diff --git a/jetty-exssl/pom.xml b/jetty-exssl/pom.xml
index 2cd3556..e35eafa 100644
--- a/jetty-exssl/pom.xml
+++ b/jetty-exssl/pom.xml
@@ -74,10 +74,25 @@
     </dependency>
     <dependency>
       <groupId>org.eclipse.jetty</groupId>
+      <artifactId>jetty-servlet</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.eclipse.jetty</groupId>
       <artifactId>jetty-http</artifactId>
       <version>${project.version}</version>
     </dependency>
     <dependency>
+      <groupId>org.eclipse.jetty</groupId>
+      <artifactId>jetty-client</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+    <dependency>
+        <groupId>org.eclipse.jetty</groupId>
+        <artifactId>jetty-util</artifactId>
+        <version>${project.version}</version>
+    </dependency>
+    <dependency>
         <groupId>org.eclipse.jetty.toolchain</groupId>
         <artifactId>jetty-test-helper</artifactId>
         <scope>test</scope>
diff --git a/jetty-exssl/src/main/java/org/eclipse/jetty/client/HttpClient.java b/jetty-exssl/src/main/java/org/eclipse/jetty/client/HttpClient.java
new file mode 100644
index 0000000..5bf5fc9
--- /dev/null
+++ b/jetty-exssl/src/main/java/org/eclipse/jetty/client/HttpClient.java
@@ -0,0 +1,817 @@
+// ========================================================================
+// Copyright (c) 2006-2009 Mort Bay Consulting Pty. Ltd.
+// ------------------------------------------------------------------------
+// All rights reserved. This program and the accompanying materials
+// are made available under the terms of the Eclipse Public License v1.0
+// and Apache License v2.0 which accompanies this distribution.
+// The Eclipse Public License is available at
+// http://www.eclipse.org/legal/epl-v10.html
+// The Apache License v2.0 is available at
+// http://www.opensource.org/licenses/apache2.0.php
+// You may elect to redistribute this code under either of these licenses.
+// ========================================================================
+
+package org.eclipse.jetty.client;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.UnknownHostException;
+import java.security.KeyStore;
+import java.security.SecureRandom;
+import java.util.Enumeration;
+import java.util.LinkedList;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
+
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLParameters;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.X509TrustManager;
+
+import org.eclipse.jetty.client.security.Authentication;
+import org.eclipse.jetty.client.security.RealmResolver;
+import org.eclipse.jetty.client.security.SecurityListener;
+import org.eclipse.jetty.http.HttpBuffers;
+import org.eclipse.jetty.http.HttpSchemes;
+import org.eclipse.jetty.http.security.Password;
+import org.eclipse.jetty.io.Buffer;
+import org.eclipse.jetty.io.ByteArrayBuffer;
+import org.eclipse.jetty.io.SslContextFactory;
+import org.eclipse.jetty.io.nio.DirectNIOBuffer;
+import org.eclipse.jetty.io.nio.IndirectNIOBuffer;
+import org.eclipse.jetty.util.Attributes;
+import org.eclipse.jetty.util.AttributesMap;
+import org.eclipse.jetty.util.component.LifeCycle;
+import org.eclipse.jetty.util.log.Log;
+import org.eclipse.jetty.util.resource.Resource;
+import org.eclipse.jetty.util.thread.QueuedThreadPool;
+import org.eclipse.jetty.util.thread.ThreadPool;
+import org.eclipse.jetty.util.thread.Timeout;
+
+/**
+ * Http Client.
+ * <p/>
+ * HttpClient is the main active component of the client API implementation.
+ * It is the opposite of the Connectors in standard Jetty, in that it listens
+ * for responses rather than requests.   Just like the connectors, there is a
+ * blocking socket version and a non-blocking NIO version (implemented as nested classes
+ * selected by {@link #setConnectorType(int)}).
+ * <p/>
+ * The an instance of {@link HttpExchange} is passed to the {@link #send(HttpExchange)} method
+ * to send a request.  The exchange contains both the headers and content (source) of the request
+ * plus the callbacks to handle responses.   A HttpClient can have many exchanges outstanding
+ * and they may be queued on the {@link HttpDestination} waiting for a {@link HttpConnection},
+ * queued in the {@link HttpConnection} waiting to be transmitted or pipelined on the actual
+ * TCP/IP connection waiting for a response.
+ * <p/>
+ * The {@link HttpDestination} class is an aggregation of {@link HttpConnection}s for the
+ * same host, port and protocol.   A destination may limit the number of connections
+ * open and they provide a pool of open connections that may be reused.   Connections may also
+ * be allocated from a destination, so that multiple request sources are not multiplexed
+ * over the same connection.
+ *
+ * @see HttpExchange
+ * @see HttpDestination
+ */
+public class HttpClient extends HttpBuffers implements Attributes
+{
+    public static final int CONNECTOR_SOCKET = 0;
+    public static final int CONNECTOR_SELECT_CHANNEL = 2;
+
+    private int _connectorType = CONNECTOR_SELECT_CHANNEL;
+    private boolean _useDirectBuffers = true;
+    private int _maxConnectionsPerAddress = Integer.MAX_VALUE;
+    private ConcurrentMap<Address, HttpDestination> _destinations = new ConcurrentHashMap<Address, HttpDestination>();
+    ThreadPool _threadPool;
+    Connector _connector;
+    private long _idleTimeout = 20000;
+    private long _timeout = 320000;
+    private int _connectTimeout = 75000;
+    private Timeout _timeoutQ = new Timeout();
+    private Timeout _idleTimeoutQ = new Timeout();
+    private Address _proxy;
+    private Authentication _proxyAuthentication;
+    private Set<String> _noProxy;
+    private int _maxRetries = 3;
+    private int _maxRedirects = 20;
+    private LinkedList<String> _registeredListeners;
+
+    private SslContextFactory _sslContextFactory;
+
+    private RealmResolver _realmResolver;
+
+    private AttributesMap _attributes=new AttributesMap();
+    
+    public HttpClient()
+    {
+        this(new SslContextFactory());
+    }
+    
+    public HttpClient(SslContextFactory sslContextFactory)
+    {
+        _sslContextFactory = sslContextFactory;
+    }
+
+    /* ------------------------------------------------------------------------------- */
+    public void dump()
+    {
+        try
+        {
+            for (Map.Entry<Address, HttpDestination> entry : _destinations.entrySet())
+            {
+                Log.info("\n" + entry.getKey() + ":");
+                entry.getValue().dump();
+            }
+        }
+        catch(Exception e)
+        {
+            Log.warn(e);
+        }
+    }
+
+    /* ------------------------------------------------------------------------------- */
+    public void send(HttpExchange exchange) throws IOException
+    {
+        boolean ssl = HttpSchemes.HTTPS_BUFFER.equalsIgnoreCase(exchange.getScheme());
+        exchange.setStatus(HttpExchange.STATUS_WAITING_FOR_CONNECTION);
+        HttpDestination destination = getDestination(exchange.getAddress(), ssl);
+        destination.send(exchange);
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * @return the threadPool
+     */
+    public ThreadPool getThreadPool()
+    {
+        return _threadPool;
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * @param threadPool the threadPool to set
+     */
+    public void setThreadPool(ThreadPool threadPool)
+    {
+        _threadPool = threadPool;
+    }
+
+
+    /* ------------------------------------------------------------ */
+    /**
+     * @param name
+     * @return Attribute associated with client
+     */
+    public Object getAttribute(String name)
+    {
+        return _attributes.getAttribute(name);
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * @return names of attributes associated with client
+     */
+    public Enumeration getAttributeNames()
+    {
+        return _attributes.getAttributeNames();
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * @param name
+     */
+    public void removeAttribute(String name)
+    {
+        _attributes.removeAttribute(name);
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * Set an attribute on the HttpClient.
+     * Attributes are not used by the client, but are provided for
+     * so that users of a shared HttpClient may share other structures.
+     * @param name
+     * @param attribute
+     */
+    public void setAttribute(String name, Object attribute)
+    {
+        _attributes.setAttribute(name,attribute);
+    }
+
+    /* ------------------------------------------------------------ */
+    public void clearAttributes()
+    {
+        _attributes.clearAttributes();
+    }
+
+    /* ------------------------------------------------------------------------------- */
+    public HttpDestination getDestination(Address remote, boolean ssl) throws UnknownHostException, IOException
+    {
+        if (remote == null)
+            throw new UnknownHostException("Remote socket address cannot be null.");
+
+        HttpDestination destination = _destinations.get(remote);
+        if (destination == null)
+        {
+            destination = new HttpDestination(this, remote, ssl, _maxConnectionsPerAddress);
+            if (_proxy != null && (_noProxy == null || !_noProxy.contains(remote.getHost())))
+            {
+                destination.setProxy(_proxy);
+                if (_proxyAuthentication != null)
+                    destination.setProxyAuthentication(_proxyAuthentication);
+            }
+            HttpDestination other =_destinations.putIfAbsent(remote, destination);
+            if (other!=null)
+                destination=other;
+        }
+        return destination;
+    }
+
+    /* ------------------------------------------------------------ */
+    public void schedule(Timeout.Task task)
+    {
+        _timeoutQ.schedule(task);
+    }
+
+    public void schedule(Timeout.Task task, long timeout)
+    {
+        _timeoutQ.schedule(task, timeout);
+    }
+
+    /* ------------------------------------------------------------ */
+    public void scheduleIdle(Timeout.Task task)
+    {
+        _idleTimeoutQ.schedule(task);
+    }
+
+    /* ------------------------------------------------------------ */
+    public void cancel(Timeout.Task task)
+    {
+        task.cancel();
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * Get whether the connector can use direct NIO buffers.
+     */
+    public boolean getUseDirectBuffers()
+    {
+        return _useDirectBuffers;
+    }
+
+    /* ------------------------------------------------------------ */
+    /** Set a RealmResolver for client Authentication.
+     * If a realmResolver is set, then the HttpDestinations created by
+     * this client will instantiate a {@link SecurityListener} so that
+     * BASIC and DIGEST authentication can be performed.
+     * @param resolver
+     */
+    public void setRealmResolver(RealmResolver resolver)
+    {
+        _realmResolver = resolver;
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * returns the SecurityRealmResolver reg_realmResolveristered with the HttpClient or null
+     *
+     * @return the SecurityRealmResolver reg_realmResolveristered with the HttpClient or null
+     */
+    public RealmResolver getRealmResolver()
+    {
+        return _realmResolver;
+    }
+
+    /* ------------------------------------------------------------ */
+    public boolean hasRealms()
+    {
+        return _realmResolver == null ? false : true;
+    }
+
+
+    /**
+     * Registers a listener that can listen to the stream of execution between the client and the
+     * server and influence events.  Sequential calls to the method wrapper sequentially wrap the preceding
+     * listener in a delegation model.
+     * <p/>
+     * NOTE: the SecurityListener is a special listener which doesn't need to be added via this
+     * mechanic, if you register security realms then it will automatically be added as the top listener of the
+     * delegation stack.
+     *
+     * @param listenerClass
+     */
+    public void registerListener(String listenerClass)
+    {
+        if (_registeredListeners == null)
+        {
+            _registeredListeners = new LinkedList<String>();
+        }
+        _registeredListeners.add(listenerClass);
+    }
+
+    /* ------------------------------------------------------------ */
+    public LinkedList<String> getRegisteredListeners()
+    {
+        return _registeredListeners;
+    }
+
+
+    /* ------------------------------------------------------------ */
+    /**
+     * Set to use NIO direct buffers.
+     *
+     * @param direct If True (the default), the connector can use NIO direct
+     *               buffers. Some JVMs have memory management issues (bugs) with
+     *               direct buffers.
+     */
+    public void setUseDirectBuffers(boolean direct)
+    {
+        _useDirectBuffers = direct;
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * Get the type of connector (socket, blocking or select) in use.
+     */
+    public int getConnectorType()
+    {
+        return _connectorType;
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setConnectorType(int connectorType)
+    {
+        this._connectorType = connectorType;
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * @see org.eclipse.jetty.http.HttpBuffers#newRequestBuffer(int)
+     */
+    @Override
+    protected Buffer newRequestBuffer(int size)
+    {
+        if (_connectorType == CONNECTOR_SOCKET)
+            return new ByteArrayBuffer(size);
+        return _useDirectBuffers?new DirectNIOBuffer(size):new IndirectNIOBuffer(size);
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * @see org.eclipse.jetty.http.HttpBuffers#newRequestHeader(int)
+     */
+    @Override
+    protected Buffer newRequestHeader(int size)
+    {
+        if (_connectorType == CONNECTOR_SOCKET)
+            return new ByteArrayBuffer(size);
+        return new IndirectNIOBuffer(size);
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * @see org.eclipse.jetty.http.HttpBuffers#newResponseBuffer(int)
+     */
+    @Override
+    protected Buffer newResponseBuffer(int size)
+    {
+        if (_connectorType == CONNECTOR_SOCKET)
+            return new ByteArrayBuffer(size);
+        return _useDirectBuffers?new DirectNIOBuffer(size):new IndirectNIOBuffer(size);
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * @see org.eclipse.jetty.http.HttpBuffers#newResponseHeader(int)
+     */
+    @Override
+    protected Buffer newResponseHeader(int size)
+    {
+        if (_connectorType == CONNECTOR_SOCKET)
+            return new ByteArrayBuffer(size);
+        return new IndirectNIOBuffer(size);
+    }
+
+    /* ------------------------------------------------------------------------------- */
+    @Override
+    protected boolean isRequestHeader(Buffer buffer)
+    {
+        if (_connectorType == CONNECTOR_SOCKET)
+            return buffer instanceof ByteArrayBuffer;
+        return buffer instanceof IndirectNIOBuffer;
+    }
+
+    /* ------------------------------------------------------------------------------- */
+    @Override
+    protected boolean isResponseHeader(Buffer buffer)
+    {
+        if (_connectorType == CONNECTOR_SOCKET)
+            return buffer instanceof ByteArrayBuffer;
+        return buffer instanceof IndirectNIOBuffer;
+    }
+
+
+    /* ------------------------------------------------------------ */
+    public int getMaxConnectionsPerAddress()
+    {
+        return _maxConnectionsPerAddress;
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setMaxConnectionsPerAddress(int maxConnectionsPerAddress)
+    {
+        _maxConnectionsPerAddress = maxConnectionsPerAddress;
+    }
+
+    /* ------------------------------------------------------------ */
+    @Override
+    protected void doStart() throws Exception
+    {
+        super.doStart();
+
+        _timeoutQ.setDuration(_timeout);
+        _timeoutQ.setNow();
+        _idleTimeoutQ.setDuration(_idleTimeout);
+        _idleTimeoutQ.setNow();
+
+        if (_threadPool == null)
+        {
+            QueuedThreadPool pool = new QueuedThreadPool();
+            pool.setMaxThreads(16);
+            pool.setDaemon(true);
+            pool.setName("HttpClient");
+            _threadPool = pool;
+        }
+
+        if (_threadPool instanceof LifeCycle)
+        {
+            ((LifeCycle)_threadPool).start();
+        }
+
+
+        if (_connectorType == CONNECTOR_SELECT_CHANNEL)
+        {
+
+            _connector = new SelectConnector(this);
+        }
+        else
+        {
+            _connector = new SocketConnector(this);
+        }
+        _connector.start();
+
+        _threadPool.dispatch(new Runnable()
+        {
+            public void run()
+            {
+                while (isRunning())
+                {
+                    _timeoutQ.tick(System.currentTimeMillis());
+                    _idleTimeoutQ.tick(_timeoutQ.getNow());
+                    try
+                    {
+                        Thread.sleep(200);
+                    }
+                    catch (InterruptedException e)
+                    {
+                    }
+                }
+            }
+        });
+
+    }
+
+    /* ------------------------------------------------------------ */
+    long getNow()
+    {
+        return _timeoutQ.getNow();
+    }
+
+    /* ------------------------------------------------------------ */
+    @Override
+    protected void doStop() throws Exception
+    {
+        _connector.stop();
+        _connector = null;
+        if (_threadPool instanceof LifeCycle)
+        {
+            ((LifeCycle)_threadPool).stop();
+        }
+        for (HttpDestination destination : _destinations.values())
+        {
+            destination.close();
+        }
+
+        _timeoutQ.cancelAll();
+        _idleTimeoutQ.cancelAll();
+        super.doStop();
+    }
+
+    /* ------------------------------------------------------------ */
+    interface Connector extends LifeCycle
+    {
+        public void startConnection(HttpDestination destination) throws IOException;
+    }
+
+    /**
+     * if a keystore location has been provided then client will attempt to use it as the keystore,
+     * otherwise we simply ignore certificates and run with a loose ssl context.
+     *
+     * @return the SSL context
+     */
+    protected SSLContext getSSLContext()
+    {
+        return _sslContextFactory.getClientSslContext();
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * @return the period in milliseconds a {@link HttpConnection} can be idle for before it is closed.
+     */
+    public long getIdleTimeout()
+    {
+        return _idleTimeout;
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * @param ms the period in milliseconds a {@link HttpConnection} can be idle for before it is closed.
+     */
+    public void setIdleTimeout(long ms)
+    {
+        _idleTimeout = ms;
+    }
+
+    /**
+     * @return the period in ms that an exchange will wait for a response from the server.
+     * @deprecated use {@link #getTimeout()} instead.
+     */
+    @Deprecated
+    public int getSoTimeout()
+    {
+        return Long.valueOf(getTimeout()).intValue();
+    }
+
+    /**
+     * @deprecated use {@link #setTimeout(long)} instead.
+     * @param timeout the period in ms that an exchange will wait for a response from the server.
+     */
+    @Deprecated
+    public void setSoTimeout(int timeout)
+    {
+        setTimeout(timeout);
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * @return the period in ms that an exchange will wait for a response from the server.
+     */
+    public long getTimeout()
+    {
+        return _timeout;
+    }
+
+    /* ------------------------------------------------------------ */
+    /**
+     * @param timeout the period in ms that an exchange will wait for a response from the server.
+     */
+    public void setTimeout(long timeout)
+    {
+        _timeout = timeout;
+    }
+
+    /**
+     * @return the period in ms before timing out an attempt to connect
+     */
+    public int getConnectTimeout()
+    {
+        return _connectTimeout;
+    }
+
+    /**
+     * @param connectTimeout the period in ms before timing out an attempt to connect
+     */
+    public void setConnectTimeout(int connectTimeout)
+    {
+        this._connectTimeout = connectTimeout;
+    }
+
+    /* ------------------------------------------------------------ */
+    public Address getProxy()
+    {
+        return _proxy;
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setProxy(Address proxy)
+    {
+        this._proxy = proxy;
+    }
+
+    /* ------------------------------------------------------------ */
+    public Authentication getProxyAuthentication()
+    {
+        return _proxyAuthentication;
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setProxyAuthentication(Authentication authentication)
+    {
+        _proxyAuthentication = authentication;
+    }
+
+    /* ------------------------------------------------------------ */
+    public boolean isProxied()
+    {
+        return this._proxy != null;
+    }
+
+    /* ------------------------------------------------------------ */
+    public Set<String> getNoProxy()
+    {
+        return _noProxy;
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setNoProxy(Set<String> noProxyAddresses)
+    {
+        _noProxy = noProxyAddresses;
+    }
+
+    /* ------------------------------------------------------------ */
+    public int maxRetries()
+    {
+        return _maxRetries;
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setMaxRetries(int retries)
+    {
+        _maxRetries = retries;
+    }
+
+    /* ------------------------------------------------------------ */
+    public int maxRedirects()
+    {
+        return _maxRedirects;
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setMaxRedirects(int redirects)
+    {
+        _maxRedirects = redirects;
+    }
+
+    /* ------------------------------------------------------------ */
+    public String getTrustStoreLocation()
+    {
+        return _sslContextFactory.getTruststore();
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setTrustStoreLocation(String trustStoreLocation)
+    {
+        _sslContextFactory.setTruststore(trustStoreLocation);
+    }
+
+    public InputStream getTrustStoreInputStream()
+    {
+        return _sslContextFactory.getTruststoreInputStream();
+    }
+
+    public void setTrustStoreInputStream(InputStream trustStoreInputStream)
+    {
+        _sslContextFactory.setTruststoreInputStream(trustStoreInputStream);
+    }
+
+    /* ------------------------------------------------------------ */
+    public String getKeyStoreLocation()
+    {
+        return _sslContextFactory.getKeystore();
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setKeyStoreLocation(String keyStoreLocation)
+    {
+        _sslContextFactory.setKeystore(keyStoreLocation);
+    }
+
+    public InputStream getKeyStoreInputStream()
+    {
+        return _sslContextFactory.getKeystoreInputStream();
+    }
+
+    public void setKeyStoreInputStream(InputStream keyStoreInputStream)
+    {
+        _sslContextFactory.setKeystoreInputStream(keyStoreInputStream);
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setKeyStorePassword(String keyStorePassword)
+    {
+        _sslContextFactory.setKeyStorePassword(keyStorePassword);
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setKeyManagerPassword(String keyManagerPassword)
+    {
+        _sslContextFactory.setKeyManagerPassword(keyManagerPassword);
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setTrustStorePassword(String trustStorePassword)
+    {
+        _sslContextFactory.setTrustStorePassword(trustStorePassword);
+    }
+
+    /* ------------------------------------------------------------ */
+    public String getKeyStoreType()
+    {
+        return _sslContextFactory.getKeystoreType();
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setKeyStoreType(String keyStoreType)
+    {
+        _sslContextFactory.setKeystoreType(keyStoreType);
+    }
+
+    /* ------------------------------------------------------------ */
+    public String getTrustStoreType()
+    {
+        return _sslContextFactory.getTruststoreType();
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setTrustStoreType(String trustStoreType)
+    {
+        _sslContextFactory.setTruststoreType(trustStoreType);
+    }
+
+    /* ------------------------------------------------------------ */
+    public String getKeyManagerAlgorithm()
+    {
+        return _sslContextFactory.getSslKeyManagerFactoryAlgorithm();
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setKeyManagerAlgorithm(String keyManagerAlgorithm)
+    {
+        _sslContextFactory.setSslKeyManagerFactoryAlgorithm(keyManagerAlgorithm);
+    }
+
+    /* ------------------------------------------------------------ */
+    public String getTrustManagerAlgorithm()
+    {
+        return _sslContextFactory.getTrustManagerFactoryAlgorithm();
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setTrustManagerAlgorithm(String trustManagerAlgorithm)
+    {
+        _sslContextFactory.setTrustManagerFactoryAlgorithm(trustManagerAlgorithm);
+    }
+
+    /* ------------------------------------------------------------ */
+    public String getProtocol()
+    {
+        return _sslContextFactory.getProtocol();
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setProtocol(String protocol)
+    {
+        _sslContextFactory.setProtocol(protocol);
+    }
+
+    /* ------------------------------------------------------------ */
+    public String getProvider()
+    {
+        return _sslContextFactory.getProvider();
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setProvider(String provider)
+    {
+        setProvider(provider);
+    }
+
+    /* ------------------------------------------------------------ */
+    public String getSecureRandomAlgorithm()
+    {
+        return _sslContextFactory.getSecureRandomAlgorithm();
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setSecureRandomAlgorithm(String secureRandomAlgorithm)
+    {
+        _sslContextFactory.setSecureRandomAlgorithm(secureRandomAlgorithm);
+    }
+}
diff --git a/jetty-exssl/src/main/java/org/eclipse/jetty/exssl/CertificateValidator.java b/jetty-exssl/src/main/java/org/eclipse/jetty/exssl/CertificateValidator.java
deleted file mode 100644
index a467dfc..0000000
--- a/jetty-exssl/src/main/java/org/eclipse/jetty/exssl/CertificateValidator.java
+++ /dev/null
@@ -1,143 +0,0 @@
-package org.eclipse.jetty.exssl;
-
-import java.security.KeyStore;
-import java.security.KeyStoreException;
-import java.security.cert.CRL;
-import java.security.cert.CertPathBuilder;
-import java.security.cert.CertPathBuilderResult;
-import java.security.cert.CertPathValidator;
-import java.security.cert.CertStore;
-import java.security.cert.Certificate;
-import java.security.cert.CertificateException;
-import java.security.cert.CollectionCertStoreParameters;
-import java.security.cert.PKIXBuilderParameters;
-import java.security.cert.X509CertSelector;
-import java.security.cert.X509Certificate;
-import java.util.ArrayList;
-import java.util.Collection;
-
-import org.eclipse.jetty.util.log.Log;
-
-public class CertificateValidator
-{
-    private KeyStore _keyStore;
-    private KeyStore _trustStore;
-    private Collection<? extends CRL> _crls;
-    private int _maxCertPathLength = -1;
-    
-    public CertificateValidator(KeyStore keyStore, KeyStore trustStore, Collection<? extends CRL> crls)
-    {
-        _keyStore = keyStore;
-        _trustStore = trustStore;
-        _crls = crls;
-    }
-
-    public String validate(String keyAlias) throws CertificateException
-    {
-        String result = null;
-
-        if (keyAlias != null)
-        {
-            try
-            {
-                validate(_keyStore.getCertificate(keyAlias));
-            }
-            catch (KeyStoreException ex)
-            {
-                Log.debug(ex);
-                throw new CertificateException("Unable to validate certificate for alias [" +
-                                               keyAlias + "]: " + ex.getMessage());
-            }
-            result = keyAlias;            
-        }
-        
-        return result;
-    }
-    
-    public void validate(Certificate cert) throws CertificateException
-    {
-        if (cert != null && cert instanceof X509Certificate)
-        {
-            ((X509Certificate)cert).checkValidity();
-            
-            String certAlias = "[none]";
-            try
-            {
-                certAlias = _keyStore.getCertificateAlias((X509Certificate)cert);
-                Certificate[] certChain = _keyStore.getCertificateChain(certAlias);
-                   
-                ArrayList<X509Certificate> certList = new ArrayList<X509Certificate>();
-                for (Certificate item : certChain)
-                {
-                    if (!(item instanceof X509Certificate))
-                    {
-                        throw new CertificateException("Invalid certificate type in chain");
-                    }
-                    certList.add((X509Certificate)item);
-                }
-
-                if (certList.isEmpty())
-                {
-                    throw new CertificateException("Invalid certificate chain");
-                    
-                }
-
-                X509CertSelector certSelect = new X509CertSelector();
-                certSelect.setCertificate(certList.get(0));
-                
-                // Configure certification path builder parameters
-                PKIXBuilderParameters pbParams = new PKIXBuilderParameters(_trustStore, certSelect);
-                pbParams.addCertStore(CertStore.getInstance("Collection", new CollectionCertStoreParameters(certList)));
-
-                // Set static Certificate Revocation List
-                if (_crls != null && !_crls.isEmpty())
-                {
-                    pbParams.addCertStore(CertStore.getInstance("Collection", new CollectionCertStoreParameters(_crls)));
-                }
-
-                // Enable revocation checking
-                pbParams.setRevocationEnabled(true);
-
-                // Set maximum certification path length
-                pbParams.setMaxPathLength(_maxCertPathLength);
- 
-                // Build certification path
-                CertPathBuilderResult buildResult = CertPathBuilder.getInstance("PKIX").build(pbParams);               
-                
-                // Validate certification path
-                CertPathValidator.getInstance("PKIX").validate(buildResult.getCertPath(),pbParams);
-            }
-            catch (Exception ex)
-            {
-                Log.debug(ex);
-                throw new CertificateException("Unable to validate certificate for alias [" +
-                                               certAlias + "]: " + ex.getMessage());
-            }
-        } 
-    }
-
-    public int getMaxCertPathLength()
-    {
-        return _maxCertPathLength;
-    }
-
-    public void setMaxCertPathLength(int maxCertPathLength)
-    {
-        _maxCertPathLength = maxCertPathLength;
-    }
-
-    public KeyStore getKeyStore()
-    {
-        return _keyStore;
-    }
-
-    public KeyStore getTrustStore()
-    {
-        return _trustStore;
-    }
-
-    public Collection<? extends CRL> getCrls()
-    {
-        return _crls;
-    }
-}
diff --git a/jetty-exssl/src/main/java/org/eclipse/jetty/exssl/SslSelectChannelConnector.java b/jetty-exssl/src/main/java/org/eclipse/jetty/exssl/SslSelectChannelConnector.java
index c5dfabc..1508157 100644
--- a/jetty-exssl/src/main/java/org/eclipse/jetty/exssl/SslSelectChannelConnector.java
+++ b/jetty-exssl/src/main/java/org/eclipse/jetty/exssl/SslSelectChannelConnector.java
@@ -28,6 +28,7 @@
 import org.eclipse.jetty.io.Buffers;
 import org.eclipse.jetty.io.Connection;
 import org.eclipse.jetty.io.EndPoint;
+import org.eclipse.jetty.io.SslContextFactory;
 import org.eclipse.jetty.io.ThreadLocalBuffers;
 import org.eclipse.jetty.io.bio.SocketEndPoint;
 import org.eclipse.jetty.io.nio.DirectNIOBuffer;
@@ -53,19 +54,19 @@
  */
 public class SslSelectChannelConnector extends SelectChannelConnector implements SslConnector
 {
-    private final SslParameters _sslParams;
+    private final SslContextFactory _sslContextFactory;
     private Buffers _sslBuffers;
 
     /* ------------------------------------------------------------ */
     public SslSelectChannelConnector()
     {
-        this(new SslParameters());
+        this(new SslContextFactory().setKeystore(SslContextFactory.DEFAULT_KEYSTORE_PATH));
     }
 
     /* ------------------------------------------------------------ */
-    public SslSelectChannelConnector(SslParameters sslParams)
+    public SslSelectChannelConnector(SslContextFactory sslContextFactory)
     {
-        _sslParams = sslParams;
+        _sslContextFactory = sslContextFactory;
         setUseDirectBuffers(false);
     }
 
@@ -114,7 +115,7 @@
      */
     public boolean isAllowRenegotiate()
     {
-        return _sslParams.isAllowRenegotiate();
+        return _sslContextFactory.isAllowRenegotiate();
     }
 
     /* ------------------------------------------------------------ */
@@ -127,7 +128,7 @@
      */
     public void setAllowRenegotiate(boolean allowRenegotiate)
     {
-        _sslParams.setAllowRenegotiate(allowRenegotiate);
+        _sslContextFactory.setAllowRenegotiate(allowRenegotiate);
     }
 
     /* ------------------------------------------------------------ */
@@ -136,7 +137,7 @@
      */
     public String[] getExcludeCipherSuites()
     {
-        return _sslParams.getExcludeCipherSuites();
+        return _sslContextFactory.getExcludeCipherSuites();
     }
 
     /* ------------------------------------------------------------ */
@@ -145,7 +146,7 @@
      */
     public void setExcludeCipherSuites(String[] cipherSuites)
     {
-        _sslParams.setExcludeCipherSuites(cipherSuites);
+        _sslContextFactory.setExcludeCipherSuites(cipherSuites);
     }
 
     /* ------------------------------------------------------------ */
@@ -154,7 +155,7 @@
      */
     public String[] getIncludeCipherSuites()
     {
-        return _sslParams.getIncludeCipherSuites();
+        return _sslContextFactory.getIncludeCipherSuites();
     }
 
     /* ------------------------------------------------------------ */
@@ -163,7 +164,7 @@
      */
     public void setIncludeCipherSuites(String[] cipherSuites)
     {
-        _sslParams.setIncludeCipherSuites(cipherSuites);
+        _sslContextFactory.setIncludeCipherSuites(cipherSuites);
     }
 
     /* ------------------------------------------------------------ */
@@ -172,7 +173,7 @@
      */
     public void setPassword(String password)
     {
-        _sslParams.setPassword(password);
+        _sslContextFactory.setKeyStorePassword(password);
     }
 
     /* ------------------------------------------------------------ */
@@ -181,7 +182,7 @@
      */
     public void setTrustPassword(String password)
     {
-        _sslParams.setTrustPassword(password);
+        _sslContextFactory.setTrustStorePassword(password);
     }
 
     /* ------------------------------------------------------------ */
@@ -190,7 +191,7 @@
      */
     public void setKeyPassword(String password)
     {
-        _sslParams.setKeyPassword(password);
+        _sslContextFactory.setKeyManagerPassword(password);
     }
 
     /* ------------------------------------------------------------ */
@@ -221,7 +222,7 @@
      */
     public String getProtocol()
     {
-        return _sslParams.getProtocol();
+        return _sslContextFactory.getProtocol();
     }
 
     /* ------------------------------------------------------------ */
@@ -230,7 +231,7 @@
      */
     public void setProtocol(String protocol)
     {
-        _sslParams.setProtocol(protocol);
+        _sslContextFactory.setProtocol(protocol);
     }
 
     /* ------------------------------------------------------------ */
@@ -239,7 +240,7 @@
      */
     public void setKeystore(String keystore)
     {
-        _sslParams.setKeystore(keystore);
+        _sslContextFactory.setKeystore(keystore);
     }
 
     /* ------------------------------------------------------------ */
@@ -248,7 +249,7 @@
      */
     public String getKeystore()
     {
-        return _sslParams.getKeystore();
+        return _sslContextFactory.getKeystore();
     }
 
     /* ------------------------------------------------------------ */
@@ -257,7 +258,7 @@
      */
     public String getKeystoreType()
     {
-        return _sslParams.getKeystoreType();
+        return _sslContextFactory.getKeystoreType();
     }
 
     /* ------------------------------------------------------------ */
@@ -266,7 +267,7 @@
      */
     public boolean getNeedClientAuth()
     {
-        return _sslParams.getNeedClientAuth();
+        return _sslContextFactory.getNeedClientAuth();
     }
 
     /* ------------------------------------------------------------ */
@@ -275,7 +276,7 @@
      */
     public boolean getWantClientAuth()
     {
-        return _sslParams.getWantClientAuth();
+        return _sslContextFactory.getWantClientAuth();
     }
 
     /* ------------------------------------------------------------ */
@@ -284,7 +285,7 @@
      */
     public void setNeedClientAuth(boolean needClientAuth)
     {
-        _sslParams.setNeedClientAuth(needClientAuth);
+        _sslContextFactory.setNeedClientAuth(needClientAuth);
     }
 
     /* ------------------------------------------------------------ */
@@ -293,7 +294,7 @@
      */
     public void setWantClientAuth(boolean wantClientAuth)
     {
-        _sslParams.setWantClientAuth(wantClientAuth);
+        _sslContextFactory.setWantClientAuth(wantClientAuth);
     }
 
     /* ------------------------------------------------------------ */
@@ -302,7 +303,7 @@
      */
     public void setKeystoreType(String keystoreType)
     {
-        _sslParams.setKeystoreType(keystoreType);
+        _sslContextFactory.setKeystoreType(keystoreType);
     }
 
     /* ------------------------------------------------------------ */
@@ -311,7 +312,7 @@
      */
     public String getProvider()
     {
-        return _sslParams.getProvider();
+        return _sslContextFactory.getProvider();
     }
 
     /* ------------------------------------------------------------ */
@@ -320,7 +321,7 @@
      */
     public String getSecureRandomAlgorithm()
     {
-        return _sslParams.getSecureRandomAlgorithm();
+        return _sslContextFactory.getSecureRandomAlgorithm();
     }
 
     /* ------------------------------------------------------------ */
@@ -329,7 +330,7 @@
      */
     public String getSslKeyManagerFactoryAlgorithm()
     {
-        return _sslParams.getSslKeyManagerFactoryAlgorithm();
+        return _sslContextFactory.getSslKeyManagerFactoryAlgorithm();
     }
 
     /* ------------------------------------------------------------ */
@@ -338,7 +339,7 @@
      */
     public String getSslTrustManagerFactoryAlgorithm()
     {
-        return _sslParams.getSslTrustManagerFactoryAlgorithm();
+        return _sslContextFactory.getTrustManagerFactoryAlgorithm();
     }
 
     /* ------------------------------------------------------------ */
@@ -347,7 +348,7 @@
      */
     public String getTruststore()
     {
-        return _sslParams.getTruststore();
+        return _sslContextFactory.getTruststore();
     }
 
     /* ------------------------------------------------------------ */
@@ -356,7 +357,7 @@
      */
     public String getTruststoreType()
     {
-        return _sslParams.getTruststoreType();
+        return _sslContextFactory.getTruststoreType();
     }
 
     /* ------------------------------------------------------------ */
@@ -365,7 +366,7 @@
      */
     public void setProvider(String provider)
     {
-        _sslParams.setProvider(provider);
+        _sslContextFactory.setProvider(provider);
     }
 
     /* ------------------------------------------------------------ */
@@ -374,7 +375,7 @@
      */
     public void setSecureRandomAlgorithm(String algorithm)
     {
-        _sslParams.setSecureRandomAlgorithm(algorithm);
+        _sslContextFactory.setSecureRandomAlgorithm(algorithm);
     }
 
     /* ------------------------------------------------------------ */
@@ -383,7 +384,7 @@
      */
     public void setSslKeyManagerFactoryAlgorithm(String algorithm)
     {
-        _sslParams.setSslKeyManagerFactoryAlgorithm(algorithm);
+        _sslContextFactory.setSslKeyManagerFactoryAlgorithm(algorithm);
     }
 
     /* ------------------------------------------------------------ */
@@ -392,7 +393,7 @@
      */
     public void setSslTrustManagerFactoryAlgorithm(String algorithm)
     {
-        _sslParams.setSslTrustManagerFactoryAlgorithm(algorithm);
+        _sslContextFactory.setTrustManagerFactoryAlgorithm(algorithm);
     }
 
     /* ------------------------------------------------------------ */
@@ -401,7 +402,7 @@
      */
     public void setTruststore(String truststore)
     {
-        _sslParams.setTruststore(truststore);
+        _sslContextFactory.setTruststore(truststore);
     }
 
     /* ------------------------------------------------------------ */
@@ -410,7 +411,7 @@
      */
     public void setTruststoreType(String truststoreType)
     {
-        _sslParams.setTruststoreType(truststoreType);
+        _sslContextFactory.setTruststoreType(truststoreType);
     }
 
     /* ------------------------------------------------------------ */
@@ -419,7 +420,7 @@
      */
     public void setSslContext(SSLContext sslContext)
     {
-        _sslParams.setSslContext(sslContext);
+        _sslContextFactory.setSslContext(sslContext);
     }
 
     /* ------------------------------------------------------------ */
@@ -428,7 +429,7 @@
      */
     public SSLContext getSslContext()
     {
-        return _sslParams.getSslContext();
+        return _sslContextFactory.getSslContext();
     }
 
     /* ------------------------------------------------------------ */
@@ -468,7 +469,7 @@
     protected SelectChannelEndPoint newEndPoint(SocketChannel channel, SelectSet selectSet, SelectionKey key) throws IOException
     {
         SslSelectChannelEndPoint endp = new SslSelectChannelEndPoint(_sslBuffers,channel,selectSet,key,createSSLEngine(), SslSelectChannelConnector.this._maxIdleTime);
-        endp.setAllowRenegotiate(_sslParams.isAllowRenegotiate());
+        endp.setAllowRenegotiate(_sslContextFactory.isAllowRenegotiate());
         return endp;
     }
 
@@ -505,15 +506,15 @@
     @Override
     protected void doStart() throws Exception
     {
-        _sslParams.createSSLContext(); // called here to prevent exception wrapping 
+        _sslContextFactory.createSSLContext(); // called here to prevent exception wrapping 
         
-        SSLEngine sslEngine = _sslParams.getSslContext().createSSLEngine();
+        SSLEngine sslEngine = _sslContextFactory.getSslContext().createSSLEngine();
 
         sslEngine.setUseClientMode(false);
-        sslEngine.setWantClientAuth(_sslParams.getWantClientAuth());
-        sslEngine.setNeedClientAuth(_sslParams.getNeedClientAuth());
+        sslEngine.setWantClientAuth(_sslContextFactory.getWantClientAuth());
+        sslEngine.setNeedClientAuth(_sslContextFactory.getNeedClientAuth());
         
-        sslEngine.setEnabledCipherSuites(_sslParams.selectCipherSuites(
+        sslEngine.setEnabledCipherSuites(_sslContextFactory.selectCipherSuites(
                                             sslEngine.getEnabledCipherSuites(),
                                             sslEngine.getSupportedCipherSuites()));
         
diff --git a/jetty-exssl/src/main/java/org/eclipse/jetty/exssl/SslSocketConnector.java b/jetty-exssl/src/main/java/org/eclipse/jetty/exssl/SslSocketConnector.java
index a441329..b826344 100644
--- a/jetty-exssl/src/main/java/org/eclipse/jetty/exssl/SslSocketConnector.java
+++ b/jetty-exssl/src/main/java/org/eclipse/jetty/exssl/SslSocketConnector.java
@@ -29,6 +29,7 @@
 
 import org.eclipse.jetty.http.HttpSchemes;
 import org.eclipse.jetty.io.EndPoint;
+import org.eclipse.jetty.io.SslContextFactory;
 import org.eclipse.jetty.io.bio.SocketEndPoint;
 import org.eclipse.jetty.server.Request;
 import org.eclipse.jetty.server.bio.SocketConnector;
@@ -53,7 +54,7 @@
  */
 public class SslSocketConnector extends SocketConnector  implements SslConnector
 {
-    private final SslParameters _sslParams;
+    private final SslContextFactory _sslContextFactory;
     private int _handshakeTimeout = 0; //0 means use maxIdleTime
 
     /* ------------------------------------------------------------ */
@@ -62,12 +63,12 @@
      */
     public SslSocketConnector()
     {
-        this(new SslParameters());
+        this(new SslContextFactory().setKeystore(SslContextFactory.DEFAULT_KEYSTORE_PATH));
     }
 
-    public SslSocketConnector(SslParameters sslParams)
+    public SslSocketConnector(SslContextFactory sslContextFactory)
     {
-        _sslParams = sslParams;
+        _sslContextFactory = sslContextFactory;
     }
 
     /* ------------------------------------------------------------ */
@@ -76,7 +77,7 @@
      */
     public boolean isAllowRenegotiate()
     {
-        return _sslParams.isAllowRenegotiate();
+        return _sslContextFactory.isAllowRenegotiate();
     }
 
     /* ------------------------------------------------------------ */
@@ -89,7 +90,7 @@
      */
     public void setAllowRenegotiate(boolean allowRenegotiate)
     {
-        _sslParams.setAllowRenegotiate(allowRenegotiate);
+        _sslContextFactory.setAllowRenegotiate(allowRenegotiate);
     }
 
     /* ------------------------------------------------------------ */
@@ -148,78 +149,78 @@
 
     /* ------------------------------------------------------------ */    
     public String[] getExcludeCipherSuites() {
-        return _sslParams.getExcludeCipherSuites();
+        return _sslContextFactory.getExcludeCipherSuites();
     }
     
     /* ------------------------------------------------------------ */
     public String[] getIncludeCipherSuites()
     {
-        return _sslParams.getIncludeCipherSuites();
+        return _sslContextFactory.getIncludeCipherSuites();
     }
 
     /* ------------------------------------------------------------ */
     public String getKeystore()
     {
-        return _sslParams.getKeystore();
+        return _sslContextFactory.getKeystore();
     }
 
     /* ------------------------------------------------------------ */
     public String getKeystoreType() 
     {
-        return _sslParams.getKeystoreType();
+        return _sslContextFactory.getKeystoreType();
     }
 
     /* ------------------------------------------------------------ */
     public boolean getNeedClientAuth()
     {
-        return _sslParams.getNeedClientAuth();
+        return _sslContextFactory.getNeedClientAuth();
     }
 
     /* ------------------------------------------------------------ */
     public String getProtocol() 
     {
-        return _sslParams.getProtocol();
+        return _sslContextFactory.getProtocol();
     }
 
     /* ------------------------------------------------------------ */
     public String getProvider() {
-	return _sslParams.getProvider();
+	return _sslContextFactory.getProvider();
     }
 
     /* ------------------------------------------------------------ */
     public String getSecureRandomAlgorithm() 
     {
-        return _sslParams.getSecureRandomAlgorithm();
+        return _sslContextFactory.getSecureRandomAlgorithm();
     }
 
     /* ------------------------------------------------------------ */
     public String getSslKeyManagerFactoryAlgorithm() 
     {
-        return _sslParams.getSslKeyManagerFactoryAlgorithm();
+        return _sslContextFactory.getSslKeyManagerFactoryAlgorithm();
     }
 
     /* ------------------------------------------------------------ */
     public String getSslTrustManagerFactoryAlgorithm() 
     {
-        return _sslParams.getSslTrustManagerFactoryAlgorithm();
+        return _sslContextFactory.getTrustManagerFactoryAlgorithm();
     }
 
     /* ------------------------------------------------------------ */
     public String getTruststore()
     {
-        return _sslParams.getTruststore();
+        return _sslContextFactory.getTruststore();
     }
 
     /* ------------------------------------------------------------ */
     public String getTruststoreType()
     {
-        return _sslParams.getTruststoreType();
+        return _sslContextFactory.getTruststoreType();
     }
 
     /* ------------------------------------------------------------ */
     public boolean getWantClientAuth()
     {
-        return _sslParams.getWantClientAuth();
+        return _sslContextFactory.getWantClientAuth();
     }
 
     /* ------------------------------------------------------------ */
@@ -259,7 +260,7 @@
     @Override
     protected void doStart() throws Exception
     {
-        _sslParams.createSSLContext(); // called here to prevent exception wrapping
+        _sslContextFactory.createSSLContext(); // called here to prevent exception wrapping
         
         super.doStart();
     }
@@ -278,17 +279,17 @@
     @Override
     protected ServerSocket newServerSocket(String host, int port,int backlog) throws IOException
     {
-        SSLServerSocketFactory factory = _sslParams.getSslContext().getServerSocketFactory();
+        SSLServerSocketFactory factory = _sslContextFactory.getSslContext().getServerSocketFactory();
 
         SSLServerSocket socket = 
             (SSLServerSocket) (host==null ?
                         factory.createServerSocket(port,backlog):
                         factory.createServerSocket(port,backlog,InetAddress.getByName(host)));
 
-        socket.setWantClientAuth(_sslParams.getWantClientAuth());
-        socket.setNeedClientAuth(_sslParams.getNeedClientAuth());
+        socket.setWantClientAuth(_sslContextFactory.getWantClientAuth());
+        socket.setNeedClientAuth(_sslContextFactory.getNeedClientAuth());
 
-        socket.setEnabledCipherSuites(_sslParams.selectCipherSuites(
+        socket.setEnabledCipherSuites(_sslContextFactory.selectCipherSuites(
                                             socket.getEnabledCipherSuites(),
                                             socket.getSupportedCipherSuites()));
         return socket;
@@ -300,19 +301,19 @@
      */
     public void setExcludeCipherSuites(String[] cipherSuites)
     {
-        _sslParams.setExcludeCipherSuites(cipherSuites);
+        _sslContextFactory.setExcludeCipherSuites(cipherSuites);
     }
 
     /* ------------------------------------------------------------ */
     public void setIncludeCipherSuites(String[] cipherSuites)
     {
-        _sslParams.setIncludeCipherSuites(cipherSuites);
+        _sslContextFactory.setIncludeCipherSuites(cipherSuites);
     }
 
     /* ------------------------------------------------------------ */
     public void setKeyPassword(String password)
     {
-        _sslParams.setKeyPassword(password);
+        _sslContextFactory.setKeyManagerPassword(password);
     }
 
     /* ------------------------------------------------------------ */
@@ -321,13 +322,13 @@
      */
     public void setKeystore(String keystore)
     {
-        _sslParams.setKeystore(keystore);
+        _sslContextFactory.setKeystore(keystore);
     }
 
     /* ------------------------------------------------------------ */
     public void setKeystoreType(String keystoreType) 
     {
-        _sslParams.setKeystoreType(keystoreType);
+        _sslContextFactory.setKeystoreType(keystoreType);
     }
 
     /* ------------------------------------------------------------ */
@@ -338,65 +339,65 @@
      */
     public void setNeedClientAuth(boolean needClientAuth)
     {
-        _sslParams.setNeedClientAuth(needClientAuth);
+        _sslContextFactory.setNeedClientAuth(needClientAuth);
     }
     
     /* ------------------------------------------------------------ */
     public void setPassword(String password)
     {
-        _sslParams.setPassword(password);
+        _sslContextFactory.setKeyStorePassword(password);
     }
     
     /* ------------------------------------------------------------ */
     public void setTrustPassword(String password)
     {
-        _sslParams.setTrustPassword(password);
+        _sslContextFactory.setTrustStorePassword(password);
     }
 
     /* ------------------------------------------------------------ */
     public void setProtocol(String protocol) 
     {
-        _sslParams.setProtocol(protocol);
+        _sslContextFactory.setProtocol(protocol);
     }
 
     /* ------------------------------------------------------------ */
     public void setProvider(String provider) {
-        _sslParams.setProvider(provider);
+        _sslContextFactory.setProvider(provider);
     }
 
     /* ------------------------------------------------------------ */
     public void setSecureRandomAlgorithm(String algorithm) 
     {
-        _sslParams.setSecureRandomAlgorithm(algorithm);
+        _sslContextFactory.setSecureRandomAlgorithm(algorithm);
     }
 
     /* ------------------------------------------------------------ */
     public void setSslKeyManagerFactoryAlgorithm(String algorithm) 
     {
-        _sslParams.setSslKeyManagerFactoryAlgorithm(algorithm);
+        _sslContextFactory.setSslKeyManagerFactoryAlgorithm(algorithm);
     }
     
     /* ------------------------------------------------------------ */
     public void setSslTrustManagerFactoryAlgorithm(String algorithm) 
     {
-        _sslParams.setSslTrustManagerFactoryAlgorithm(algorithm);
+        _sslContextFactory.setTrustManagerFactoryAlgorithm(algorithm);
     }
 
 
     public void setTruststore(String truststore)
     {
-        _sslParams.setTruststore(truststore);
+        _sslContextFactory.setTruststore(truststore);
     }
     
 
     public void setTruststoreType(String truststoreType)
     {
-        _sslParams.setTruststoreType(truststoreType);
+        _sslContextFactory.setTruststoreType(truststoreType);
     }
     
     public void setSslContext(SSLContext sslContext)
     {
-        _sslParams.setSslContext(sslContext);
+        _sslContextFactory.setSslContext(sslContext);
     }
 
     /* ------------------------------------------------------------ */
@@ -405,7 +406,7 @@
      */
     public SSLContext getSslContext()
     {
-        return _sslParams.getSslContext();
+        return _sslContextFactory.getSslContext();
     }
 
     /* ------------------------------------------------------------ */
@@ -418,7 +419,7 @@
      */
     public void setWantClientAuth(boolean wantClientAuth)
     {
-        _sslParams.setWantClientAuth(wantClientAuth);
+        _sslContextFactory.setWantClientAuth(wantClientAuth);
     }
 
     /* ------------------------------------------------------------ */
@@ -471,7 +472,7 @@
                     {
                         if (handshook)
                         {
-                            if (!_sslParams.isAllowRenegotiate())
+                            if (!_sslContextFactory.isAllowRenegotiate())
                             {
                                 Log.warn("SSL renegotiate denied: "+ssl);
                                 try{ssl.close();}catch(IOException e){Log.warn(e);}
diff --git a/jetty-exssl/src/main/java/org/eclipse/jetty/exssl/SslParameters.java b/jetty-exssl/src/main/java/org/eclipse/jetty/io/SslContextFactory.java
similarity index 65%
rename from jetty-exssl/src/main/java/org/eclipse/jetty/exssl/SslParameters.java
rename to jetty-exssl/src/main/java/org/eclipse/jetty/io/SslContextFactory.java
index 90f9e40..b052194 100644
--- a/jetty-exssl/src/main/java/org/eclipse/jetty/exssl/SslParameters.java
+++ b/jetty-exssl/src/main/java/org/eclipse/jetty/io/SslContextFactory.java
@@ -1,6 +1,9 @@
-package org.eclipse.jetty.exssl;
+package org.eclipse.jetty.io;
 
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
 import java.io.File;
+import java.io.IOException;
 import java.io.InputStream;
 import java.security.KeyStore;
 import java.security.SecureRandom;
@@ -26,21 +29,25 @@
 import javax.net.ssl.TrustManager;
 import javax.net.ssl.TrustManagerFactory;
 import javax.net.ssl.X509KeyManager;
+import javax.net.ssl.X509TrustManager;
 
+import org.eclipse.jetty.exssl.SslExtendedKeyManager;
 import org.eclipse.jetty.http.security.Password;
+import org.eclipse.jetty.util.IO;
 import org.eclipse.jetty.util.resource.Resource;
+import org.eclipse.jetty.util.security.CertificateValidator;
 
-public class SslParameters
+public class SslContextFactory
 {
-    public static final String DEFAULT_KEYSTORE_ALGORITHM = 
+    public static final String DEFAULT_KEYMANAGERFACTORY_ALGORITHM = 
         (Security.getProperty("ssl.KeyManagerFactory.algorithm") == null ?
                 "SunX509" : Security.getProperty("ssl.KeyManagerFactory.algorithm"));
-    public static final String DEFAULT_TRUSTSTORE_ALGORITHM = 
+    public static final String DEFAULT_TRUSTMANAGERFACTORY_ALGORITHM = 
         (Security.getProperty("ssl.TrustManagerFactory.algorithm") == null ?
                 "SunX509" : Security.getProperty("ssl.TrustManagerFactory.algorithm"));
 
     /** Default value for the keystore location path. */
-    public static final String DEFAULT_KEYSTORE = 
+    public static final String DEFAULT_KEYSTORE_PATH = 
         System.getProperty("user.home") + File.separator + ".keystore";
 
     /** String name of key password property. */
@@ -54,21 +61,26 @@
     /** Included cipher suites. */
     private String _includeCipherSuites[] = null;
 
-    /** KeyStore path. */
-    private String _keystorePath = DEFAULT_KEYSTORE;
-    /** KeyStore provider name */
+    /** Keystore path. */
+    private String _keystorePath;
+    /** Keystore provider name */
     private String _keystoreProvider;
-    /** KeyStore type */
+    /** Keystore type */
     private String _keystoreType = "JKS";
+    /** Keystore input stream */
+    private InputStream _keystoreInputStream;
+    
     /** SSL certificate alias */
     private String _certAlias;
 
-    /** TrustStore path */
+    /** Truststore path */
     private String _truststorePath;
-    /** TrustStore provider name */
+    /** Truststore provider name */
     private String _truststoreProvider;
-    /** TrustStore type */
+    /** Truststore type */
     private String _truststoreType = "JKS";
+    /** Truststore input stream */
+    private InputStream _truststoreInputStream;
 
     /** Set to true if client certificate authentication is required */
     private boolean _needClientAuth = false;
@@ -80,11 +92,11 @@
     private boolean _allowRenegotiate = false;
 
     /** KeyStore password */
-    private transient Password _password;
+    private transient Password _keystorePassword;
     /** Key password */
-    private transient Password _keyPassword;
+    private transient Password _keymanagerPassword;
     /** TrustStore password */
-    private transient Password _trustPassword;
+    private transient Password _truststorePassword;
 
     /** SSL Provider name */
     private String _sslProvider;
@@ -94,9 +106,9 @@
     /** SecureRandom algorithm */
     private String _secureRandomAlgorithm;
     /** KeyManager factory algorithm */
-    private String _sslKeyManagerFactoryAlgorithm = DEFAULT_KEYSTORE_ALGORITHM;
+    private String _keyManagerFactoryAlgorithm = DEFAULT_KEYMANAGERFACTORY_ALGORITHM;
     /** TrustManager factory algorithm */
-    private String _sslTrustManagerFactoryAlgorithm = DEFAULT_TRUSTSTORE_ALGORITHM;
+    private String _trustManagerFactoryAlgorithm = DEFAULT_TRUSTMANAGERFACTORY_ALGORITHM;
 
     /** Path to file that contains Certificate Revocation List */
     private String _crlPath;
@@ -122,9 +134,11 @@
      *            The array of cipher suite names to exclude from
      *            {@link SSLEngine#setEnabledCipherSuites(String[])}
      */
-    public void setExcludeCipherSuites(String[] cipherSuites)
+    public SslContextFactory setExcludeCipherSuites(String[] cipherSuites)
     {
         _excludeCipherSuites = cipherSuites;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -143,9 +157,11 @@
      *            The array of cipher suite names to include in
      *            {@link SSLEngine#setEnabledCipherSuites(String[])}
      */
-    public void setIncludeCipherSuites(String[] cipherSuites)
+    public SslContextFactory setIncludeCipherSuites(String[] cipherSuites)
     {
         _includeCipherSuites = cipherSuites;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -162,9 +178,11 @@
      * @param keystore
      *            The file or URL of the SSL Key store.
      */
-    public void setKeystore(String keystore)
+    public SslContextFactory setKeystore(String keystore)
     {
         _keystorePath = keystore;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -181,9 +199,11 @@
      * @param keystoreProvider
      *            The provider of the key store
      */
-    public void setKeystoreProvider(String keystoreProvider)
+    public SslContextFactory setKeystoreProvider(String keystoreProvider)
     {
         _keystoreProvider = keystoreProvider;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -200,9 +220,33 @@
      * @param keystoreType
      *            The type of the key store (default "JKS")
      */
-    public void setKeystoreType(String keystoreType)
+    public SslContextFactory setKeystoreType(String keystoreType)
     {
         _keystoreType = keystoreType;
+        
+        return this;
+    }
+
+    /* ------------------------------------------------------------ */
+    /** Get the _keystoreInputStream.
+     * @return the _keystoreInputStream
+     */
+    public InputStream getKeystoreInputStream()
+    {
+        checkConfig();
+        
+        return _keystoreInputStream;
+    }
+
+    /* ------------------------------------------------------------ */
+    /** Set the _keystoreInputStream.
+     * @param _keystoreInputStream the _keystoreInputStream to set
+     */
+    public SslContextFactory setKeystoreInputStream(InputStream keystoreInputStream)
+    {
+        _keystoreInputStream = keystoreInputStream;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -219,9 +263,11 @@
      * @param certAlias
      *            Alias of SSL certificate for the connector
      */
-    public void setCertAlias(String certAlias)
+    public SslContextFactory setCertAlias(String certAlias)
     {
         _certAlias = certAlias;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -238,9 +284,11 @@
      * @param truststore
      *            The file name or URL of the trust store location
      */
-    public void setTruststore(String truststore)
+    public SslContextFactory setTruststore(String truststore)
     {
         _truststorePath = truststore;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -257,9 +305,11 @@
      * @param truststoreProvider
      *            The provider of the trust store
      */
-    public void setTruststoreProvider(String truststoreProvider)
+    public SslContextFactory setTruststoreProvider(String truststoreProvider)
     {
         _truststoreProvider = truststoreProvider;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -276,9 +326,33 @@
      * @param truststoreType
      *            The type of the trust store (default "JKS")
      */
-    public void setTruststoreType(String truststoreType)
+    public SslContextFactory setTruststoreType(String truststoreType)
     {
         _truststoreType = truststoreType;
+        
+        return this;
+    }
+
+    /* ------------------------------------------------------------ */
+    /** Get the _truststoreInputStream.
+     * @return the _truststoreInputStream
+     */
+    public InputStream getTruststoreInputStream()
+    {
+        checkConfig();
+        
+        return _truststoreInputStream;
+    }
+
+    /* ------------------------------------------------------------ */
+    /** Set the _truststoreInputStream.
+     * @param _truststoreInputStream the _truststoreInputStream to set
+     */
+    public SslContextFactory setTruststoreInputStream(InputStream truststoreInputStream)
+    {
+        _truststoreInputStream = truststoreInputStream;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -297,9 +371,11 @@
      *            True if SSL needs client authentication.
      * @see SSLEngine#getNeedClientAuth()
      */
-    public void setNeedClientAuth(boolean needClientAuth)
+    public SslContextFactory setNeedClientAuth(boolean needClientAuth)
     {
         _needClientAuth = needClientAuth;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -318,9 +394,11 @@
      *            True if SSL wants client authentication.
      * @see SSLEngine#getWantClientAuth()
      */
-    public void setWantClientAuth(boolean wantClientAuth)
+    public SslContextFactory setWantClientAuth(boolean wantClientAuth)
     {
         _wantClientAuth = wantClientAuth;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -337,9 +415,11 @@
      * @param validateServerCert
      *            true if SSL certificate has to be validated
      */
-    public void setValidateCerts(boolean validateCerts)
+    public SslContextFactory setValidateCerts(boolean validateCerts)
     {
         _validateCerts = validateCerts;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -360,9 +440,11 @@
      * @param allowRenegotiate
      *            true if re-negotiation is allowed (default false)
      */
-    public void setAllowRenegotiate(boolean allowRenegotiate)
+    public SslContextFactory setAllowRenegotiate(boolean allowRenegotiate)
     {
         _allowRenegotiate = allowRenegotiate;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -370,9 +452,11 @@
      * @param password
      *            The password for the key store
      */
-    public void setPassword(String password)
+    public SslContextFactory setKeyStorePassword(String password)
     {
-        _password = Password.getPassword(PASSWORD_PROPERTY,password,null);
+        _keystorePassword = Password.getPassword(PASSWORD_PROPERTY,password,null);
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -380,9 +464,11 @@
      * @param password
      *            The password (if any) for the specific key within the key store
      */
-    public void setKeyPassword(String password)
+    public SslContextFactory setKeyManagerPassword(String password)
     {
-        _keyPassword = Password.getPassword(KEYPASSWORD_PROPERTY,password,null);
+        _keymanagerPassword = Password.getPassword(KEYPASSWORD_PROPERTY,password,null);
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -390,9 +476,11 @@
      * @param password
      *            The password for the trust store
      */
-    public void setTrustPassword(String password)
+    public SslContextFactory setTrustStorePassword(String password)
     {
-        _trustPassword = Password.getPassword(PASSWORD_PROPERTY,password,null);
+        _truststorePassword = Password.getPassword(PASSWORD_PROPERTY,password,null);
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -411,9 +499,11 @@
      *            The SSL provider name, which if set is passed to
      *            {@link SSLContext#getInstance(String, String)}
      */
-    public void setProvider(String provider)
+    public SslContextFactory setProvider(String provider)
     {
         _sslProvider = provider;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -432,9 +522,11 @@
      *            The SSL protocol (default "TLS") passed to
      *            {@link SSLContext#getInstance(String, String)}
      */
-    public void setProtocol(String protocol)
+    public SslContextFactory setProtocol(String protocol)
     {
         _sslProtocol = protocol;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -455,9 +547,11 @@
      *            {@link SecureRandom#getInstance(String)} to obtain the {@link SecureRandom} instance passed to
      *            {@link SSLContext#init(javax.net.ssl.KeyManager[], javax.net.ssl.TrustManager[], SecureRandom)}
      */
-    public void setSecureRandomAlgorithm(String algorithm)
+    public SslContextFactory setSecureRandomAlgorithm(String algorithm)
     {
         _secureRandomAlgorithm = algorithm;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -466,7 +560,7 @@
      */
     public String getSslKeyManagerFactoryAlgorithm()
     {
-        return (_sslKeyManagerFactoryAlgorithm);
+        return (_keyManagerFactoryAlgorithm);
     }
 
     /* ------------------------------------------------------------ */
@@ -474,18 +568,20 @@
      * @param algorithm
      *            The algorithm name (default "SunX509") used by the {@link KeyManagerFactory}
      */
-    public void setSslKeyManagerFactoryAlgorithm(String algorithm)
+    public SslContextFactory setSslKeyManagerFactoryAlgorithm(String algorithm)
     {
-        _sslKeyManagerFactoryAlgorithm = algorithm;
+        _keyManagerFactoryAlgorithm = algorithm;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
     /**
      * @return The algorithm name (default "SunX509") used by the {@link TrustManagerFactory}
      */
-    public String getSslTrustManagerFactoryAlgorithm()
+    public String getTrustManagerFactoryAlgorithm()
     {
-        return (_sslTrustManagerFactoryAlgorithm);
+        return (_trustManagerFactoryAlgorithm);
     }
 
     /* ------------------------------------------------------------ */
@@ -493,9 +589,11 @@
      * @param algorithm
      *            The algorithm name (default "SunX509") used by the {@link TrustManagerFactory}
      */
-    public void setSslTrustManagerFactoryAlgorithm(String algorithm)
+    public SslContextFactory setTrustManagerFactoryAlgorithm(String algorithm)
     {
-        _sslTrustManagerFactoryAlgorithm = algorithm;
+        _trustManagerFactoryAlgorithm = algorithm;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -512,9 +610,11 @@
      * @param crlPath
      *            Path to file that contains Certificate Revocation List
      */
-    public void setCrlPath(String crlPath)
+    public SslContextFactory setCrlPath(String crlPath)
     {
         _crlPath = crlPath;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -533,9 +633,11 @@
      *            maximum number of intermediate certificates in
      *            the certification path (-1 for unlimited)
      */
-    public void setMaxCertPathLength(int maxCertPathLength)
+    public SslContextFactory setMaxCertPathLength(int maxCertPathLength)
     {
         _maxCertPathLength = maxCertPathLength;
+        
+        return this;
     }
 
     /* ------------------------------------------------------------ */
@@ -562,16 +664,80 @@
      * @param sslContext
      *            Set a preconfigured SSLContext
      */
-    public void setSslContext(SSLContext sslContext)
+    public SslContextFactory setSslContext(SSLContext sslContext)
     {
         _context = sslContext;
+        
+        return this;
+    }
+    
+    /* ------------------------------------------------------------ */
+    /**
+     * @return The SSLContext
+     */
+    public SSLContext getClientSslContext()
+    {
+        try
+        {
+            if (_context == null)
+                _context = createClientSSLContext();
+        }
+        catch (Exception e)
+        {
+            throw new RuntimeException(e);
+        }
+
+        return _context;
     }
 
     /* ------------------------------------------------------------ */
-    protected SSLContext createSSLContext() throws Exception
+    /**
+     * @return SSL context for the client code
+     */
+    public SSLContext createClientSSLContext() throws Exception
     {
-        KeyStore keyStore = getKeyStore(_keystorePath,_keystoreType,_keystoreProvider,_password == null?null:_password.toString());
-        KeyStore trustStore = getTrustStore(_truststorePath,_truststoreType,_truststoreProvider,_trustPassword == null?null:_trustPassword.toString());
+        SSLContext sslContext = null;
+        
+        if (_keystoreInputStream == null && _keystorePath == null &&
+                _truststoreInputStream == null && _truststorePath == null )
+        {
+            // Create a trust manager that does not validate certificate chains
+            TrustManager[] trustAllCerts = new TrustManager[]{new X509TrustManager()
+            {
+                public java.security.cert.X509Certificate[] getAcceptedIssuers()
+                {
+                    return null;
+                }
+
+                public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType)
+                {
+                }
+
+                public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType)
+                {
+                }
+            }};
+
+            sslContext = SSLContext.getInstance(_sslProtocol);
+            sslContext.init(null, trustAllCerts, null);
+        }
+        else
+        {
+            sslContext = createSSLContext();
+        }
+        
+        return sslContext;
+    }
+
+    /* ------------------------------------------------------------ */
+    public SSLContext createSSLContext() throws Exception
+    {
+        checkConfig();
+        
+        KeyStore keyStore = getKeyStore(_keystoreInputStream, _keystorePath, _keystoreType, 
+                _keystoreProvider, _keystorePassword==null? null: _keystorePassword.toString());
+        KeyStore trustStore = getKeyStore(_truststoreInputStream, _truststorePath, _truststoreType, 
+                _truststoreProvider, _truststorePassword==null? null: _truststorePassword.toString());
         Collection<? extends CRL> crls = loadCRL(_crlPath);
 
         if (_certAlias == null)
@@ -588,8 +754,8 @@
 
         if (_validateCerts)
         {
-            CertificateValidator validator = new CertificateValidator(keyStore,trustStore,crls);
-            validator.validate(cert);
+            CertificateValidator validator = new CertificateValidator(trustStore,crls);
+            validator.validate(keyStore, cert);
         }
 
         KeyManager[] keyManagers = getKeyManagers(keyStore);
@@ -603,10 +769,10 @@
     }
 
     /* ------------------------------------------------------------ */
-    public KeyManager[] getKeyManagers(KeyStore keyStore) throws Exception
+    protected KeyManager[] getKeyManagers(KeyStore keyStore) throws Exception
     {
-        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(_sslKeyManagerFactoryAlgorithm);
-        keyManagerFactory.init(keyStore,_keyPassword == null?(_password == null?null:_password.toString().toCharArray()):_keyPassword.toString().toCharArray());
+        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(_keyManagerFactoryAlgorithm);
+        keyManagerFactory.init(keyStore,_keymanagerPassword == null?(_keystorePassword == null?null:_keystorePassword.toString().toCharArray()):_keymanagerPassword.toString().toCharArray());
         KeyManager[] managers = keyManagerFactory.getKeyManagers();
 
         if (_certAlias != null)
@@ -624,13 +790,13 @@
     }
 
     /* ------------------------------------------------------------ */
-    public TrustManager[] getTrustManagers(KeyStore trustStore, Collection<? extends CRL> crls) throws Exception
+    protected TrustManager[] getTrustManagers(KeyStore trustStore, Collection<? extends CRL> crls) throws Exception
     {
         TrustManager[] managers = null;
         if (trustStore != null && _validateCerts)
         {
             // Revocation checking is only supported for PKIX algorithm
-            if (_sslTrustManagerFactoryAlgorithm.equalsIgnoreCase("PKIX"))
+            if (_trustManagerFactoryAlgorithm.equalsIgnoreCase("PKIX"))
             {
                 PKIXBuilderParameters pbParams = new PKIXBuilderParameters(trustStore,new X509CertSelector());
 
@@ -651,14 +817,14 @@
                 // Enable Certificate Revocation List Distribution Points (CRLDP) support
                 System.setProperty("com.sun.security.enableCRLDP","true");
 
-                TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(_sslTrustManagerFactoryAlgorithm);
+                TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(_trustManagerFactoryAlgorithm);
                 trustManagerFactory.init(new CertPathTrustManagerParameters(pbParams));
 
                 managers = trustManagerFactory.getTrustManagers();
             }
             else
             {
-                TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(_sslTrustManagerFactoryAlgorithm);
+                TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(_trustManagerFactoryAlgorithm);
                 trustManagerFactory.init(trustStore);
 
                 managers = trustManagerFactory.getTrustManagers();
@@ -669,63 +835,45 @@
     }
 
     /* ------------------------------------------------------------ */
-    public KeyStore getKeyStore(String storePath, String storeType, String storeProvider, String storePassword) throws Exception
+    protected KeyStore getKeyStore(InputStream storeStream, String storePath, String storeType, String storeProvider, String storePassword) throws Exception
     {
-        if (storePath == null)
-            return null;
-
         KeyStore keystore = null;
-        InputStream inStream = null;
-        try
-        {
-            if (storeProvider != null)
-            {
-                keystore = KeyStore.getInstance(storeType,storeProvider);
-            }
-            else
-            {
-                keystore = KeyStore.getInstance(storeType);
-            }
 
-            inStream = Resource.newResource(storePath).getInputStream();
-            keystore.load(inStream,storePassword == null?null:storePassword.toCharArray());
-
-            return keystore;
-        }
-        finally
+        if (storeStream != null || storePath != null)
         {
-            if (inStream != null)
+            InputStream inStream = storeStream;
+            try
             {
-                inStream.close();
+                if (inStream == null)
+                {
+                    inStream = Resource.newResource(storePath).getInputStream();
+                }
+                
+                if (storeProvider != null)
+                {
+                    keystore = KeyStore.getInstance(storeType, storeProvider);
+                }
+                else
+                {
+                    keystore = KeyStore.getInstance(storeType);
+                }
+    
+                keystore.load(inStream, storePassword == null ? null : storePassword.toCharArray());
+            }
+            finally
+            {
+                if (inStream != null)
+                {
+                    inStream.close();
+                }
             }
         }
+        
+        return keystore;
     }
 
     /* ------------------------------------------------------------ */
-    public KeyStore getTrustStore(String trustPath, String trustType, String trustProvider, String trustPassword) throws Exception
-    {
-        if (trustPath == null)
-        {
-            trustPath = System.getProperty("javax.net.ssl.trustStore");
-            trustType = System.getProperty("javax.net.ssl.trustStoreType");
-            trustProvider = System.getProperty("javax.net.ssl.trustStoreProvider");
-            trustPassword = System.getProperty("javax.net.ssl.trustStorePassword");
-        }
-
-        if (trustPath == null)
-        {
-            trustPath = _keystorePath;
-            trustType = _keystoreType;
-            trustProvider = _keystoreProvider;
-            trustPassword = _password.toString();
-            _sslTrustManagerFactoryAlgorithm = _sslKeyManagerFactoryAlgorithm;
-        }
-
-        return getKeyStore(trustPath,trustType,trustProvider,trustPassword);
-    }
-
-    /* ------------------------------------------------------------ */
-    private Collection<? extends CRL> loadCRL(String crlPath) throws Exception
+    protected Collection<? extends CRL> loadCRL(String crlPath) throws Exception
     {
         Collection<? extends CRL> crlList = null;
 
@@ -748,6 +896,43 @@
 
         return crlList;
     }
+    
+    protected void checkConfig()
+    {
+        /*
+         * if the keystore exists but the trust store doesn't use the keystore as the trust store
+         */
+        if (_keystoreInputStream != null || _keystorePath != null)
+        {
+            if (_truststoreInputStream == null && _truststorePath == null)
+            {
+                _truststorePath = _keystorePath;
+                _truststoreInputStream = _keystoreInputStream;
+                _truststoreType = _keystoreType;
+                _truststoreProvider = _keystoreProvider;
+                _truststorePassword = _keystorePassword;
+                _trustManagerFactoryAlgorithm = _keyManagerFactoryAlgorithm;
+            }
+        }
+        
+        // It's the same stream and we cannot read it twice, so we read it once in memory
+        if (_keystoreInputStream != null && _keystoreInputStream == _truststoreInputStream)
+        {
+            try
+            {
+                ByteArrayOutputStream baos = new ByteArrayOutputStream();
+                IO.copy(_keystoreInputStream, baos);
+                _keystoreInputStream.close();
+    
+                _keystoreInputStream = new ByteArrayInputStream(baos.toByteArray());
+                _truststoreInputStream = new ByteArrayInputStream(baos.toByteArray());
+            }
+            catch (Exception ex)
+            {
+                throw new RuntimeException(ex);
+            }
+        }
+    }
 
     public String[] selectCipherSuites(String[] enabledCipherSuites, String[] supportedCipherSuites)
     {
diff --git a/jetty-exssl/src/test/java/org/eclipse/jetty/client/ContentExchangeTest.java b/jetty-exssl/src/test/java/org/eclipse/jetty/client/ContentExchangeTest.java
new file mode 100644
index 0000000..3267530
--- /dev/null
+++ b/jetty-exssl/src/test/java/org/eclipse/jetty/client/ContentExchangeTest.java
@@ -0,0 +1,346 @@
+// ========================================================================
+// Copyright (c) 2009-2009 Mort Bay Consulting Pty. Ltd.
+// ------------------------------------------------------------------------
+// All rights reserved. This program and the accompanying materials
+// are made available under the terms of the Eclipse Public License v1.0
+// and Apache License v2.0 which accompanies this distribution.
+// The Eclipse Public License is available at 
+// http://www.eclipse.org/legal/epl-v10.html
+// The Apache License v2.0 is available at
+// http://www.opensource.org/licenses/apache2.0.php
+// You may elect to redistribute this code under either of these licenses. 
+// ========================================================================
+
+package org.eclipse.jetty.client;
+
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.URLDecoder;
+
+import javax.servlet.ServletException;
+import javax.servlet.ServletInputStream;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import junit.framework.TestCase;
+
+import org.eclipse.jetty.client.security.Realm;
+import org.eclipse.jetty.client.security.SimpleRealmResolver;
+import org.eclipse.jetty.http.HttpMethods;
+import org.eclipse.jetty.http.HttpStatus;
+import org.eclipse.jetty.io.ByteArrayBuffer;
+import org.eclipse.jetty.io.EofException;
+import org.eclipse.jetty.server.Handler;
+import org.eclipse.jetty.server.Request;
+import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.server.handler.AbstractHandler;
+import org.eclipse.jetty.server.handler.HandlerCollection;
+import org.eclipse.jetty.server.nio.SelectChannelConnector;
+import org.eclipse.jetty.servlet.DefaultServlet;
+import org.eclipse.jetty.servlet.ServletContextHandler;
+import org.eclipse.jetty.servlet.ServletHolder;
+import org.eclipse.jetty.util.IO;
+
+public class ContentExchangeTest
+    extends TestCase
+{
+    private static String _content =
+        "Lorem ipsum dolor sit amet, consectetur adipiscing elit. In quis felis nunc. "+
+        "Quisque suscipit mauris et ante auctor ornare rhoncus lacus aliquet. Pellentesque "+
+        "habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. "+
+        "Vestibulum sit amet felis augue, vel convallis dolor. Cras accumsan vehicula diam "+
+        "at faucibus. Etiam in urna turpis, sed congue mi. Morbi et lorem eros. Donec vulputate "+
+        "velit in risus suscipit lobortis. Aliquam id urna orci, nec sollicitudin ipsum. "+
+        "Cras a orci turpis. Donec suscipit vulputate cursus. Mauris nunc tellus, fermentum "+
+        "eu auctor ut, mollis at diam. Quisque porttitor ultrices metus, vitae tincidunt massa "+
+        "sollicitudin a. Vivamus porttitor libero eget purus hendrerit cursus. Integer aliquam "+
+        "consequat mauris quis luctus. Cras enim nibh, dignissim eu faucibus ac, mollis nec neque. "+
+        "Aliquam purus mauris, consectetur nec convallis lacinia, porta sed ante. Suspendisse "+
+        "et cursus magna. Donec orci enim, molestie a lobortis eu, imperdiet vitae neque.";
+
+    private File _docRoot;
+    private Server _server;
+    private HttpClient _client;
+    private Realm _realm;
+    private String _protocol;
+    private String _baseUrl;
+    private String _requestContent;
+
+    public void setUp()
+        throws Exception
+    {
+        _docRoot = new File("target/test-output/docroot/");
+        _docRoot.mkdirs();
+        _docRoot.deleteOnExit();
+        
+        File content = new File(_docRoot,"input.txt");
+        FileOutputStream out = new FileOutputStream(content);
+        out.write(_content.getBytes("utf-8"));
+        out.close();
+        
+        _server = new Server();
+        configureServer(_server);
+        _server.start();
+
+        int port = _server.getConnectors()[0].getLocalPort();
+        _baseUrl = _protocol+"://localhost:"+port+ "/";
+    }
+    
+    public void tearDown()
+        throws Exception
+    {
+        if (_server != null)
+        {
+            _server.stop();
+            _server = null;
+        }
+    }
+    
+    public void testPut() throws Exception
+    {
+        startClient(_realm);
+    
+        ContentExchange putExchange = new ContentExchange();
+        putExchange.setURL(getBaseUrl() + "output.txt");
+        putExchange.setMethod(HttpMethods.PUT);
+        putExchange.setRequestContent(new ByteArrayBuffer(_content.getBytes()));
+    
+        _client.send(putExchange);
+        int state = putExchange.waitForDone();
+    
+        int responseStatus = putExchange.getResponseStatus();
+    
+        stopClient();
+    
+        boolean statusOk = (responseStatus == 200 || responseStatus == 201);
+        assertTrue(statusOk);
+        
+        String content = IO.toString(new FileInputStream(new File(_docRoot,"output.txt")));
+        assertEquals(_content,content);
+    }
+    
+    public void testGet() throws Exception
+    {
+        startClient(_realm);
+    
+        ContentExchange getExchange = new ContentExchange();
+        getExchange.setURL(getBaseUrl() + "input.txt");
+        getExchange.setMethod(HttpMethods.GET);
+    
+        _client.send(getExchange);
+        int state = getExchange.waitForDone();
+    
+        String content = "";
+        int responseStatus = getExchange.getResponseStatus();
+        if (responseStatus == HttpStatus.OK_200)
+        {
+            content = getExchange.getResponseContent();
+        }
+    
+        stopClient();
+    
+        assertEquals(HttpStatus.OK_200,responseStatus);
+        assertEquals(_content,content);
+    }
+    
+    public void testHead() throws Exception
+    {
+        startClient(_realm);
+    
+        ContentExchange getExchange = new ContentExchange();
+        getExchange.setURL(getBaseUrl() + "input.txt");
+        getExchange.setMethod(HttpMethods.HEAD);
+    
+        _client.send(getExchange);
+        getExchange.waitForDone();
+    
+        int responseStatus = getExchange.getResponseStatus();
+
+        stopClient();
+    
+        assertEquals(HttpStatus.OK_200,responseStatus);
+    }
+    
+    public void testPost() throws Exception
+    {
+        startClient(_realm);
+    
+        ContentExchange postExchange = new ContentExchange();
+        postExchange.setURL(getBaseUrl() + "test");
+        postExchange.setMethod(HttpMethods.POST);
+        postExchange.setRequestContent(new ByteArrayBuffer(_content.getBytes()));
+   
+        _client.send(postExchange);
+        int state = postExchange.waitForDone();
+    
+        int responseStatus = postExchange.getResponseStatus();
+ 
+        stopClient();
+    
+        assertEquals(HttpStatus.OK_200,responseStatus);
+        assertEquals(_content,_requestContent);
+    }
+    
+    protected void configureServer(Server server)
+        throws Exception
+    {
+        setProtocol("http");
+        
+        SelectChannelConnector connector = new SelectChannelConnector();
+        server.addConnector(connector);
+
+        Handler handler = new TestHandler(getBasePath());
+        
+        ServletContextHandler root = new ServletContextHandler();
+        root.setContextPath("/");
+        root.setResourceBase(_docRoot.getAbsolutePath());
+        ServletHolder servletHolder = new ServletHolder( new DefaultServlet() );
+        servletHolder.setInitParameter( "gzip", "true" );
+        root.addServlet( servletHolder, "/*" );    
+
+        HandlerCollection handlers = new HandlerCollection();
+        handlers.setHandlers(new Handler[]{handler, root});
+        server.setHandler( handlers ); 
+
+    }
+    
+    protected void startClient(Realm realm)
+        throws Exception
+    {
+        _client = new HttpClient();
+        _client.setConnectorType(HttpClient.CONNECTOR_SELECT_CHANNEL);
+        if (realm != null)
+            _client.setRealmResolver(new SimpleRealmResolver(realm));
+        _client.start();
+    }
+    
+    protected void stopClient()
+        throws Exception
+    {
+        if (_client != null)
+        {
+            _client.stop();
+            _client = null;
+        }
+    }
+    
+    protected String getBasePath()
+    {
+        return _docRoot.getAbsolutePath();
+    }
+    
+    protected String getBaseUrl()
+    {
+        return _baseUrl;
+    }
+    
+    protected HttpClient getClient()
+    {
+        return _client;
+    }
+    
+    protected Realm getRealm()
+    {
+        return _realm;
+    }
+    
+    protected String getContent()
+    {
+        return _content;
+    }
+    
+    protected void setProtocol(String protocol)
+    {
+        _protocol = protocol;
+    }
+    
+    protected void setRealm(Realm realm)
+    {
+        _realm = realm;
+    }
+    
+    public static void copyStream(InputStream in, OutputStream out)
+    {
+        try
+        {
+            byte[] buffer=new byte[1024];
+            int len;
+            while ((len=in.read(buffer))>=0)
+            {
+                out.write(buffer,0,len);
+            }
+        }
+        catch (EofException e)
+        {
+            System.err.println(e);
+        }
+        catch (IOException e)
+        {
+            e.printStackTrace();
+        }
+    }
+
+    protected class TestHandler extends AbstractHandler {
+        private final String resourcePath;
+
+        public TestHandler(String repositoryPath) {
+            this.resourcePath = repositoryPath;
+        }
+
+        public void handle(String target, Request baseRequest,
+                HttpServletRequest request, HttpServletResponse response)
+            throws IOException, ServletException
+        {
+            if (baseRequest.isHandled())
+            {
+                return;
+            }
+
+            OutputStream out = null;
+            
+            if (baseRequest.getMethod().equals("PUT"))
+            {
+            	baseRequest.setHandled(true);
+
+            	File file = new File(resourcePath, URLDecoder.decode(request.getPathInfo()));
+            	file.getParentFile().mkdirs();
+            	file.deleteOnExit();
+            
+            	out = new FileOutputStream(file);
+
+	            response.setStatus(HttpServletResponse.SC_CREATED);
+            }
+            
+            if (baseRequest.getMethod().equals("POST"))
+            {
+            	baseRequest.setHandled(true);
+            	out = new ByteArrayOutputStream();
+
+	        response.setStatus(HttpServletResponse.SC_OK);
+            }
+            
+            if (out != null)
+            {
+                ServletInputStream in = request.getInputStream();
+	            try
+	            {
+	                copyStream( in, out );
+	            }
+	            finally
+	            {
+	                in.close();
+	                out.close();
+	            }
+	            
+	            if (!(out instanceof FileOutputStream))
+	            	_requestContent = out.toString();
+            }
+            
+        }
+    }
+}
diff --git a/jetty-exssl/src/test/java/org/eclipse/jetty/client/SslContentExchangeTest.java b/jetty-exssl/src/test/java/org/eclipse/jetty/client/SslContentExchangeTest.java
new file mode 100644
index 0000000..7dfb21e
--- /dev/null
+++ b/jetty-exssl/src/test/java/org/eclipse/jetty/client/SslContentExchangeTest.java
@@ -0,0 +1,56 @@
+// ========================================================================
+// Copyright (c) 2009-2009 Mort Bay Consulting Pty. Ltd.
+// ------------------------------------------------------------------------
+// All rights reserved. This program and the accompanying materials
+// are made available under the terms of the Eclipse Public License v1.0
+// and Apache License v2.0 which accompanies this distribution.
+// The Eclipse Public License is available at 
+// http://www.eclipse.org/legal/epl-v10.html
+// The Apache License v2.0 is available at
+// http://www.opensource.org/licenses/apache2.0.php
+// You may elect to redistribute this code under either of these licenses. 
+// ========================================================================
+
+package org.eclipse.jetty.client;
+
+import java.io.File;
+
+import org.eclipse.jetty.server.Handler;
+import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.server.handler.HandlerCollection;
+import org.eclipse.jetty.server.ssl.SslSelectChannelConnector;
+import org.eclipse.jetty.servlet.DefaultServlet;
+import org.eclipse.jetty.servlet.ServletContextHandler;
+import org.eclipse.jetty.servlet.ServletHolder;
+import org.eclipse.jetty.toolchain.test.MavenTestingUtils;
+
+public class SslContentExchangeTest
+	extends ContentExchangeTest
+{
+
+    protected void configureServer(Server server)
+        throws Exception
+    {
+        setProtocol("https");
+        
+        SslSelectChannelConnector connector = new SslSelectChannelConnector();
+        File keystore = MavenTestingUtils.getTestResourceFile("jetty-valid.keystore");
+        connector.setKeystore(keystore.getAbsolutePath());
+        connector.setPassword("webtide");
+        connector.setKeyPassword("webtide");
+        server.addConnector(connector);
+                
+        Handler handler = new TestHandler(getBasePath());
+
+        ServletContextHandler root = new ServletContextHandler();
+        root.setContextPath("/");
+        root.setResourceBase(getBasePath());
+        ServletHolder servletHolder = new ServletHolder( new DefaultServlet() );
+        servletHolder.setInitParameter( "gzip", "true" );
+        root.addServlet( servletHolder, "/*" );    
+
+        HandlerCollection handlers = new HandlerCollection();
+        handlers.setHandlers(new Handler[]{handler, root});
+        server.setHandler( handlers ); 
+    }
+}
diff --git a/jetty-exssl/src/test/java/org/eclipse/jetty/exssl/CertificateValidationTestBase.java b/jetty-exssl/src/test/java/org/eclipse/jetty/exssl/CertificateValidationTestBase.java
index da25770..c823bd3 100644
--- a/jetty-exssl/src/test/java/org/eclipse/jetty/exssl/CertificateValidationTestBase.java
+++ b/jetty-exssl/src/test/java/org/eclipse/jetty/exssl/CertificateValidationTestBase.java
@@ -4,6 +4,7 @@
 import java.lang.reflect.Constructor;
 import java.security.cert.CertificateException;
 
+import org.eclipse.jetty.io.SslContextFactory;
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.server.ssl.SslConnector;
 import org.eclipse.jetty.toolchain.test.MavenTestingUtils;
@@ -32,17 +33,17 @@
         String trustpath = new File(System.getProperty("java.home"),"./lib/security/cacerts").getAbsolutePath();
         String crlpath = MavenTestingUtils.getTestResourceFile("crlfile.pem").getAbsolutePath();
 
-        SslParameters sslParams = new SslParameters();
-        sslParams.setValidateCerts(true);
-        sslParams.setKeystore(keypath);
-        sslParams.setPassword("webtide");
-        sslParams.setKeyPassword("webtide");
-        sslParams.setTruststore(trustpath);
-        sslParams.setTrustPassword("changeit");
-        sslParams.setCrlPath(crlpath);
+        SslContextFactory sslContextFactory = new SslContextFactory();
+        sslContextFactory.setValidateCerts(true);
+        sslContextFactory.setKeystore(keypath);
+        sslContextFactory.setKeyStorePassword("webtide");
+        sslContextFactory.setKeyManagerPassword("webtide");
+        sslContextFactory.setTruststore(trustpath);
+        sslContextFactory.setTrustStorePassword("changeit");
+        sslContextFactory.setCrlPath(crlpath);
         
-        Constructor<? extends SslConnector> constructor = _klass.getConstructor(SslParameters.class);
-        SslConnector connector = constructor.newInstance(sslParams);
+        Constructor<? extends SslConnector> constructor = _klass.getConstructor(SslContextFactory.class);
+        SslConnector connector = constructor.newInstance(sslContextFactory);
         connector.setPort(0);
 
         _server = new Server();