diff --git a/include/mbedtls/asn1write.h b/include/mbedtls/asn1write.h
index f76fc80..40c5d97 100644
--- a/include/mbedtls/asn1write.h
+++ b/include/mbedtls/asn1write.h
@@ -153,6 +153,21 @@
 int mbedtls_asn1_write_int( unsigned char **p, unsigned char *start, int val );
 
 /**
+ * \brief           Write a given string tag and
+ *                  value in ASN.1 format
+ *                  Note: function works backwards in data buffer
+ *
+ * \param p         reference to current position pointer
+ * \param start     start of the buffer (for bounds-checking)
+ * \param tag       the tag to write
+ * \param text      the text to write
+ * \param text_len  length of the text
+ *
+ * \return          the length written or a negative error code
+ */
+int mbedtls_asn1_write_any_string( unsigned char **p, unsigned char *start,
+                                 int tag, const char *text, size_t text_len );
+/**
  * \brief           Write a printable string tag (MBEDTLS_ASN1_PRINTABLE_STRING) and
  *                  value in ASN.1 format
  *                  Note: function works backwards in data buffer
@@ -168,6 +183,21 @@
                                  const char *text, size_t text_len );
 
 /**
+ * \brief           Write a UTF8 string tag (MBEDTLS_ASN1_UTF8_STRING) and
+ *                  value in ASN.1 format
+ *                  Note: function works backwards in data buffer
+ *
+ * \param p         reference to current position pointer
+ * \param start     start of the buffer (for bounds-checking)
+ * \param text      the text to write
+ * \param text_len  length of the text
+ *
+ * \return          the length written or a negative error code
+ */
+int mbedtls_asn1_write_utf8_string( unsigned char **p, unsigned char *start,
+                                 const char *text, size_t text_len );
+
+/**
  * \brief           Write an IA5 string tag (MBEDTLS_ASN1_IA5_STRING) and
  *                  value in ASN.1 format
  *                  Note: function works backwards in data buffer
diff --git a/include/mbedtls/dhm.h b/include/mbedtls/dhm.h
index f848e22..75317a8 100644
--- a/include/mbedtls/dhm.h
+++ b/include/mbedtls/dhm.h
@@ -1,12 +1,12 @@
 /**
  * \file dhm.h
  *
- * \brief   This file contains Diffie-Hellman-Merkle (DHM) key exchange 
+ * \brief   This file contains Diffie-Hellman-Merkle (DHM) key exchange
  *          definitions and functions.
  *
  * Diffie-Hellman-Merkle (DHM) key exchange is defined in
- * <em>RFC-2631: Diffie-Hellman Key Agreement Method</em> and 
- * <em>Public-Key Cryptography Standards (PKCS) #3: Diffie 
+ * <em>RFC-2631: Diffie-Hellman Key Agreement Method</em> and
+ * <em>Public-Key Cryptography Standards (PKCS) #3: Diffie
  * Hellman Key Agreement Standard</em>.
  *
  * <em>RFC-3526: More Modular Exponential (MODP) Diffie-Hellman groups for
diff --git a/include/mbedtls/ecdh.h b/include/mbedtls/ecdh.h
index 922f029..5fdf55a 100644
--- a/include/mbedtls/ecdh.h
+++ b/include/mbedtls/ecdh.h
@@ -2,8 +2,8 @@
  * \file ecdh.h
  *
  * \brief This file contains ECDH definitions and functions.
- * 
- * The Elliptic Curve Diffie-Hellman (ECDH) protocol is an anonymous 
+ *
+ * The Elliptic Curve Diffie-Hellman (ECDH) protocol is an anonymous
  * key agreement protocol allowing two parties to establish a shared
  * secret over an insecure channel. Each party must have an
  * elliptic-curve public–private key pair.
diff --git a/include/mbedtls/ecp_internal.h b/include/mbedtls/ecp_internal.h
index 8a6d517..1804069 100644
--- a/include/mbedtls/ecp_internal.h
+++ b/include/mbedtls/ecp_internal.h
@@ -48,7 +48,7 @@
  * [6] Digital Signature Standard (DSS), FIPS 186-4.
  *     <http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf>
  *
- * [7] Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer 
+ * [7] Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer
  *     Security (TLS), RFC 4492.
  *     <https://tools.ietf.org/search/rfc4492>
  *
diff --git a/include/mbedtls/entropy.h b/include/mbedtls/entropy.h
index fcb4d02..a5cb05a 100644
--- a/include/mbedtls/entropy.h
+++ b/include/mbedtls/entropy.h
@@ -166,7 +166,7 @@
  * \param threshold Minimum required from source before entropy is released
  *                  ( with mbedtls_entropy_func() ) (in bytes)
  * \param strong    MBEDTLS_ENTROPY_SOURCE_STRONG or
- *                  MBEDTSL_ENTROPY_SOURCE_WEAK.
+ *                  MBEDTLS_ENTROPY_SOURCE_WEAK.
  *                  At least one strong source needs to be added.
  *                  Weaker sources (such as the cycle counter) can be used as
  *                  a complement.
diff --git a/include/mbedtls/gcm.h b/include/mbedtls/gcm.h
index 3c22033..bec5577 100644
--- a/include/mbedtls/gcm.h
+++ b/include/mbedtls/gcm.h
@@ -116,7 +116,7 @@
  * \param ctx       The GCM context to use for encryption or decryption.
  * \param mode      The operation to perform: #MBEDTLS_GCM_ENCRYPT or
  *                  #MBEDTLS_GCM_DECRYPT.
- * \param length    The length of the input data. This must be a multiple of 
+ * \param length    The length of the input data. This must be a multiple of
  *                  16 except in the last call before mbedtls_gcm_finish().
  * \param iv        The initialization vector.
  * \param iv_len    The length of the IV.
diff --git a/include/mbedtls/platform.h b/include/mbedtls/platform.h
index a53229b..bba7709 100644
--- a/include/mbedtls/platform.h
+++ b/include/mbedtls/platform.h
@@ -9,7 +9,7 @@
  *        system services, making the library easier to port and embed.
  *        Application developers and users of the library can provide their own
  *        implementations of these functions, or implementations specific to
- *        their platform, which can be statically linked to the library or 
+ *        their platform, which can be statically linked to the library or
  *        dynamically configured at runtime.
  */
 /*
@@ -331,7 +331,7 @@
  * \note    This function should be called before any other library functions.
  *
  *          Its implementation is platform-specific, and unless
- *          platform-specific code is provided, it does nothing. 
+ *          platform-specific code is provided, it does nothing.
  *
  * \note    The usage and necessity of this function is dependent on the platform.
  *
diff --git a/include/mbedtls/rsa.h b/include/mbedtls/rsa.h
index df6e3e5..19eb2ee 100644
--- a/include/mbedtls/rsa.h
+++ b/include/mbedtls/rsa.h
@@ -5,7 +5,7 @@
  *
  * The RSA public-key cryptosystem is defined in <em>Public-Key
  * Cryptography Standards (PKCS) #1 v1.5: RSA Encryption</em>
- * and <em>Public-Key Cryptography Standards (PKCS) #1 v2.1: 
+ * and <em>Public-Key Cryptography Standards (PKCS) #1 v2.1:
  * RSA Cryptography Specifications</em>.
  *
  */
@@ -781,7 +781,7 @@
  * \param olen       The length of the plaintext.
  * \param input      The buffer holding the encrypted data.
  * \param output     The buffer to hold the plaintext.
- * \param output_max_len    The maximum length of the output buffer. 
+ * \param output_max_len    The maximum length of the output buffer.
  *
  * \return         \c 0 on success.
  * \return         An \c MBEDTLS_ERR_RSA_XXX error code on failure.
diff --git a/include/mbedtls/sha1.h b/include/mbedtls/sha1.h
index 8f805fb..65a124c 100644
--- a/include/mbedtls/sha1.h
+++ b/include/mbedtls/sha1.h
@@ -3,7 +3,7 @@
  *
  * \brief This file contains SHA-1 definitions and functions.
  *
- * The Secure Hash Algorithm 1 (SHA-1) cryptographic hash function is defined in 
+ * The Secure Hash Algorithm 1 (SHA-1) cryptographic hash function is defined in
  * <em>FIPS 180-4: Secure Hash Standard (SHS)</em>.
  *
  * \warning   SHA-1 is considered a weak message digest and its use constitutes
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index bb9c02d..f91066d 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -1854,21 +1854,21 @@
 
 #if defined(MBEDTLS_X509_CRT_PARSE_C)
 /**
- * \brief          Set or reset the hostname to check against the received 
- *                 server certificate. It sets the ServerName TLS extension, 
+ * \brief          Set or reset the hostname to check against the received
+ *                 server certificate. It sets the ServerName TLS extension,
  *                 too, if that extension is enabled. (client-side only)
  *
  * \param ssl      SSL context
  * \param hostname the server hostname, may be NULL to clear hostname
- 
+
  * \note           Maximum hostname length MBEDTLS_SSL_MAX_HOST_NAME_LEN.
  *
- * \return         0 if successful, MBEDTLS_ERR_SSL_ALLOC_FAILED on 
- *                 allocation failure, MBEDTLS_ERR_SSL_BAD_INPUT_DATA on 
+ * \return         0 if successful, MBEDTLS_ERR_SSL_ALLOC_FAILED on
+ *                 allocation failure, MBEDTLS_ERR_SSL_BAD_INPUT_DATA on
  *                 too long input hostname.
  *
  *                 Hostname set to the one provided on success (cleared
- *                 when NULL). On allocation failure hostname is cleared. 
+ *                 when NULL). On allocation failure hostname is cleared.
  *                 On too long input failure, old hostname is unchanged.
  */
 int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname );
diff --git a/include/mbedtls/ssl_ciphersuites.h b/include/mbedtls/ssl_ciphersuites.h
index 545468a..1d2aabc 100644
--- a/include/mbedtls/ssl_ciphersuites.h
+++ b/include/mbedtls/ssl_ciphersuites.h
@@ -267,7 +267,7 @@
     defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED)      ||       \
     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED)     ||       \
     defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)    ||       \
-    defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) 
+    defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
 #define MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED
 #endif