diff --git a/ChangeLog b/ChangeLog
index e3e77f2..51478d5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,14 @@
 
 = mbed TLS X.X.X branch released XXXX-XX-XX
 
+New deprecations
+   * Deprecate MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO that enables parsing
+     SSLv2 ClientHello messages.
+   * Deprecate MBEDTLS_SSL_PROTO_SSL3 that enables support for SSLv3.
+   * Deprecate for MBEDTLS_PKCS11_C, the wrapper around the pkcs11-helper
+     library which allows TLS authentication to use keys stored in a
+     PKCS#11 token such as a smartcard.
+
 Bugfix
    * Allow loading symlinked certificates. Fixes #3005. Reported and fixed
      by Jonathan Bennett <JBennett@incomsystems.biz> via #3008.
diff --git a/crypto b/crypto
index 1146b4e..819799c 160000
--- a/crypto
+++ b/crypto
@@ -1 +1 @@
-Subproject commit 1146b4e06011b69a6437e6b728f2af043a06ec19
+Subproject commit 819799cfc68e4c4381673a8a27af19802c8263f2
diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index 6ebe6b7..ec11426 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -342,6 +342,14 @@
 #error "MBEDTLS_PKCS11_C defined, but not all prerequisites"
 #endif
 
+#if defined(MBEDTLS_PKCS11_C)
+#if defined(MBEDTLS_DEPRECATED_REMOVED)
+#error "MBEDTLS_PKCS11_C is deprecated and will be removed in a future version of Mbed TLS"
+#elif defined(MBEDTLS_DEPRECATED_WARNING)
+#warning "MBEDTLS_PKCS11_C is deprecated and will be removed in a future version of Mbed TLS"
+#endif
+#endif /* MBEDTLS_PKCS11_C */
+
 #if defined(MBEDTLS_PLATFORM_EXIT_ALT) && !defined(MBEDTLS_PLATFORM_C)
 #error "MBEDTLS_PLATFORM_EXIT_ALT defined, but not all prerequisites"
 #endif
@@ -774,6 +782,22 @@
 #error "MBEDTLS_HAVE_INT32/MBEDTLS_HAVE_INT64 and MBEDTLS_HAVE_ASM cannot be defined simultaneously"
 #endif /* (MBEDTLS_HAVE_INT32 || MBEDTLS_HAVE_INT64) && MBEDTLS_HAVE_ASM */
 
+#if defined(MBEDTLS_SSL_PROTO_SSL3)
+#if defined(MBEDTLS_DEPRECATED_REMOVED)
+#error "MBEDTLS_SSL_PROTO_SSL3 is deprecated and will be removed in a future version of Mbed TLS"
+#elif defined(MBEDTLS_DEPRECATED_WARNING)
+#warning "MBEDTLS_SSL_PROTO_SSL3 is deprecated and will be removed in a future version of Mbed TLS"
+#endif
+#endif /* MBEDTLS_SSL_PROTO_SSL3 */
+
+#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
+#if defined(MBEDTLS_DEPRECATED_REMOVED)
+#error "MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO is deprecated and will be removed in a future version of Mbed TLS"
+#elif defined(MBEDTLS_DEPRECATED_WARNING)
+#warning "MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO is deprecated and will be removed in a future version of Mbed TLS"
+#endif
+#endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
+
 /*
  * Avoid warning from -pedantic. This is a convenient place for this
  * workaround since this is included by every single file before the
diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index 058969b..7abdaa5 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -233,27 +233,27 @@
 /**
  * \def MBEDTLS_DEPRECATED_WARNING
  *
- * Mark deprecated functions so that they generate a warning if used.
- * Functions deprecated in one version will usually be removed in the next
- * version. You can enable this to help you prepare the transition to a new
- * major version by making sure your code is not using these functions.
+ * Mark deprecated functions and features so that they generate a warning if
+ * used. Functionality deprecated in one version will usually be removed in the
+ * next version. You can enable this to help you prepare the transition to a
+ * new major version by making sure your code is not using this functionality.
  *
  * This only works with GCC and Clang. With other compilers, you may want to
  * use MBEDTLS_DEPRECATED_REMOVED
  *
- * Uncomment to get warnings on using deprecated functions.
+ * Uncomment to get warnings on using deprecated functions and features.
  */
 //#define MBEDTLS_DEPRECATED_WARNING
 
 /**
  * \def MBEDTLS_DEPRECATED_REMOVED
  *
- * Remove deprecated functions so that they generate an error if used.
- * Functions deprecated in one version will usually be removed in the next
- * version. You can enable this to help you prepare the transition to a new
- * major version by making sure your code is not using these functions.
+ * Remove deprecated functions and features so that they generate an error if
+ * used. Functionality deprecated in one version will usually be removed in the
+ * next version. You can enable this to help you prepare the transition to a
+ * new major version by making sure your code is not using this functionality.
  *
- * Uncomment to get errors on using deprecated functions.
+ * Uncomment to get errors on using deprecated functions and features.
  */
 //#define MBEDTLS_DEPRECATED_REMOVED
 
@@ -1571,6 +1571,9 @@
  * Enable support for receiving and parsing SSLv2 Client Hello messages for the
  * SSL Server module (MBEDTLS_SSL_SRV_C).
  *
+ * \deprecated This option is deprecated and will be removed in a future
+ *             version of Mbed TLS.
+ *
  * Uncomment this macro to enable support for SSLv2 Client Hello messages.
  */
 //#define MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
@@ -1602,6 +1605,9 @@
  * Requires: MBEDTLS_MD5_C
  *           MBEDTLS_SHA1_C
  *
+ * \deprecated This option is deprecated and will be removed in a future
+ *             version of Mbed TLS.
+ *
  * Comment this macro to disable support for SSL 3.0
  */
 //#define MBEDTLS_SSL_PROTO_SSL3
@@ -2812,7 +2818,10 @@
 /**
  * \def MBEDTLS_PKCS11_C
  *
- * Enable wrapper for PKCS#11 smartcard support.
+ * Enable wrapper for PKCS#11 smartcard support via the pkcs11-helper library.
+ *
+ * \deprecated This option is deprecated and will be removed in a future
+ *             version of Mbed TLS.
  *
  * Module:  library/pkcs11.c
  * Caller:  library/pk.c
diff --git a/include/mbedtls/pkcs11.h b/include/mbedtls/pkcs11.h
index d9f45db..cf8d8c4 100644
--- a/include/mbedtls/pkcs11.h
+++ b/include/mbedtls/pkcs11.h
@@ -47,6 +47,8 @@
 extern "C" {
 #endif
 
+#if defined(MBEDTLS_DEPRECATED_REMOVED)
+
 /**
  * Context for PKCS #11 private keys.
  */
@@ -56,47 +58,71 @@
         int len;
 } mbedtls_pkcs11_context;
 
+#if defined(MBEDTLS_DEPRECATED_WARNING)
+#define MBEDTLS_DEPRECATED      __attribute__((deprecated))
+#else
+#define MBEDTLS_DEPRECATED
+#endif
+
 /**
  * Initialize a mbedtls_pkcs11_context.
  * (Just making memory references valid.)
+ *
+ * \deprecated          This function is deprecated and will be removed in a
+ *                      future version of the library.
  */
-void mbedtls_pkcs11_init( mbedtls_pkcs11_context *ctx );
+MBEDTLS_DEPRECATED void mbedtls_pkcs11_init( mbedtls_pkcs11_context *ctx );
 
 /**
  * Fill in a mbed TLS certificate, based on the given PKCS11 helper certificate.
  *
+ * \deprecated          This function is deprecated and will be removed in a
+ *                      future version of the library.
+ *
  * \param cert          X.509 certificate to fill
  * \param pkcs11h_cert  PKCS #11 helper certificate
  *
  * \return              0 on success.
  */
-int mbedtls_pkcs11_x509_cert_bind( mbedtls_x509_crt *cert, pkcs11h_certificate_t pkcs11h_cert );
+MBEDTLS_DEPRECATED int mbedtls_pkcs11_x509_cert_bind( mbedtls_x509_crt *cert,
+                                        pkcs11h_certificate_t pkcs11h_cert );
 
 /**
  * Set up a mbedtls_pkcs11_context storing the given certificate. Note that the
  * mbedtls_pkcs11_context will take over control of the certificate, freeing it when
  * done.
  *
+ * \deprecated          This function is deprecated and will be removed in a
+ *                      future version of the library.
+ *
  * \param priv_key      Private key structure to fill.
  * \param pkcs11_cert   PKCS #11 helper certificate
  *
  * \return              0 on success
  */
-int mbedtls_pkcs11_priv_key_bind( mbedtls_pkcs11_context *priv_key,
-        pkcs11h_certificate_t pkcs11_cert );
+MBEDTLS_DEPRECATED int mbedtls_pkcs11_priv_key_bind(
+                                        mbedtls_pkcs11_context *priv_key,
+                                        pkcs11h_certificate_t pkcs11_cert );
 
 /**
  * Free the contents of the given private key context. Note that the structure
  * itself is not freed.
  *
+ * \deprecated          This function is deprecated and will be removed in a
+ *                      future version of the library.
+ *
  * \param priv_key      Private key structure to cleanup
  */
-void mbedtls_pkcs11_priv_key_free( mbedtls_pkcs11_context *priv_key );
+MBEDTLS_DEPRECATED void mbedtls_pkcs11_priv_key_free(
+                                            mbedtls_pkcs11_context *priv_key );
 
 /**
  * \brief          Do an RSA private key decrypt, then remove the message
  *                 padding
  *
+ * \deprecated     This function is deprecated and will be removed in a future
+ *                 version of the library.
+ *
  * \param ctx      PKCS #11 context
  * \param mode     must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature
  * \param input    buffer holding the encrypted data
@@ -110,15 +136,18 @@
  *                 of ctx->N (eg. 128 bytes if RSA-1024 is used) otherwise
  *                 an error is thrown.
  */
-int mbedtls_pkcs11_decrypt( mbedtls_pkcs11_context *ctx,
-                       int mode, size_t *olen,
-                       const unsigned char *input,
-                       unsigned char *output,
-                       size_t output_max_len );
+MBEDTLS_DEPRECATED int mbedtls_pkcs11_decrypt( mbedtls_pkcs11_context *ctx,
+                                               int mode, size_t *olen,
+                                               const unsigned char *input,
+                                               unsigned char *output,
+                                               size_t output_max_len );
 
 /**
  * \brief          Do a private RSA to sign a message digest
  *
+ * \deprecated     This function is deprecated and will be removed in a future
+ *                 version of the library.
+ *
  * \param ctx      PKCS #11 context
  * \param mode     must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature
  * \param md_alg   a MBEDTLS_MD_XXX (use MBEDTLS_MD_NONE for signing raw data)
@@ -132,28 +161,58 @@
  * \note           The "sig" buffer must be as large as the size
  *                 of ctx->N (eg. 128 bytes if RSA-1024 is used).
  */
-int mbedtls_pkcs11_sign( mbedtls_pkcs11_context *ctx,
-                    int mode,
-                    mbedtls_md_type_t md_alg,
-                    unsigned int hashlen,
-                    const unsigned char *hash,
-                    unsigned char *sig );
+MBEDTLS_DEPRECATED int mbedtls_pkcs11_sign( mbedtls_pkcs11_context *ctx,
+                                            int mode,
+                                            mbedtls_md_type_t md_alg,
+                                            unsigned int hashlen,
+                                            const unsigned char *hash,
+                                            unsigned char *sig );
 
 /**
  * SSL/TLS wrappers for PKCS#11 functions
+ *
+ * \deprecated     This function is deprecated and will be removed in a future
+ *                 version of the library.
  */
-static inline int mbedtls_ssl_pkcs11_decrypt( void *ctx, int mode, size_t *olen,
-                        const unsigned char *input, unsigned char *output,
-                        size_t output_max_len )
+MBEDTLS_DEPRECATED static inline int mbedtls_ssl_pkcs11_decrypt( void *ctx,
+                            int mode, size_t *olen,
+                            const unsigned char *input, unsigned char *output,
+                            size_t output_max_len )
 {
     return mbedtls_pkcs11_decrypt( (mbedtls_pkcs11_context *) ctx, mode, olen, input, output,
                            output_max_len );
 }
 
-static inline int mbedtls_ssl_pkcs11_sign( void *ctx,
-                     int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
-                     int mode, mbedtls_md_type_t md_alg, unsigned int hashlen,
-                     const unsigned char *hash, unsigned char *sig )
+/**
+ * \brief          This function signs a message digest using RSA.
+ *
+ * \deprecated     This function is deprecated and will be removed in a future
+ *                 version of the library.
+ *
+ * \param ctx      The PKCS #11 context.
+ * \param f_rng    The RNG function. This parameter is unused.
+ * \param p_rng    The RNG context. This parameter is unused.
+ * \param mode     The operation to run. This must be set to
+ *                 MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's
+ *                 signature.
+ * \param md_alg   The message digest algorithm. One of the MBEDTLS_MD_XXX
+ *                 must be passed to this function and MBEDTLS_MD_NONE can be
+ *                 used for signing raw data.
+ * \param hashlen  The message digest length (for MBEDTLS_MD_NONE only).
+ * \param hash     The buffer holding the message digest.
+ * \param sig      The buffer that will hold the ciphertext.
+ *
+ * \return         \c 0 if the signing operation was successful.
+ * \return         A non-zero error code on failure.
+ *
+ * \note           The \p sig buffer must be as large as the size of
+ *                 <code>ctx->N</code>. For example, 128 bytes if RSA-1024 is
+ *                 used.
+ */
+MBEDTLS_DEPRECATED static inline int mbedtls_ssl_pkcs11_sign( void *ctx,
+                    int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
+                    int mode, mbedtls_md_type_t md_alg, unsigned int hashlen,
+                    const unsigned char *hash, unsigned char *sig )
 {
     ((void) f_rng);
     ((void) p_rng);
@@ -161,11 +220,25 @@
                         hashlen, hash, sig );
 }
 
-static inline size_t mbedtls_ssl_pkcs11_key_len( void *ctx )
+/**
+ * This function gets the length of the private key.
+ *
+ * \deprecated     This function is deprecated and will be removed in a future
+ *                 version of the library.
+ *
+ * \param ctx      The PKCS #11 context.
+ *
+ * \return         The length of the private key.
+ */
+MBEDTLS_DEPRECATED static inline size_t mbedtls_ssl_pkcs11_key_len( void *ctx )
 {
     return ( (mbedtls_pkcs11_context *) ctx )->len;
 }
 
+#undef MBEDTLS_DEPRECATED
+
+#endif /* MBEDTLS_DEPRECATED_REMOVED */
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/mbedtls/ssl_internal.h b/include/mbedtls/ssl_internal.h
index f703da9..b8c7f0a 100644
--- a/include/mbedtls/ssl_internal.h
+++ b/include/mbedtls/ssl_internal.h
@@ -319,7 +319,8 @@
     mbedtls_ecdh_context ecdh_ctx;              /*!<  ECDH key exchange       */
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
-    psa_ecc_curve_t ecdh_psa_curve;
+    psa_key_type_t ecdh_psa_type;
+    uint16_t ecdh_bits;
     psa_key_handle_t ecdh_psa_privkey;
     unsigned char ecdh_psa_peerkey[MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH];
     size_t ecdh_psa_peerkey_len;
diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 1005bd9..0f6a26b 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -2244,6 +2244,7 @@
                                              unsigned char *end )
 {
     uint16_t tls_id;
+    size_t ecdh_bits = 0;
     uint8_t ecpoint_len;
     mbedtls_ssl_handshake_params *handshake = ssl->handshake;
 
@@ -2264,11 +2265,14 @@
     tls_id |= *(*p)++;
 
     /* Convert EC group to PSA key type. */
-    if( ( handshake->ecdh_psa_curve =
-          mbedtls_psa_parse_tls_ecc_group( tls_id ) ) == 0 )
+    if( ( handshake->ecdh_psa_type =
+          mbedtls_psa_parse_tls_ecc_group( tls_id, &ecdh_bits ) ) == 0 )
     {
         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
     }
+    if( ecdh_bits > 0xffff )
+        return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
+    handshake->ecdh_bits = (uint16_t) ecdh_bits;
 
     /*
      * Put peer's ECDH public key in the format understood by PSA.
@@ -2278,7 +2282,7 @@
     if( (size_t)( end - *p ) < ecpoint_len )
         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
 
-    if( mbedtls_psa_tls_ecpoint_to_psa_ec( handshake->ecdh_psa_curve,
+    if( mbedtls_psa_tls_ecpoint_to_psa_ec(
                                     *p, ecpoint_len,
                                     handshake->ecdh_psa_peerkey,
                                     sizeof( handshake->ecdh_psa_peerkey ),
@@ -3257,11 +3261,8 @@
         key_attributes = psa_key_attributes_init();
         psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
         psa_set_key_algorithm( &key_attributes, PSA_ALG_ECDH );
-        psa_set_key_type( &key_attributes,
-                          PSA_KEY_TYPE_ECC_KEY_PAIR( handshake->ecdh_psa_curve )
-                        );
-        psa_set_key_bits( &key_attributes,
-                          PSA_ECC_CURVE_BITS( handshake->ecdh_psa_curve ) );
+        psa_set_key_type( &key_attributes, handshake->ecdh_psa_type );
+        psa_set_key_bits( &key_attributes, handshake->ecdh_bits );
 
         /* Generate ECDH private key. */
         status = psa_generate_key( &key_attributes,
diff --git a/programs/fuzz/fuzz_privkey.c b/programs/fuzz/fuzz_privkey.c
index 533a647..178d17b 100644
--- a/programs/fuzz/fuzz_privkey.c
+++ b/programs/fuzz/fuzz_privkey.c
@@ -1,4 +1,5 @@
 #include <stdint.h>
+#include <stdlib.h>
 #include "mbedtls/pk.h"
 
 //4 Kb should be enough for every bug ;-)
@@ -29,8 +30,12 @@
             mbedtls_mpi_init( &DQ ); mbedtls_mpi_init( &QP );
 
             rsa = mbedtls_pk_rsa( pk );
-            mbedtls_rsa_export( rsa, &N, &P, &Q, &D, &E );
-            mbedtls_rsa_export_crt( rsa, &DP, &DQ, &QP );
+            if ( mbedtls_rsa_export( rsa, &N, &P, &Q, &D, &E ) != 0 ) {
+                abort();
+            }
+            if ( mbedtls_rsa_export_crt( rsa, &DP, &DQ, &QP ) != 0 ) {
+                abort();
+            }
 
             mbedtls_mpi_free( &N ); mbedtls_mpi_free( &P ); mbedtls_mpi_free( &Q );
             mbedtls_mpi_free( &D ); mbedtls_mpi_free( &E ); mbedtls_mpi_free( &DP );
diff --git a/programs/fuzz/fuzz_pubkey.c b/programs/fuzz/fuzz_pubkey.c
index df42f7d..38eacfb 100644
--- a/programs/fuzz/fuzz_pubkey.c
+++ b/programs/fuzz/fuzz_pubkey.c
@@ -1,4 +1,5 @@
 #include <stdint.h>
+#include <stdlib.h>
 #include "mbedtls/pk.h"
 
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
@@ -20,8 +21,12 @@
             mbedtls_mpi_init( &DQ ); mbedtls_mpi_init( &QP );
 
             rsa = mbedtls_pk_rsa( pk );
-            ret = mbedtls_rsa_export( rsa, &N, &P, &Q, &D, &E );
-            ret = mbedtls_rsa_export_crt( rsa, &DP, &DQ, &QP );
+            if ( mbedtls_rsa_export( rsa, &N, &P, &Q, &D, &E ) != 0 ) {
+                abort();
+            }
+            if ( mbedtls_rsa_export_crt( rsa, &DP, &DQ, &QP ) != MBEDTLS_ERR_RSA_BAD_INPUT_DATA ) {
+                abort();
+            }
 
             mbedtls_mpi_free( &N ); mbedtls_mpi_free( &P ); mbedtls_mpi_free( &Q );
             mbedtls_mpi_free( &D ); mbedtls_mpi_free( &E ); mbedtls_mpi_free( &DP );
diff --git a/scripts/config.py b/scripts/config.py
index 9f77063..b4edb65 100755
--- a/scripts/config.py
+++ b/scripts/config.py
@@ -183,6 +183,8 @@
             'MBEDTLS_REMOVE_ARC4_CIPHERSUITES',
             'MBEDTLS_RSA_NO_CRT',
             'MBEDTLS_SSL_HW_RECORD_ACCEL',
+            'MBEDTLS_SSL_PROTO_SSL3',
+            'MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO',
             'MBEDTLS_TEST_NULL_ENTROPY',
             'MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3',
             'MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION',
diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh
index 5e98645..2350dc7 100755
--- a/tests/scripts/all.sh
+++ b/tests/scripts/all.sh
@@ -978,9 +978,6 @@
     msg "test: compat.sh default (full minus MBEDTLS_USE_PSA_CRYPTO)"
     if_build_succeeded tests/compat.sh
 
-    msg "test: compat.sh ssl3 (full minus MBEDTLS_USE_PSA_CRYPTO)"
-    if_build_succeeded env OPENSSL_CMD="$OPENSSL_LEGACY" tests/compat.sh -m 'ssl3'
-
     msg "test: compat.sh RC4, DES & NULL (full minus MBEDTLS_USE_PSA_CRYPTO)"
     if_build_succeeded env OPENSSL_CMD="$OPENSSL_LEGACY" GNUTLS_CLI="$GNUTLS_LEGACY_CLI" GNUTLS_SERV="$GNUTLS_LEGACY_SERV" tests/compat.sh -e '3DES\|DES-CBC3' -f 'NULL\|DES\|RC4\|ARCFOUR'
 
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 3d0ca87..e65b8ec 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -5500,15 +5500,8 @@
 # Test for ClientHello without extensions
 
 requires_gnutls
-run_test    "ClientHello without extensions, SHA-1 allowed" \
-            "$P_SRV debug_level=3 key_file=data_files/server2.key crt_file=data_files/server2.crt" \
-            "$G_CLI --priority=NORMAL:%NO_EXTENSIONS:%DISABLE_SAFE_RENEGOTIATION localhost" \
-            0 \
-            -s "dumping 'client hello extensions' (0 bytes)"
-
-requires_gnutls
-run_test    "ClientHello without extensions, SHA-1 forbidden in certificates on server" \
-            "$P_SRV debug_level=3 key_file=data_files/server2.key crt_file=data_files/server2.crt allow_sha1=0" \
+run_test    "ClientHello without extensions" \
+            "$P_SRV debug_level=3" \
             "$G_CLI --priority=NORMAL:%NO_EXTENSIONS:%DISABLE_SAFE_RENEGOTIATION localhost" \
             0 \
             -s "dumping 'client hello extensions' (0 bytes)"
diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data
index 3326b43..5f4dc67 100644
--- a/tests/suites/test_suite_ssl.data
+++ b/tests/suites/test_suite_ssl.data
@@ -85,6 +85,120 @@
 Message transport mock - two-way interleaved sends/reads
 ssl_message_mock_interleaved_two_ways:
 
+Test mbedtls_endpoint sanity for the client
+mbedtls_endpoint_sanity:MBEDTLS_SSL_IS_CLIENT
+
+Test mbedtls_endpoint sanity for the server
+mbedtls_endpoint_sanity:MBEDTLS_SSL_IS_SERVER
+
+Test moving clients handshake to state: HELLO_REQUEST
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_HELLO_REQUEST:1
+
+Test moving clients handshake to state: CLIENT_HELLO
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_CLIENT_HELLO:1
+
+Test moving clients handshake to state: SERVER_HELLO
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_SERVER_HELLO:1
+
+Test moving clients handshake to state: SERVER_CERTIFICATE
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_SERVER_CERTIFICATE:1
+
+Test moving clients handshake to state: SERVER_KEY_EXCHANGE
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_SERVER_KEY_EXCHANGE:1
+
+Test moving clients handshake to state: CERTIFICATE_REQUEST
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_CERTIFICATE_REQUEST:1
+
+Test moving clients handshake to state: SERVER_HELLO_DONE
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_SERVER_HELLO_DONE:1
+
+Test moving clients handshake to state: CLIENT_CERTIFICATE
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_CLIENT_CERTIFICATE:1
+
+Test moving clients handshake to state: CLIENT_KEY_EXCHANGE
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:1
+
+Test moving clients handshake to state: CERTIFICATE_VERIFY
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_CERTIFICATE_VERIFY:1
+
+Test moving clients handshake to state: CLIENT_CHANGE_CIPHER_SPEC
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:1
+
+Test moving clients handshake to state: CLIENT_FINISHED
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_CLIENT_FINISHED:1
+
+Test moving clients handshake to state: SERVER_CHANGE_CIPHER_SPEC
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:1
+
+Test moving clients handshake to state: SERVER_FINISHED
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_SERVER_FINISHED:1
+
+Test moving clients handshake to state: FLUSH_BUFFERS
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_FLUSH_BUFFERS:1
+
+Test moving clients handshake to state: HANDSHAKE_WRAPUP
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_HANDSHAKE_WRAPUP:1
+
+Test moving clients handshake to state: HANDSHAKE_OVER
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_HANDSHAKE_OVER:1
+
+Test moving servers handshake to state: HELLO_REQUEST
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_HELLO_REQUEST:1
+
+Test moving servers handshake to state: CLIENT_HELLO
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_CLIENT_HELLO:1
+
+Test moving servers handshake to state: SERVER_HELLO
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_SERVER_HELLO:1
+
+Test moving servers handshake to state: SERVER_CERTIFICATE
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_SERVER_CERTIFICATE:1
+
+Test moving servers handshake to state: SERVER_KEY_EXCHANGE
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_SERVER_KEY_EXCHANGE:1
+
+Test moving servers handshake to state: CERTIFICATE_REQUEST
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_CERTIFICATE_REQUEST:1
+
+Test moving servers handshake to state: SERVER_HELLO_DONE
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_SERVER_HELLO_DONE:1
+
+Test moving servers handshake to state: CLIENT_CERTIFICATE
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_CLIENT_CERTIFICATE:1
+
+Test moving servers handshake to state: CLIENT_KEY_EXCHANGE
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:1
+
+Test moving servers handshake to state: CERTIFICATE_VERIFY
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_CERTIFICATE_VERIFY:1
+
+Test moving servers handshake to state: CLIENT_CHANGE_CIPHER_SPEC
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:1
+
+Test moving servers handshake to state: CLIENT_FINISHED
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_CLIENT_FINISHED:1
+
+Test moving servers handshake to state: SERVER_CHANGE_CIPHER_SPEC
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:1
+
+Test moving servers handshake to state: SERVER_FINISHED
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_SERVER_FINISHED:1
+
+Test moving servers handshake to state: FLUSH_BUFFERS
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_FLUSH_BUFFERS:1
+
+Test moving servers handshake to state: HANDSHAKE_WRAPUP
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_HANDSHAKE_WRAPUP:1
+
+Test moving servers handshake to state: HANDSHAKE_OVER
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_HANDSHAKE_OVER:1
+
+Negative test moving clients ssl to state: VERIFY_REQUEST_SENT
+move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:0
+
+Negative test moving servers ssl to state: NEW_SESSION_TICKET
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET:0
+
 SSL DTLS replay: initial state, seqnum 0
 ssl_dtls_replay:"":"000000000000":0
 
diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function
index 2d080c7..4fba1f1 100644
--- a/tests/suites/test_suite_ssl.function
+++ b/tests/suites/test_suite_ssl.function
@@ -1,7 +1,9 @@
 /* BEGIN_HEADER */
 #include <mbedtls/ssl.h>
 #include <mbedtls/ssl_internal.h>
-
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/certs.h>
 
 /*
  * Buffer structure for custom I/O callbacks.
@@ -59,7 +61,7 @@
  *          zero and \p input is NULL.
  */
 int mbedtls_test_buffer_put( mbedtls_test_buffer *buf,
-                             const unsigned char* input, size_t input_len )
+                             const unsigned char *input, size_t input_len )
 {
     size_t overflow = 0;
 
@@ -618,6 +620,271 @@
     return msg_len;
 }
 
+#if defined(MBEDTLS_X509_CRT_PARSE_C)
+
+/*
+ * Structure with endpoint's certificates for SSL communication tests.
+ */
+typedef struct mbedtls_endpoint_certificate
+{
+    mbedtls_x509_crt ca_cert;
+    mbedtls_x509_crt cert;
+    mbedtls_x509_crt cert2;
+    mbedtls_pk_context pkey;
+    mbedtls_pk_context pkey2;
+} mbedtls_endpoint_certificate;
+
+/*
+ * Endpoint structure for SSL communication tests.
+ */
+typedef struct mbedtls_endpoint
+{
+    const char *name;
+    mbedtls_ssl_context ssl;
+    mbedtls_ssl_config conf;
+    mbedtls_ctr_drbg_context ctr_drbg;
+    mbedtls_entropy_context entropy;
+    mbedtls_mock_socket socket;
+    mbedtls_endpoint_certificate cert;
+} mbedtls_endpoint;
+
+/*
+ * Initializes \p ep_cert structure and assigns it to endpoint
+ * represented by \p ep.
+ *
+ * \retval  0 on success, otherwise error code.
+ */
+int mbedtls_endpoint_certificate_init( mbedtls_endpoint *ep )
+{
+    int i = 0;
+    int ret = -1;
+    mbedtls_endpoint_certificate *cert;
+
+    if( ep == NULL )
+    {
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
+    }
+
+    cert = &( ep->cert );
+    mbedtls_x509_crt_init( &( cert->ca_cert ) );
+    mbedtls_x509_crt_init( &( cert->cert ) );
+    mbedtls_x509_crt_init( &( cert->cert2 ) );
+    mbedtls_pk_init( &( cert->pkey ) );
+    mbedtls_pk_init( &( cert->pkey2 ) );
+
+    /* Load the trusted CA */
+
+    for( i = 0; mbedtls_test_cas[i] != NULL; i++ )
+    {
+        ret = mbedtls_x509_crt_parse( &( cert->ca_cert ),
+                        (const unsigned char *) mbedtls_test_cas[i],
+                        mbedtls_test_cas_len[i] );
+        TEST_ASSERT( ret == 0 );
+    }
+
+    for( i = 0; mbedtls_test_cas_der[i] != NULL; i++ )
+    {
+        ret = mbedtls_x509_crt_parse_der( &( cert->ca_cert ),
+                        (const unsigned char *) mbedtls_test_cas_der[i],
+                        mbedtls_test_cas_der_len[i] );
+        TEST_ASSERT( ret == 0 );
+    }
+
+    /* Load own certificate and private key */
+
+    if( ep->conf.endpoint == MBEDTLS_SSL_IS_SERVER )
+    {
+        ret = mbedtls_x509_crt_parse( &( cert->cert ),
+                            (const unsigned char *) mbedtls_test_srv_crt_rsa,
+                            mbedtls_test_srv_crt_rsa_len );
+        TEST_ASSERT( ret == 0 );
+
+        ret = mbedtls_pk_parse_key( &( cert->pkey ),
+                            (const unsigned char *) mbedtls_test_srv_key_rsa,
+                            mbedtls_test_srv_key_rsa_len, NULL, 0 );
+        TEST_ASSERT( ret == 0 );
+
+        ret = mbedtls_x509_crt_parse( &( cert->cert2 ),
+                            (const unsigned char *) mbedtls_test_srv_crt_ec,
+                            mbedtls_test_srv_crt_ec_len );
+        TEST_ASSERT( ret == 0 );
+
+        ret = mbedtls_pk_parse_key( &( cert->pkey2 ),
+                            (const unsigned char *) mbedtls_test_srv_key_ec,
+                            mbedtls_test_srv_key_ec_len, NULL, 0 );
+        TEST_ASSERT( ret == 0 );
+    }
+    else
+    {
+        ret = mbedtls_x509_crt_parse( &( cert->cert ),
+                            (const unsigned char *) mbedtls_test_cli_crt,
+                            mbedtls_test_cli_crt_len );
+        TEST_ASSERT( ret == 0 );
+
+        ret = mbedtls_pk_parse_key( &( cert->pkey ),
+                            (const unsigned char *) mbedtls_test_cli_key,
+                            mbedtls_test_cli_key_len, NULL, 0 );
+        TEST_ASSERT( ret == 0 );
+    }
+
+    mbedtls_ssl_conf_ca_chain( &( ep->conf ), &( cert->ca_cert ), NULL );
+
+    ret = mbedtls_ssl_conf_own_cert( &( ep->conf ), &( cert->cert ), &( cert->pkey ) );
+    TEST_ASSERT( ret == 0 );
+
+    if( ep->conf.endpoint == MBEDTLS_SSL_IS_SERVER )
+    {
+        ret = mbedtls_ssl_conf_own_cert( &( ep->conf ), &( cert->cert2 ), &( cert->pkey2 ) );
+        TEST_ASSERT( ret == 0 );
+    }
+
+exit:
+    if( ret != 0 )
+    {
+        mbedtls_x509_crt_free( &( cert->ca_cert ) );
+        mbedtls_x509_crt_free( &( cert->cert ) );
+        mbedtls_x509_crt_free( &( cert->cert2 ) );
+        mbedtls_pk_free( &( cert->pkey ) );
+        mbedtls_pk_free( &( cert->pkey2 ) );
+    }
+
+    return ret;
+}
+
+/*
+ * Initializes \p ep structure. It is important to call `mbedtls_endpoint_free()`
+ * after calling this function even if it fails.
+ *
+ * \p endpoint_type must be set as MBEDTLS_SSL_IS_SERVER or
+ * MBEDTLS_SSL_IS_CLIENT.
+ *
+ * \retval  0 on success, otherwise error code.
+ */
+int mbedtls_endpoint_init( mbedtls_endpoint *ep, int endpoint_type )
+{
+    int ret = -1;
+
+    if( ep == NULL )
+    {
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
+    }
+
+    memset( ep, 0, sizeof( *ep ) );
+
+    ep->name = ( endpoint_type == MBEDTLS_SSL_IS_SERVER ) ? "Server" : "Client";
+
+    mbedtls_ssl_init( &( ep->ssl ) );
+    mbedtls_ssl_config_init( &( ep->conf ) );
+    mbedtls_ctr_drbg_init( &( ep->ctr_drbg ) );
+    mbedtls_ssl_conf_rng( &( ep->conf ),
+        mbedtls_ctr_drbg_random,
+        &( ep->ctr_drbg ) );
+    mbedtls_entropy_init( &( ep->entropy ) );
+    mbedtls_mock_socket_init( &( ep->socket ) );
+
+    ret = mbedtls_ctr_drbg_seed( &( ep->ctr_drbg ), mbedtls_entropy_func,
+                    &( ep->entropy ), (const unsigned char *) ( ep->name ),
+                    strlen( ep->name ) );
+    TEST_ASSERT( ret == 0 );
+
+    /* Non-blocking callbacks without timeout */
+    mbedtls_ssl_set_bio( &( ep->ssl ), &( ep->socket ),
+        mbedtls_mock_tcp_send_nb,
+        mbedtls_mock_tcp_recv_nb,
+        NULL );
+
+    ret = mbedtls_ssl_setup( &( ep->ssl ), &( ep->conf ) );
+    TEST_ASSERT( ret == 0 );
+
+    ret = mbedtls_ssl_config_defaults( &( ep->conf ), endpoint_type,
+                                        MBEDTLS_SSL_TRANSPORT_STREAM,
+                                        MBEDTLS_SSL_PRESET_DEFAULT );
+    TEST_ASSERT( ret == 0 );
+
+    ret = mbedtls_endpoint_certificate_init( ep );
+    TEST_ASSERT( ret == 0 );
+
+exit:
+    return ret;
+}
+
+/*
+ * Deinitializes certificates from endpoint represented by \p ep.
+ */
+void mbedtls_endpoint_certificate_free( mbedtls_endpoint *ep )
+{
+    mbedtls_endpoint_certificate *cert = &( ep->cert );
+    mbedtls_x509_crt_free( &( cert->ca_cert ) );
+    mbedtls_x509_crt_free( &( cert->cert ) );
+    mbedtls_x509_crt_free( &( cert->cert2 ) );
+    mbedtls_pk_free( &( cert->pkey ) );
+    mbedtls_pk_free( &( cert->pkey2 ) );
+}
+
+/*
+ * Deinitializes endpoint represented by \p ep.
+ */
+void mbedtls_endpoint_free( mbedtls_endpoint *ep )
+{
+    mbedtls_endpoint_certificate_free( ep );
+
+    mbedtls_ssl_free( &( ep->ssl ) );
+    mbedtls_ssl_config_free( &( ep->conf ) );
+    mbedtls_ctr_drbg_free( &( ep->ctr_drbg ) );
+    mbedtls_entropy_free( &( ep->entropy ) );
+    mbedtls_mock_socket_close( &( ep->socket ) );
+}
+
+/*
+ * This function moves ssl handshake from \p ssl to prescribed \p state.
+ * /p second_ssl is used as second endpoint and their sockets have to be
+ * connected before calling this function.
+ *
+ * \retval  0 on success, otherwise error code.
+ */
+int mbedtls_move_handshake_to_state( mbedtls_ssl_context *ssl,
+                                     mbedtls_ssl_context *second_ssl,
+                                     int state )
+{
+    enum { BUFFSIZE = 1024 };
+    int max_steps = 1000;
+    int ret = 0;
+
+    if( ssl == NULL || second_ssl == NULL )
+    {
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
+    }
+
+    /* Perform communication via connected sockets */
+    while( ( ssl->state != state ) && ( --max_steps >= 0 ) )
+    {
+        /* If /p second_ssl ends the handshake procedure before /p ssl then
+         * there is no need to call the next step */
+        if( second_ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
+        {
+            ret = mbedtls_ssl_handshake_step( second_ssl );
+            if( ret != 0 && ret != MBEDTLS_ERR_SSL_WANT_READ &&
+                            ret != MBEDTLS_ERR_SSL_WANT_WRITE )
+            {
+                return ret;
+            }
+        }
+
+        /* We only care about the \p ssl state and returns, so we call it last,
+         * to leave the iteration as soon as the state is as expected. */
+        ret = mbedtls_ssl_handshake_step( ssl );
+        if( ret != 0 && ret != MBEDTLS_ERR_SSL_WANT_READ &&
+                        ret != MBEDTLS_ERR_SSL_WANT_WRITE )
+        {
+            return ret;
+        }
+    }
+
+    return ( max_steps >= 0 ) ? ret : -1;
+}
+
+#endif /* MBEDTLS_X509_CRT_PARSE_C */
+
 /*
  * Helper function setting up inverse record transformations
  * using given cipher, hash, EtM mode, authentication tag length,
@@ -2648,3 +2915,64 @@
 
 }
 /* END_CASE */
+
+/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_ECP_DP_SECP384R1_ENABLED:!MBEDTLS_USE_PSA_CRYPTO */
+void mbedtls_endpoint_sanity( int endpoint_type )
+{
+    enum { BUFFSIZE = 1024 };
+    mbedtls_endpoint ep;
+    int ret = -1;
+
+    ret = mbedtls_endpoint_init( NULL, endpoint_type );
+    TEST_ASSERT( MBEDTLS_ERR_SSL_BAD_INPUT_DATA == ret );
+
+    ret = mbedtls_endpoint_certificate_init( NULL );
+    TEST_ASSERT( MBEDTLS_ERR_SSL_BAD_INPUT_DATA == ret );
+
+    ret = mbedtls_endpoint_init( &ep, endpoint_type );
+    TEST_ASSERT( ret == 0 );
+
+exit:
+    mbedtls_endpoint_free( &ep );
+}
+/* END_CASE */
+
+/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_ECP_DP_SECP384R1_ENABLED:!MBEDTLS_USE_PSA_CRYPTO */
+void move_handshake_to_state(int endpoint_type, int state, int need_pass)
+{
+    enum { BUFFSIZE = 1024 };
+    mbedtls_endpoint base_ep, second_ep;
+    int ret = -1;
+
+    ret = mbedtls_endpoint_init( &base_ep, endpoint_type );
+    TEST_ASSERT( ret == 0 );
+
+    ret = mbedtls_endpoint_init( &second_ep,
+                            ( endpoint_type == MBEDTLS_SSL_IS_SERVER ) ?
+                            MBEDTLS_SSL_IS_CLIENT : MBEDTLS_SSL_IS_SERVER );
+    TEST_ASSERT( ret == 0 );
+
+    ret = mbedtls_mock_socket_connect( &(base_ep.socket),
+                                       &(second_ep.socket),
+                                       BUFFSIZE );
+    TEST_ASSERT( ret == 0 );
+
+    ret = mbedtls_move_handshake_to_state( &(base_ep.ssl),
+                                           &(second_ep.ssl),
+                                           state );
+    if( need_pass )
+    {
+        TEST_ASSERT( ret == 0 );
+        TEST_ASSERT( base_ep.ssl.state == state );
+    }
+    else
+    {
+        TEST_ASSERT( ret != 0 );
+        TEST_ASSERT( base_ep.ssl.state != state );
+    }
+
+exit:
+    mbedtls_endpoint_free( &base_ep );
+    mbedtls_endpoint_free( &second_ep );
+}
+/* END_CASE */