniqueRef<SecPolicyRef> policy(SecPolicyCreateSSL(true, 0));
-    UniqueRef<SecTrustRef> trust;
-    err = SecTrustCreateWithCertificates(reinterpret_cast<CFArrayRef>(cert.get()), policy.get(), &trust.get());
-    if(err || !trust)
-    {
-        throw PluginInitializationException(__FILE__, __LINE__,
-                                            "IceSSL: error creating trust object" +
-                                            (err ? ":\n" + errorToString(err) : ""));
-    }
-
-    SecTrustResultType trustResult;
-    if((err = SecTrustEvaluate(trust.get(), &trustResult)))
-    {
-        throw PluginInitializationException(__FILE__, __LINE__,
-                                            "IceSSL: error evaluating trust:\n" + errorToString(err));
-    }
-
-    int chainLength = SecTrustGetCertificateCount(trust.get());
-    UniqueRef<CFArrayRef> items(CFArrayCreateMutable(kCFAllocatorDefault, chainLength, &kCFTypeArrayCallBacks));
-    for(int i = 0; i < chainLength; ++i)
-    {
-        CFArrayAppendValue(const_cast<CFMutableArrayRef>(items.get()), SecTrustGetCertificateAtIndex(trust.get(), i));
-    }
-
-    //
-    // Replace the first certificate in the chain with the
-    // identity.
-    //
-    UniqueRef<SecIdentityRef> identity;
-#if defined(ICE_USE_SECURE_TRANSPORT_IOS)
-
-    //
-    // SecIdentityCreateWithCertificate isn't supported on iOS so we lookup the identity
-    // using the certicate label. If the user added the identity with SecItemAdd the
-    // identity has the same label as the certificate.
-    //
-    query.reset(CFDictionaryCreateMutable(0, 1, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
-    CFDictionarySetValue(query.get(), kSecClass, kSecClassCertificate);
-    CFDictionarySetValue(query.get(), kSecValueRef, cert.get());
-    CFDictionarySetValue(query.get(), kSecReturnAttributes, kCFBooleanTrue);
-    UniqueRef<CFDictionaryRef> attributes;
-    err = SecItemCopyMatching(query.get(), reinterpret_cast<CFTypeRef*>(&attributes.get()));
-    if(err != noErr)
-    {
-        ostringstream os;
-        os << "IceSSL: couldn't create identity for certificate found in the keychain:\n" << errorToString(err);
-        throw PluginInitializationException(__FILE__, __LINE__, os.str());
-    }
-
-    // Now lookup the identity with the label
-    query.reset(CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
-    CFDictionarySetValue(query.get(), kSecMatchLimit, kSecMatchLimitOne);
-    CFDictionarySetValue(query.get(), kSecClass, kSecClassIdentity);
-    CFDictionarySetValue(query.get(), kSecAttrLabel, (CFDataRef)CFDictionaryGetValue(attributes.get(), kSecAttrLabel));
-    CFDictionarySetValue(query.get(), kSecReturnRef, kCFBooleanTrue);
-    err = SecItemCopyMatching(query.get(), (CFTypeRef*)&identity.get());
-    if(err == noErr)
-    {
-        UniqueRef<SecCertificateRef> cert2;
-        if((err = SecIdentityCopyCertificate(identity.get(), &cert2.get())) == noErr)
-        {
-            err = CFEqual(cert2.get(), cert.get()) ? noErr : errSecItemNotFound;
-        }
-    }
-#else
-    err = SecIdentityCreateWithCertificate(keychain.get(), cert.get(), &identity.get());
-#endif
-    if(err != noErr)
-    {
-        ostringstream os;
-        os << "IceSSL: couldn't create identity for certificate found in the keychain:\n" << errorToString(err);
-        throw PluginInitializationException(__FILE__, __LINE__, os.str());
-    }
-    CFArraySetValueAtIndex(const_cast<CFMutableArrayRef>(items.get()), 0, identity.get());
-    return items.release();
-}
-
-#elif defined(ICE_USE_SCHANNEL)
-
-namespace
-{
-
-void
-addMatchingCertificates(HCERTSTORE source, HCERTSTORE target, DWORD findType, const void* findParam)
-{
-    PCCERT_CONTEXT next = 0;
-    do
-    {
-        if((next = CertFindCertificateInStore(source, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0,
-                                              findType, findParam, next)))
-        {
-            if(!CertAddCertificateContextToStore(target, next, CERT_STORE_ADD_ALWAYS, 0))
-            {
-                throw PluginInitializationException(__FILE__, __LINE__,
-                    "IceSSL: error adding certificate to store:\n" + IceUtilInternal::lastErrorToString());
-            }
-        }
-    }
-    while(next);
-}
-
-}
-
-vector<PCCERT_CONTEXT>
-IceSSL::findCertificates(const string& location, const string& name, const string& value, vector<HCERTSTORE>& stores)
-{
-    DWORD storeLoc;
-    if(location == "CurrentUser")
-    {
-        storeLoc = CERT_SYSTEM_STORE_CURRENT_USER;
-    }
-    else
-    {
-        storeLoc = CERT_SYSTEM_STORE_LOCAL_MACHINE;
-    }
-
-    HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, 0, storeLoc, Ice::stringToWstring(name).c_str());
-    if(!store)
-    {
-        throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: failed to open certificate store `" + name +
-                                            "':\n" + IceUtilInternal::lastErrorToString());
-    }
-
-    //
-    // Start with all of the certificates in the collection and filter as necessary.
-    //
-    // - If the value is "*", return all certificates.
-    // - Otherwise, search using key:value pairs. The following keys are supported:
-    //
-    //   Issuer
-    //   IssuerDN
-    //   Serial
-    //   Subject
-    //   SubjectDN
-    //   SubjectKeyId
-    //   Thumbprint
-    //
-    //   A value must be enclosed in single or double quotes if it contains whitespace.
-    //
-    HCERTSTORE tmpStore = 0;
-    try
-    {
-        if(value != "*")
-        {
-            if(value.find(':', 0) == string::npos)
-            {
-                throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: no key in `" + value + "'");
-            }
-            size_t start = 0;
-            size_t pos;
-            while((pos = value.find(':', start)) != string::npos)
-            {
-                string field = IceUtilInternal::toUpper(IceUtilInternal::trim(value.substr(start, pos - start)));
-                if(field != "SUBJECT" && field != "SUBJECTDN" && field != "ISSUER" && field != "ISSUERDN" &&
-                   field != "THUMBPRINT" && field != "SUBJECTKEYID" && field != "SERIAL")
-                {
-                    throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unknown key in `" + value + "'");
-                }
-
-                start = pos + 1;
-                while(start < value.size() && (value[start] == ' ' || value[start] == '\t'))
-                {
-                    ++start;
-                }
-
-                if(start == value.size())
-                {
-                    throw PluginInitializationException(__FILE__, __LINE__,
-                                                        "IceSSL: missing argument in `" + value + "'");
-                }
-
-                string arg;
-                if(value[start] == '"' || value[start] == '\'')
-                {
-                    size_t end = start;
-                    ++end;
-                    while(end < value.size())
-                    {
-                        if(value[end] == value[start] && value[end - 1] != '\\')
-                        {
-                            break;
-                        }
-                        ++end;
-                    }
-                    if(end == value.size() || value[end] != value[start])
-                    {
-                        throw PluginInitializationException(__FILE__, __LINE__,
-                                                            "IceSSL: unmatched quote in `" + value + "'");
-                    }
-                    ++start;
-                    arg = value.substr(start, end - start);
-                    start = end + 1;
-                }
-                else
-                {
-                    size_t end = value.find_first_of(" \t", start);
-                    if(end == string::npos)
-                    {
-                        arg = value.substr(start);
-                        start = value.size();
-                    }
-                    else
-                    {
-                        arg = value.substr(start, end - start);
-                        start = end + 1;
-                    }
-                }
-
-                tmpStore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, 0, 0);
-                if(!tmpStore)
-                {
-                    throw PluginInitializationException(__FILE__, __LINE__,
-                                "IceSSL: error adding certificate to store:\n" + IceUtilInternal::lastErrorToString());
-                }
-
-                if(field == "SUBJECT" || field == "ISSUER")
-                {
-                    const wstring argW = Ice::stringToWstring(arg);
-                    DWORD findType = field == "SUBJECT" ? CERT_FIND_SUBJECT_STR : CERT_FIND_ISSUER_STR;
-                    addMatchingCertificates(store, tmpStore, findType, argW.c_str());
-                }
-                else if(field == "SUBJECTDN" || field == "ISSUERDN")
-                {
-                    const wstring argW = Ice::stringToWstring(arg);
-                    DWORD flags[] = {
-                        CERT_OID_NAME_STR,
-                        CERT_OID_NAME_STR | CERT_NAME_STR_REVERSE_FLAG,
-                        CERT_OID_NAME_STR | CERT_NAME_STR_FORCE_UTF8_DIR_STR_FLAG,
-                        CERT_OID_NAME_STR | CERT_NAME_STR_FORCE_UTF8_DIR_STR_FLAG | CERT_NAME_STR_REVERSE_FLAG
-                    };
-                    for(size_t i = 0; i < sizeof(flags) / sizeof(DWORD); ++i)
-                    {
-                        DWORD length = 0;
-                        if(!CertStrToNameW(X509_ASN_ENCODING, argW.c_str(), flags[i], 0, 0, &length, 0))
-                        {
-                            throw PluginInitializationException(
-                                __FILE__, __LINE__,
-                                "IceSSL: invalid value `" + value + "' for `IceSSL.FindCert' property:\n" +
-                                IceUtilInternal::lastErrorToString());
-                        }
-
-                        vector<BYTE> buffer(length);
-                        if(!CertStrToNameW(X509_ASN_ENCODING, argW.c_str(), flags[i], 0, &buffer[0], &length, 0))
-                        {
-                            throw PluginInitializationException(
-                                __FILE__, __LINE__,
-                                "IceSSL: invalid value `" + value + "' for `IceSSL.FindCert' property:\n" +
-                                IceUtilInternal::lastErrorToString());
-                        }
-
-                        CERT_NAME_BLOB name = { length, &buffer[0] };
-
-                        DWORD findType = field == "SUBJECTDN" ? CERT_FIND_SUBJECT_NAME : CERT_FIND_ISSUER_NAME;
-                        addMatchingCertificates(store, tmpStore, findType, &name);
-                    }
-                }
-                else if(field == "THUMBPRINT" || field == "SUBJECTKEYID")
-                {
-                    vector<BYTE> buffer;
-                    if(!parseBytes(arg, buffer))
-                    {
-                        throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: invalid `IceSSL.FindCert' property: can't decode the value");
-                    }
-
-                    CRYPT_HASH_BLOB hash = { static_cast<DWORD>(buffer.size()), &buffer[0] };
-                    DWORD findType = field == "THUMBPRINT" ? CERT_FIND_HASH : CERT_FIND_KEY_IDENTIFIER;
-                    addMatchingCertificates(store, tmpStore, findType, &hash);
-                }
-                else if(field == "SERIAL")
-                {
-                    vector<BYTE> buffer;
-                    if(!parseBytes(arg, buffer))
-                    {
-                        throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: invalid value `" + value + "' for `IceSSL.FindCert' property");
-                    }
-
-                    CRYPT_INTEGER_BLOB serial = { static_cast<DWORD>(buffer.size()), &buffer[0] };
-                    PCCERT_CONTEXT next = 0;
-                    do
-                    {
-                        if((next = CertFindCertificateInStore(store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0,
-                                                              CERT_FIND_ANY, 0, next)))
-                        {
-                            if(CertCompareIntegerBlob(&serial, &next->pCertInfo->SerialNumber))
-                            {
-                                if(!CertAddCertificateContextToStore(tmpStore, next, CERT_STORE_ADD_ALWAYS, 0))
-                                {
-                                    throw PluginInitializationException(__FILE__, __LINE__,
-                                                                    "IceSSL: error adding certificate to store:\n" +
-                                                                    IceUtilInternal::lastErrorToString());
-                                }
-                            }
-                        }
-                    }
-                    while(next);
-                }
-                CertCloseStore(store, 0);
-                store = tmpStore;
-            }
-        }
-    }
-    catch(...)
-    {
-        if(store && store != tmpStore)
-        {
-            CertCloseStore(store, 0);
-        }
-
-        if(tmpStore)
-        {
-            CertCloseStore(tmpStore, 0);
-            tmpStore = 0;
-        }
-        throw;
-    }
-
-    vector<PCCERT_CONTEXT> certs;
-    if(store)
-    {
-        PCCERT_CONTEXT next = 0;
-        do
-        {
-            if((next = CertFindCertificateInStore(store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, CERT_FIND_ANY, 0,
-                                                  next)))
-            {
-                certs.push_back(next);
-            }
-        }
-        while(next);
-        stores.push_back(store);
-    }
-    return certs;
-}
-#elif defined (ICE_OS_UWP)
-
-namespace
-{
-
-//
-// Find a certificate in the Application Personal certificate store
-// with the given friendly name. Returns the matching certificate or
-// nullptr if none is found.
-//
-Certificates::Certificate^
-findPersonalCertificate(String^ friendlyName)
-{
-    CertificateQuery^ query = ref new CertificateQuery();
-    query->IncludeDuplicates = true;
-    query->IncludeExpiredCertificates = true;
-    query->FriendlyName = friendlyName;
-    query->StoreName = StandardCertificateStoreNames::Personal;
-
-    try
-    {
-        auto certificates = IceInternal::runSync(CertificateStores::FindAllAsync(query));
-        return certificates->Size > 0 ? certificates->GetAt(0) : nullptr; 
-    }
-    catch(Platform::Exception^ ex)
-    {
-        throw PluginInitializationException(__FILE__, __LINE__,
-                                            "IceSSL: certificate error:\n" + wstringToString(ex->Message->Data()));
-    }
-}
-
-//
-// Import a certificate in the Application Personal certificate store
-// with the given friendly name. Returns true if there was a password
-// error and false otherwise. If the import fails because a different
-// error PluginInitializationException exception is throw.
-//
-bool
-importPfxData(String^ friendlyName, String^ data, String^ password)
-{
-    try
-    {
-        IceInternal::runSync(CertificateEnrollmentManager::ImportPfxDataAsync(
-            data,
-            password,
-            ExportOption::NotExportable,
-            KeyProtectionLevel::NoConsent,
-            InstallOptions::None,
-            friendlyName));
-        return false; // The import succcess
-    }
-    catch(Platform::Exception^ ex)
-    {
-        if(HRESULT_CODE(ex->HResult) == ERROR_DECRYPTION_FAILED)
-        {
-            return true; // Password error
-        }
-        else
-        {
-            throw PluginInitializationException(__FILE__, __LINE__, 
-                                                "IceSSL: certificate error:\n" + wstringToString(ex->Message->Data()));
-        }
-    }
-}
-
-}
-
-Certificates::Certificate^
-IceSSL::importPersonalCertificate(const string& file, function<string ()> password, bool passwordPrompt,
-                                  int passwordRetryMax)
-{
-    auto uri = ref new Uri(ref new String(stringToWstring(file).c_str()));
-    try
-    {
-        auto file = IceInternal::runSync(StorageFile::GetFileFromApplicationUriAsync(uri));
-        auto buffer = IceInternal::runSync(FileIO::ReadBufferAsync(file));
-
-        //
-        // Create a hash of the certificate to use as a friendly name, this will allow us
-        // to uniquely identify the certificate in the store.
-        //
-        auto hasher = HashAlgorithmProvider::OpenAlgorithm(HashAlgorithmNames::Sha1);
-        auto hash = hasher->CreateHash();
-
-        hash->Append(buffer);
-        String^ friendlyName = CryptographicBuffer::EncodeToBase64String(hash->GetValueAndReset());
-
-        //
-        // If the certificate is already in the store we avoid importing it.
-        //
-        Certificates::Certificate^ cert = findPersonalCertificate(friendlyName);
-        if(cert)
-        {
-            return cert;
-        }
-        else
-        {
-            String^ data = CryptographicBuffer::EncodeToBase64String(buffer);
-            int count = 0;
-            bool passwordErr = false;
-            do
-            {
-                passwordErr = importPfxData(friendlyName, data,
-                                            ref new String(stringToWstring(password()).c_str()));
-            }
-            while(passwordPrompt && passwordErr && ++count < passwordRetryMax);
-            if(passwordErr)
-            {
-                throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: error decoding certificate");
-            }
-            return findPersonalCertificate(friendlyName);
-        }
-    }
-    catch(Platform::Exception^ ex)
-    {
-        if(HRESULT_CODE(ex->HResult) == ERROR_FILE_NOT_FOUND)
-        {
-            throw PluginInitializationException(__FILE__, __LINE__, "certificate file not found:\n" + file);
-        }
-        else
-        {
-            throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: certificate error:\n" + wstringToString(ex->Message->Data()));
-        }
-    }
-}
-
-IVectorView<Certificates::Certificate^>^
-IceSSL::findCertificates(const string& name, const string& value)
-{
-    CertificateQuery^ query = ref new CertificateQuery();
-    query->StoreName = ref new String(stringToWstring(name).c_str());
-    query->IncludeDuplicates = true;
-    query->IncludeExpiredCertificates = true;
-
-    if(value != "*")
-    {
-        if(value.find(':', 0) == string::npos)
-        {
-            throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: no key in `" + value + "'");
-        }
-        size_t start = 0;
-        size_t pos;
-        while((pos = value.find(':', start)) != string::npos)
-        {
-            string field = IceUtilInternal::toUpper(IceUtilInternal::trim(value.substr(start, pos - start)));
-            if(field != "ISSUER" && field != "THUMBPRINT" && field != "FRIENDLYNAME")
-            {
-                throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unknown key in `" + value + "'");
-            }
-
-            start = pos + 1;
-            while(start < value.size() && (value[start] == ' ' || value[start] == '\t'))
-            {
-                ++start;
-            }
-
-            if(start == value.size())
-            {
-                throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: missing argument in `" + value + "'");
-            }
-
-            string arg;
-            if(value[start] == '"' || value[start] == '\'')
-            {
-                size_t end = start;
-                ++end;
-                while(end < value.size())
-                {
-                    if(value[end] == value[start] && value[end - 1] != '\\')
-                    {
-                        break;
-                    }
-                    ++end;
-                }
-                if(end == value.size() || value[end] != value[start])
-                {
-                    throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unmatched quote in `" + value + "'");
-                }
-                ++start;
-                arg = value.substr(start, end - start);
-                start = end + 1;
-            }
-            else
-            {
-                size_t end = value.find_first_of(" \t", start);
-                if(end == string::npos)
-                {
-                    arg = value.substr(start);
-                    start = value.size();
-                }
-                else
-                {
-                    arg = value.substr(start, end - start);
-                    start = end + 1;
-                }
-            }
-
-            if(field == "ISSUER")
-            {
-                query->IssuerName = ref new String(stringToWstring(arg).c_str());
-            }
-            else if(field == "FRIENDLYNAME")
-            {
-                query->FriendlyName = ref new String(stringToWstring(arg).c_str());
-            }
-            else if(field == "THUMBPRINT")
-            {
-                vector<BYTE> buffer;
-                if(!parseBytes(arg, buffer))
-                {
-                    throw PluginInitializationException(__FILE__, __LINE__,
-                        "IceSSL: invalid `IceSSL.FindCert' property: can't decode the value");
-                }
-                query->Thumbprint = ref new Array<unsigned char>(&buffer[0], static_cast<unsigned int>(buffer.size()));
-            }
-        }
-    }
-
-    try
-    {
-        return IceInternal::runSync(CertificateStores::FindAllAsync(query));
-    }
-    catch(Platform::Exception^ ex)
-    {
-        throw PluginInitializationException(__FILE__, __LINE__,
-                                            "IceSSL: certificate error:\n" + wstringToString(ex->Message->Data()));
-    }
-}
-#endif
-
 void
 IceSSL::readFile(const string& file, vector<char>& buffer)
 {