SSL Java viewer work thru proxy. -sslGenCA, etc key/cert management utils for x11vnc. FBPM "support".

25 files changed, 3430 insertions, 516 deletions

diff --git a/x11vnc/ChangeLog b/x11vnc/ChangeLog
index b661ba6..c8722d3 100644
--- a/x11vnc/ChangeLog
+++ b/x11vnc/ChangeLog
@@ -1,3 +1,10 @@
+2006-04-05  Karl Runge <runge@karlrunge.com>
+	* x11vnc: add FBPM support (-fbpm) for Suns. -rawfb ZERO for
+	  testing.  Basic key+cert management utilities: -sslGenCA,
+	  -sslGenCert, -sslEncKey, -sslDelCert, -sslCertInfo, and
+	  addln features.  SSL proxy connection.  -storepasswd with
+	  no args or pw echo.
+
 2006-03-26  Karl Runge <runge@karlrunge.com>
 	* x11vnc: -xinerama now on by default.  In -ssl mode accept https
 	  applet downloads thru VNC port.  -https option for 2nd https
diff --git a/x11vnc/Makefile.am b/x11vnc/Makefile.am
index ccb22ed..8f2e880 100644
--- a/x11vnc/Makefile.am
+++ b/x11vnc/Makefile.am
@@ -13,7 +13,7 @@ endif
 
 if HAVE_X
 bin_PROGRAMS=x11vnc
-x11vnc_SOURCES = 8to24.c cleanup.c connections.c cursor.c gui.c help.c inet.c keyboard.c options.c pointer.c rates.c remote.c scan.c screen.c selection.c solid.c sslcmds.c sslhelper.c unixpw.c user.c userinput.c util.c win_utils.c x11vnc.c x11vnc_defs.c xdamage.c xevents.c xinerama.c xkb_bell.c xrandr.c xrecord.c xwrappers.c 8to24.h allowed_input_t.h blackout_t.h cleanup.h connections.h cursor.h enums.h gui.h help.h inet.h keyboard.h options.h params.h pointer.h rates.h remote.h scan.h screen.h scrollevent_t.h selection.h solid.h sslcmds.h sslhelper.h tkx11vnc.h unixpw.h user.h userinput.h util.h win_utils.h winattr_t.h x11vnc.h xdamage.h xevents.h xinerama.h xkb_bell.h xrandr.h xrecord.h xwrappers.h
+x11vnc_SOURCES = 8to24.c cleanup.c connections.c cursor.c gui.c help.c inet.c keyboard.c options.c pm.c pointer.c rates.c remote.c scan.c screen.c selection.c solid.c sslcmds.c sslhelper.c unixpw.c user.c userinput.c util.c win_utils.c x11vnc.c x11vnc_defs.c xdamage.c xevents.c xinerama.c xkb_bell.c xrandr.c xrecord.c xwrappers.c 8to24.h allowed_input_t.h blackout_t.h cleanup.h connections.h cursor.h enums.h gui.h help.h inet.h keyboard.h options.h params.h pm.h pointer.h rates.h remote.h scan.h screen.h scrollevent_t.h selection.h solid.h sslcmds.h sslhelper.h ssltools.h tkx11vnc.h unixpw.h user.h userinput.h util.h win_utils.h winattr_t.h x11vnc.h xdamage.h xevents.h xinerama.h xkb_bell.h xrandr.h xrecord.h xwrappers.h
 INCLUDES=@X_CFLAGS@
 x11vnc_LDADD=$(LDADD) @X_LIBS@ $(LD_CYGIPC)
 endif
diff --git a/x11vnc/README b/x11vnc/README
index 7772c6c..17d5eed 100644
--- a/x11vnc/README
+++ b/x11vnc/README
@@ -1,5 +1,5 @@
 
-x11vnc README file                         Date: Mon Mar 27 23:19:59 EST 2006
+x11vnc README file                         Date: Wed Apr  5 14:16:10 EDT 2006
 
 The following information is taken from these URLs:
 
@@ -736,9 +736,9 @@ make
    protocol.) I suggest using xsetroot, dtstyle or similar utility to set
    a solid background while using x11vnc. You can turn the pretty
    background image back on when you are using the display directly.
-   Update: As of Feb/2005 in the libvncserver CVS, x11vnc has the
-   [92]-solid [color] option that works on recent GNOME, KDE, and CDE and
-   also on classic X (background image is on the root window).
+   Update: As of Feb/2005 x11vnc has the [92]-solid [color] option that
+   works on recent GNOME, KDE, and CDE and also on classic X (background
+   image is on the root window).
 
    I also find the [93]TightVNC encoding gives the best response for my
    usage (Unix <-> Unix over cable modem). One needs a tightvnc-aware
@@ -1721,35 +1721,35 @@ x11vnc -wait 50 -localhost -rfbauth $HOME/.vnc/passwd -display :0 $*
    a similar thing can be done via aliases in your shell (bash, tcsh,
    csh, etc..).
 
-   Or as of Jun/2004 in the libvncserver CVS you can use the simple
-   $HOME/.x11vncrc config file support. If that file exists, each line is
-   taken as a command line option. E.g. the above would be:
+   Or as of Jun/2004 you can use the simple $HOME/.x11vncrc config file
+   support. If that file exists, each line is taken as a command line
+   option. E.g. the above would be:
 # this is a comment in my ~/.x11vncrc file
 wait 50        # this is a comment to the end of the line.
 -localhost     # note: the leading "-" is optional.
 rfbauth  /home/fred/.vnc/passwd
 display :0
 
-   As of Dec/2004 in the libvncserver CVS there is now a simple Tcl/Tk
-   GUI based on the remote-control functionality ("-R") that was added.
-   The /usr/bin/wish program is needed for operation. The gui is not
-   particularly user-friendly, it just provides a point and click mode to
-   set all the many x11vnc parameters and obtain help on them. See the
-   [225]-gui option for more info. Examples: "x11vnc ... -gui" and
-   "x11vnc ... -gui other:0" in the latter case the gui is displayed on
-   other:0, not the X display x11vnc is polling. There is also a
-   "[226]-gui tray" system tray mode.
+   As of Dec/2004 there is now a simple Tcl/Tk GUI based on the
+   remote-control functionality ("-R") that was added. The /usr/bin/wish
+   program is needed for operation. The gui is not particularly
+   user-friendly, it just provides a point and click mode to set all the
+   many x11vnc parameters and obtain help on them. See the [225]-gui
+   option for more info. Examples: "x11vnc ... -gui" and "x11vnc ... -gui
+   other:0" in the latter case the gui is displayed on other:0, not the X
+   display x11vnc is polling. There is also a "[226]-gui tray" system
+   tray mode.
 
 
    Q-9: How can I get the GUI to run in the System Tray, or at least be a
    smaller, simpler icon?
 
-   As of Jul/2005 in the libvncserver CVS the gui can run in a more
-   friendly small icon mode "-gui icon" or in the system tray: "-gui
-   tray". It has balloon status, a simple menu, and a Properities dialog.
-   The full, complicated, gui is only available under "Advanced". Other
-   improvements were added as well. Try "Misc -> simple_gui" for a gui
-   with fewer esoteric menu items.
+   As of Jul/2005 the gui can run in a more friendly small icon mode
+   "-gui icon" or in the system tray: "-gui tray". It has balloon status,
+   a simple menu, and a Properities dialog. The full, complicated, gui is
+   only available under "Advanced". Other improvements were added as
+   well. Try "Misc -> simple_gui" for a gui with fewer esoteric menu
+   items.
 
    If the gui fails to embed itself in the system tray, do a retry via
    "Window View -> icon" followed by "Window View -> tray" with the popup
@@ -1776,9 +1776,9 @@ display :0
    the error message like: "Broken pipe". I'm using the -forever mode and
    I want x11vnc to keep running.
 
-   As of Jan/2004 in the libvncserver CVS the SIGPIPE signal is ignored.
-   So if a viewer client terminates abruptly, libvncserver will notice on
-   the next I/O operation and will close the connection and continue on.
+   As of Jan/2004 the SIGPIPE signal is ignored. So if a viewer client
+   terminates abruptly, libvncserver will notice on the next I/O
+   operation and will close the connection and continue on.
 
    Up until of Apr/2004 the above fix only works for BSD signal systems
    (Linux, FreeBSD, ...) For SYSV systems there is a workaround in place
@@ -1843,7 +1843,7 @@ display :0
    On some systems is seems you need to set LC_ALL=C for configure to
    work properly...
 
-   Be careful the the following two variables: HARDWIRE_PASSWD and
+   Be careful the following two variables: HARDWIRE_PASSWD and
    HARDWIRE_VIEWPASSWD. If set (remember to include the double quotes
    around the string), they will be used as default values for the
    -passwd and -viewpasswd options. Of course the strings will exist
@@ -1894,11 +1894,11 @@ display :0
    If so, there are a couple options. 1) Can you set the default visual
    on your display to be depth 24 TrueColor? Sun machines often have 8+24
    overlay/multi-depth visuals, and you can make the default visual depth
-   24 TrueColor (see fbconfig(1) and Xsun(1)). 2) As of Feb/2004, in the
-   libvncserver CVS, x11vnc has the [240]-visual option to allow you to
-   force the framebuffer visual to whatever you want (this usually messes
-   up the colors unless you are very clever). In this case, the option
-   provides a convenient workaround for the Win2VNC bug:
+   24 TrueColor (see fbconfig(1) and Xsun(1)). 2) As of Feb/2004 x11vnc
+   has the [240]-visual option to allow you to force the framebuffer
+   visual to whatever you want (this usually messes up the colors unless
+   you are very clever). In this case, the option provides a convenient
+   workaround for the Win2VNC bug:
   x11vnc -nofb -visual TrueColor -display :0 ...
 
    So the visual will be set to 8bpp TrueColor and Win2VNC can handle
@@ -2063,10 +2063,10 @@ TrueColor defdepth 24
    visual and depth of the window printed out is often useful in
    debugging x11vnc [255]color problems.
 
-   Also, as of Dec/2004 libvncserver CVS you can use "[256]-id pick" to
-   have x11vnc run xwininfo(1) for you and after you click the window it
-   extracts the windowid. Besides "pick" there is also "id:root" to allow
-   you to go back to root window when doing remote-control.
+   Also, as of Dec/2004 you can use "[256]-id pick" to have x11vnc run
+   xwininfo(1) for you and after you click the window it extracts the
+   windowid. Besides "pick" there is also "id:root" to allow you to go
+   back to root window when doing remote-control.
 
 
    Q-18: Why don't menus or other transient windows come up when I am
@@ -2231,11 +2231,10 @@ TrueColor defdepth 24
 
    Q-23: How do I stop x11vnc once it is running in the background?
 
-   As of Dec/2004 in the libvncserver CVS there is a remote control
-   feature. It can change a huge amount of things on the fly: see the
-   [266]-remote and [267]-query options. To shut down the running x11vnc
-   server just type "x11vnc -R stop". To disconnect all clients do
-   "x11vnc -R disconnect:all", etc.
+   As of Dec/2004 there is a remote control feature. It can change a huge
+   amount of things on the fly: see the [266]-remote and [267]-query
+   options. To shut down the running x11vnc server just type "x11vnc -R
+   stop". To disconnect all clients do "x11vnc -R disconnect:all", etc.
 
    If the [268]-forever option has not been supplied, x11vnc will
    automatically exit after the first client disconnects. In general you
@@ -2262,15 +2261,14 @@ TrueColor defdepth 24
    Can I remote control it?
 
    Look at the [272]-remote (same as -R) and [273]-query (same as -Q)
-   options added in the Dec/2004 libvncserver CVS. They allow nearly
-   everything to be changed dynamically and settings to be queried.
-   Examples: "x11vnc -R shared", "x11vnc -R forever", "x11vnc -R
-   scale:3/4", "x11vnc -Q modtweak", "x11vnc -R stop", "x11vnc -R
-   disconnect:all", etc.. These commands do not start a x11vnc server,
-   but rather communicate with one that is already running. The X display
-   (X11VNC_REMOTE property) is used as the communication channel, so the
-   X permissions and DISPLAY must be set up correctly for communication
-   to be possible.
+   options added in Dec/2004. They allow nearly everything to be changed
+   dynamically and settings to be queried. Examples: "x11vnc -R shared",
+   "x11vnc -R forever", "x11vnc -R scale:3/4", "x11vnc -Q modtweak",
+   "x11vnc -R stop", "x11vnc -R disconnect:all", etc.. These commands do
+   not start a x11vnc server, but rather communicate with one that is
+   already running. The X display (X11VNC_REMOTE property) is used as the
+   communication channel, so the X permissions and DISPLAY must be set up
+   correctly for communication to be possible.
 
    There is also a simple Tcl/Tk gui based on this remote control
    mechanism. See the [274]-gui option for more info. You will need to
@@ -2285,72 +2283,60 @@ TrueColor defdepth 24
    You may already have one in $HOME/.vnc/passwd if you have used, say,
    the vncserver program from the regular RealVNC or TightVNC packages
    (i.e. launching the Xvnc server). Otherwise, you could use the
-   vncpasswd(1) program from those packages. The libvncserver package
-   also comes with a simple program: storepasswd in the examples
-   directory. And as of Jun/2004 in the libvncserver CVS x11vnc supports
-   the -storepasswd "pass" "file" [275]option, which is the the same
-   functionality of storepasswd. Be sure to quote the "pass" if it
-   contains shell meta characters, spaces, etc. Example:
+   vncpasswd(1) program from those packages.
+
+   As of Jun/2004 x11vnc supports the -storepasswd "pass" "file"
+   [275]option, which is the same functionality of storepasswd. Be sure
+   to quote the "pass" if it contains shell meta characters, spaces, etc.
+   Example:
   x11vnc -storepasswd 'sword*fish' $HOME/myvncpasswd
 
-   You then use the password via the x11vnc option: [276]-rfbauth
-   $HOME/myvncpasswd
+   You then use the password via the x11vnc option: "[276]-rfbauth
+   $HOME/myvncpasswd"
+
+   If you do not supply any arguments:
+  x11vnc -storepasswd
 
-   Compared to vncpasswd(1) the latter two methods are a somewhat unsafe
-   because the password is specified on the command line and so someone
-   may see it by using ps(1) or looking over your shoulder. Also watch
-   out for the command winding up in your shell's history file (history
-   -c is often a way to clear it).
+   you will be prompted for a password to save to ~/.vnc/passwd (your
+   keystrokes when entering the password will not be echoed to the
+   screen).
 
    x11vnc also has the [277]-passwdfile and -passwd/-viewpasswd plain
    text (i.e. not obscured like the -rfbauth VNC passwords) password
    options.
 
+   You can use the [278]-usepw option to automatically use any password
+   file you have in ~/.vnc/passwd or ~/.vnc/passwdfile (the latter is
+   used with the -passwdfile option).
 
-   Q-26: Can I make it so -storepasswd doesn't show my password on the
-   screen?
-
-   You can use the vncpasswd program from RealVNC or TightVNC mentioned
-   above..
-
-   Alternatively, this script should keep your [278]-storepasswd more
-   private:
-#!/bin/sh
-# usage: x11vnc_pw [file]  (default: ~/.vnc/passwd)
-
-if [ "X$1" = "X" ]; then
-        file=$HOME/.vnc/passwd
-else
-        file=$1
-fi
+  x11vnc -usepw -display :0 ...
 
-stty -echo
-printf "Password: "
-read pw1; echo ""
-printf "Verify:   "
-read pw2; echo ""
-stty  echo
+   If neither file exists you are prompted to store a password in
+   ~/.vnc/passwd. If a password file cannot be found or created x11vnc
+   exits immediately.
 
-if [ "X$pw1" != "X$pw2" ]; then
-        echo "passwords do not match."
-        exit 1
-fi
 
-x11vnc -help > /dev/null 2>&1
-x11vnc -storepasswd "$pw1" "$file"
-ls -l "$file"
+   Q-26: Can I make it so -storepasswd doesn't show my password on the
+   screen?
 
-   Note that there is a tiny window of time when x11vnc -storepasswd is
-   running that someone could snoop the value using ps(1).
+   You can use the vncpasswd program from RealVNC or TightVNC mentioned
+   above. As of Jan/2006 the -storepasswd option without any arguments
+   will not echo your password as you type it and save the file to
+   ~/.vnc/passwd:
+  # x11vnc -storepasswd
+  Enter VNC password:
+  Verify password:
+  Write password to /home/myname/.vnc/passwd?  [y]/n
+  Password written to: /home/myname/.vnc/passwd
 
 
    Q-27: Can I have two passwords for VNC viewers, one for full access
    and the other for view-only access to the display?
 
-   Yes, as of May/2004 in the libvncserver CVS there is the
-   [279]-viewpasswd option to supply the view-only password. Note the
-   full-access password option [280]-passwd must be supplied at the same
-   time. E.g.: -passwd sword -viewpasswd fish.
+   Yes, as of May/2004 there is the [279]-viewpasswd option to supply the
+   view-only password. Note the full-access password option [280]-passwd
+   must be supplied at the same time. E.g.: -passwd sword -viewpasswd
+   fish.
 
    To avoid specifying the passwords on the command line (where they
    could be observed via the ps(1) command by any user) you can use the
@@ -2460,12 +2446,11 @@ ls -l "$file"
    internal LAN) rather than having it listen on all network interfaces
    and relying on -allow to filter unwanted connections out?
 
-   As of Mar/2005 in the libvncserver CVS, there is the "[294]-listen
-   ipaddr" option that enables this. For ipaddr either supply the desired
-   network interface's IP address (or use a hostname that resolves to it)
-   or use the string "localhost". For additional filtering simultaneously
-   use the "[295]-allow host1,..." option to allow only specific hosts
-   in.
+   As of Mar/2005 there is the "[294]-listen ipaddr" option that enables
+   this. For ipaddr either supply the desired network interface's IP
+   address (or use a hostname that resolves to it) or use the string
+   "localhost". For additional filtering simultaneously use the
+   "[295]-allow host1,..." option to allow only specific hosts in.
 
    This option is useful if you want to insure that no one can even begin
    a dialog with x11vnc from untrusted network interfaces (e.g. ppp0).
@@ -2651,7 +2636,7 @@ connect = 5900
 
    One nice thing about version 4 is often the PEM file does not need to
    be specified because stunnel finds it in its installed area. One other
-   gotcha the the PEM file is usually only readable by root (it has the
+   gotcha the PEM file is usually only readable by root (it has the
    private key afterall), so you'll need to relax the permissions or make
    a copy that the user running x11vnc/stunnel can read.
 
@@ -2699,10 +2684,10 @@ connect = 5900
   PORT=5900
   SSLPORT=5900
 
-   The PEM file does not be supplied if the openssl(1) command is
-   available in PATH to create a self-signed, temporary certificate good
-   only for the single x11vnc session (this may take a while on slow
-   machines).
+   The PEM file does not need to be supplied if the openssl(1) command is
+   available in PATH, in that case a self-signed, temporary certificate
+   good only for the single x11vnc session is created (this may take a
+   while on slow machines).
 
    Otherwise you will have to create a certificate menually via openssl
    or the Java keytool utilities (or some other source). Then supply the
@@ -3217,7 +3202,7 @@ x11vnc -logfile $HOME/.x11vnc.log -rfbauth $HOME/.vnc/passwd -forever -bg
    Continuously.   Have x11vnc reattach each time the X server is
    restarted (i.e. after each logout):
 
-   To make x11vnc always attached to the the X server including the login
+   To make x11vnc always attached to the X server including the login
    screen you will need to add a command to a display manager startup
    script.
 
@@ -3462,13 +3447,12 @@ service x11vncservice
    Q-48: Are reverse connections (i.e. the VNC server connecting to the
    VNC viewer) using "vncviewer -listen" and vncconnect(1) supported?
 
-   As of Mar/2004 in the libvncserver CVS x11vnc supports reverse
-   connections. On Unix one starts the VNC viewer in listen mode:
-   vncviewer -listen (see your documentation for Windows, etc), and then
-   starts up x11vnc with the [369]-connect option. To connect immediately
-   at x11vnc startup time use the "-connect host:port" option (use commas
-   for a list of hosts to connect to). The ":port" is optional (default
-   is 5500).
+   As of Mar/2004 x11vnc supports reverse connections. On Unix one starts
+   the VNC viewer in listen mode: vncviewer -listen (see your
+   documentation for Windows, etc), and then starts up x11vnc with the
+   [369]-connect option. To connect immediately at x11vnc startup time
+   use the "-connect host:port" option (use commas for a list of hosts to
+   connect to). The ":port" is optional (default is 5500).
 
    If a file is specified instead: -connect /path/to/some/file then that
    file is checked periodically (about once a second) for new hosts to
@@ -3791,10 +3775,10 @@ ied)
    Q-55: Does x11vnc support the X DAMAGE Xserver extension to find
    modified regions of the screen quickly and efficiently?
 
-   Yes, as of Mar/2005 in the libvncserver CVS x11vnc will use the X
-   DAMAGE extension by default if it is available on the display. This
-   requires libXdamage to be available in the build environment as well
-   (recent Linux distros and Solaris 10 have it).
+   Yes, as of Mar/2005 x11vnc will use the X DAMAGE extension by default
+   if it is available on the display. This requires libXdamage to be
+   available in the build environment as well (recent Linux distros and
+   Solaris 10 have it).
 
    The DAMAGE extension enables the X server to report changed regions of
    the screen back to x11vnc. So x11vnc doesn't have to guess where the
@@ -3850,11 +3834,11 @@ ied)
    respect to that (updates are only packaged and sent when viewers ask
    for them).
 
-   As of Jan/2004 there are some improvements in the libvncserver CVS
-   tree. The default should now be much better than before and dragging
-   small windows around should no longer be a huge pain. If for some
-   reason these changes make matters worse, you can go back to the old
-   way via the "[409]-pointer_mode 1" option.
+   As of Jan/2004 there are some improvements to libvncserver. The
+   default should now be much better than before and dragging small
+   windows around should no longer be a huge pain. If for some reason
+   these changes make matters worse, you can go back to the old way via
+   the "[409]-pointer_mode 1" option.
 
    Also added was the [410]-nodragging option that disables all screen
    updates while dragging with the mouse (i.e. mouse motion with a button
@@ -3862,9 +3846,9 @@ ied)
    in some circumstances when you want to see the visual feedback while
    dragging (e.g. menu traversal or text selection).
 
-   As of Dec/2004 in the libvncserver CVS the [411]-pointer_mode n option
-   was introduced. n=1 is the original mode, n=2 an improvement, etc..
-   See the -pointer_mode n help for more info.
+   As of Dec/2004 the [411]-pointer_mode n option was introduced. n=1 is
+   the original mode, n=2 an improvement, etc.. See the -pointer_mode n
+   help for more info.
 
    Also, in some circumstances the [412]-threads option can improve
    response considerably. Be forewarned that if more than one vncviewer
@@ -3872,27 +3856,27 @@ ied)
    (try to get the viewers to use different VNC encodings, e.g. tight and
    ZRLE).
 
-   As of Apr/2005 in the libvncserver CVS two new options (see the
-   [413]wireframe FAQ and [414]scrollcopyrect FAQ below) provide schemes
-   to sweep this problem under the rug for window moves or resizes and
-   for some (but not all) window scrolls.
+   As of Apr/2005 two new options (see the [413]wireframe FAQ and
+   [414]scrollcopyrect FAQ below) provide schemes to sweep this problem
+   under the rug for window moves or resizes and for some (but not all)
+   window scrolls.
 
 
    Q-57: Why not do something like wireframe animations to avoid the
    windows "lurching" when being moved or resized?
 
-   Nice idea for a hack! As of Apr/2005 in the libvncserver CVS x11vnc by
-   default will apply heuristics to try to guess if a window is being
-   (opaquely) moved or resized. If such a change is detected framebuffer
-   polling and updates will be suspended and only an animated "wireframe"
-   (a rectangle outline drawn where the moved/resized window would be) is
-   shown. When the window move/resize stops, it returns to normal
-   processing: you should only see the window appear in the new position.
-   This spares you from interacting with a "lurching" window between all
-   of the intermediate steps. BTW the lurching is due to [415]slow video
-   card read rates (see [416]here too). A displacement, even a small one,
-   of a large window requires a non-negligible amount of time, a good
-   fraction of a second, to read in from the hardware framebuffer.
+   Nice idea for a hack! As of Apr/2005 x11vnc by default will apply
+   heuristics to try to guess if a window is being (opaquely) moved or
+   resized. If such a change is detected framebuffer polling and updates
+   will be suspended and only an animated "wireframe" (a rectangle
+   outline drawn where the moved/resized window would be) is shown. When
+   the window move/resize stops, it returns to normal processing: you
+   should only see the window appear in the new position. This spares you
+   from interacting with a "lurching" window between all of the
+   intermediate steps. BTW the lurching is due to [415]slow video card
+   read rates (see [416]here too). A displacement, even a small one, of a
+   large window requires a non-negligible amount of time, a good fraction
+   of a second, to read in from the hardware framebuffer.
 
    Note that Opaque Moves/Resizes must be Enabled by your window manager
    for -wireframe to do any good.
@@ -3983,14 +3967,14 @@ ied)
    Q-58: Can x11vnc try to apply heuristics to detect when an window is
    scrolling its contents and use the CopyRect encoding for a speedup?
 
-   Another nice idea for a hack! As of May/2005 in the libvncserver CVS
-   x11vnc will by default apply heuristics to try to detect if the the
-   window that has the input focus is scrolling its contents (but only
-   when x11vnc is feeding user input, keystroke or pointer, to the X
-   server). So, when detected, scrolls induced by dragging on a scrollbar
-   or by typing (e.g. Up or Down arrows, hitting Return in a terminal
-   window, etc), will show up much more quickly than via the standard
-   x11vnc screen polling update mechanism.
+   Another nice idea for a hack! As of May/2005 x11vnc will by default
+   apply heuristics to try to detect if the window that has the input
+   focus is scrolling its contents (but only when x11vnc is feeding user
+   input, keystroke or pointer, to the X server). So, when detected,
+   scrolls induced by dragging on a scrollbar or by typing (e.g. Up or
+   Down arrows, hitting Return in a terminal window, etc), will show up
+   much more quickly than via the standard x11vnc screen polling update
+   mechanism.
 
    There will be a speedup for both slow and fast links to viewers. For
    slow links the speedup is mostly due to the CopyRect encoding not
@@ -4134,17 +4118,16 @@ ied)
    work for those cases. Also see the "[430]-cursor some" option for
    additional kludges.
 
-   Note that as of Aug/2004 in the libvncserver CVS, on Solaris using the
-   SUN_OVL overlay extension and IRIX, x11vnc can show the correct mouse
-   cursor when the [431]-overlay option is supplied. See [432]this FAQ
-   for more info.
+   Note that as of Aug/2004 on Solaris using the SUN_OVL overlay
+   extension and IRIX, x11vnc can show the correct mouse cursor when the
+   [431]-overlay option is supplied. See [432]this FAQ for more info.
 
-   Also as of Dec/2004 in the libvncserver CVS XFIXES X extension support
-   has been added to allow exact extraction of the mouse cursor shape.
-   XFIXES fixes the problem of the cursor-shape being write-only: x11vnc
-   can now query the X server for the current shape and send it back to
-   the connected viewers. XFIXES is available on recent Linux Xorg based
-   distros and [433]Solaris 10.
+   Also as of Dec/2004 XFIXES X extension support has been added to allow
+   exact extraction of the mouse cursor shape. XFIXES fixes the problem
+   of the cursor-shape being write-only: x11vnc can now query the X
+   server for the current shape and send it back to the connected
+   viewers. XFIXES is available on recent Linux Xorg based distros and
+   [433]Solaris 10.
 
    The only XFIXES issue is the handling of alpha channel transparency in
    cursors. If a cursor has any translucency then in general it must be
@@ -4216,17 +4199,17 @@ ied)
    Q-61: In XFIXES mode, are there any hacks to handle cursor
    transparency ("alpha channel") exactly?
 
-   As of Jan/2005 in the CVS, libvncserver has been modified to allow an
-   alpha channel (i.e. RGBA data) for Rich Cursors. So x11vnc can now
-   send the alpha channel data to libvncserver. However, this data will
-   only be used for VNC clients that do not support the
-   CursorShapeUpdates VNC extension (or have disabled it). It can be
-   disabled for all clients with the [438]-nocursorshape x11vnc option.
-   In this case the cursor is drawn, correctly blended with the
-   background, into the VNC framebuffer before being sent out to the
-   client. So the alpha blending is done on the x11vnc side. Use the
-   [439]-noalphablend option to disable this behavior (always approximate
-   transparent cursors with opaque RGB values).
+   As of Jan/2005 libvncserver has been modified to allow an alpha
+   channel (i.e. RGBA data) for Rich Cursors. So x11vnc can now send the
+   alpha channel data to libvncserver. However, this data will only be
+   used for VNC clients that do not support the CursorShapeUpdates VNC
+   extension (or have disabled it). It can be disabled for all clients
+   with the [438]-nocursorshape x11vnc option. In this case the cursor is
+   drawn, correctly blended with the background, into the VNC framebuffer
+   before being sent out to the client. So the alpha blending is done on
+   the x11vnc side. Use the [439]-noalphablend option to disable this
+   behavior (always approximate transparent cursors with opaque RGB
+   values).
 
    The CursorShapeUpdates VNC extension complicates matters because the
    cursor shape is sent to the VNC viewers supporting it, and the viewers
@@ -4258,10 +4241,10 @@ ied)
    the local VNC viewer. You may disable it with the [441]-nocursor
    option to x11vnc if your viewer does not have this extension.
 
-   Note: as of Aug/2004 in the libvncserver CVS this should be fixed: the
-   default for non-tightvnc viewers (or ones that do not support
-   CursorShapeUpdates) will be to draw the moving cursor into the x11vnc
-   framebuffer. This can also be disabled via -nocursor.
+   Note: as of Aug/2004 this should be fixed: the default for
+   non-tightvnc viewers (or ones that do not support CursorShapeUpdates)
+   will be to draw the moving cursor into the x11vnc framebuffer. This
+   can also be disabled via -nocursor.
 
 
    Q-63: Can I take advantage of the TightVNC extension to the VNC
@@ -4271,9 +4254,8 @@ ied)
 
    Use the [442]-cursorpos option when starting x11vnc. A VNC viewer must
    support the Cursor Positions Updates for the user to see the mouse
-   motions (the TightVNC viewers support this). As of Aug/2004 in the
-   libvncserver CVS -cursorpos is the default. See also [443]-nocursorpos
-   and [444]-nocursorshape.
+   motions (the TightVNC viewers support this). As of Aug/2004 -cursorpos
+   is the default. See also [443]-nocursorpos and [444]-nocursorshape.
 
 
    Q-64: Is it possible to swap the mouse buttons (e.g. left-handed
@@ -4345,14 +4327,13 @@ ied)
    correct keycode to send, possibly by sending fake modifier key presses
    and releases in addition to the actual keystroke.
 
-   Update:  As of Jul/2004 in the libvncserver CVS, -modtweak is now the
-   default (use -nomodtweak to get the old behavior). This was done
-   because it was noticed on newer XFree86 setups even on bland "us"
-   keyboards like "pc104 us" XFree86 included a "ghost" key with both "<"
-   and ">" it. This key does not exist on the keyboard (see [449]this FAQ
-   for more info). Without -modtweak there was then an ambiguity in the
-   reverse map keysym => keycode, making it so the "<" symbol could not
-   be typed.
+   Update:  As of Jul/2004 -modtweak is now the default (use -nomodtweak
+   to get the old behavior). This was done because it was noticed on
+   newer XFree86 setups even on bland "us" keyboards like "pc104 us"
+   XFree86 included a "ghost" key with both "<" and ">" it. This key does
+   not exist on the keyboard (see [449]this FAQ for more info). Without
+   -modtweak there was then an ambiguity in the reverse map keysym =>
+   keycode, making it so the "<" symbol could not be typed.
 
    Also see the [450]FAQ about the -xkb option for a more powerful method
    of modifier tweaking for use on X servers with the XKEYBOARD
@@ -4475,8 +4456,7 @@ ied)
    can't find the keysym "@" anywhere in the keymapping! (even though it
    is in the XKEYBOARD extended keymapping).
 
-   How to Solve: As of Jul/2004 in the libvncserver CVS x11vnc has two
-   changes:
+   How to Solve: As of Jul/2004 x11vnc has two changes:
      * -modtweak (tweak Modifier keys) is now the default (use
        -nomodtweak to go back to the old way)
      * there is a new option -xkb to use the XKEYBOARD extension API to
@@ -4688,12 +4668,12 @@ ied)
    Q-75: Does x11vnc support server-side framebuffer scaling? (E.g. to
    make the desktop smaller).
 
-   As of Jun/2004 in the libvncserver CVS x11vnc provides basic
-   server-side scaling. It is a global scaling of the desktop, not a
-   per-client setting. To enable it use the "[479]-scale fraction"
-   option. "fraction" can either be a floating point number (e.g. -scale
-   0.5) or the alternative m/n fraction notation (e.g. -scale 2/3). Note
-   that if fraction is greater than one the display is magnified.
+   As of Jun/2004 x11vnc provides basic server-side scaling. It is a
+   global scaling of the desktop, not a per-client setting. To enable it
+   use the "[479]-scale fraction" option. "fraction" can either be a
+   floating point number (e.g. -scale 0.5) or the alternative m/n
+   fraction notation (e.g. -scale 2/3). Note that if fraction is greater
+   than one the display is magnified.
 
    Extra resources (CPU, memory I/O, and memory) are required to do the
    scaling. If the machine is slow where x11vnc is run with scaling
@@ -4749,11 +4729,11 @@ ied)
    gui process. Otherwise they all share the same X property channels:
    VNC_CONNECT and X11VNC_REMOTE.
 
-   Update: As of Mar/2005 in the libvncserver CVS x11vnc now scales the
-   mouse cursor with the same scale factor as the screen. If you don't
-   want that, use the [484]"-scale_cursor frac" option to set the cursor
-   scaling to a different factor (e.g. use "-scale_cursor 1" to keep the
-   cursor at its natural unscaled size).
+   Update: As of Mar/2005 x11vnc now scales the mouse cursor with the
+   same scale factor as the screen. If you don't want that, use the
+   [484]"-scale_cursor frac" option to set the cursor scaling to a
+   different factor (e.g. use "-scale_cursor 1" to keep the cursor at its
+   natural unscaled size).
 
 
    Q-76: Does x11vnc work with Xinerama? (i.e. multiple monitors joined
@@ -4816,11 +4796,11 @@ ied)
    Q-78: Can x11vnc show only a portion of the display? (E.g. for a
    special purpose rfb application).
 
-   As of Mar/2005 in the libvncserver CVS x11vnc has the "[491]-clip
-   WxH+X+Y" option to select a rectangle of width W, height H and offset
-   (X, Y). Thus the VNC screen will be the clipped sub-region of the
-   display and be only WxH in size. One user used -clip to split up a
-   large [492]Xinerama screen into two more managable smaller screens.
+   As of Mar/2005 x11vnc has the "[491]-clip WxH+X+Y" option to select a
+   rectangle of width W, height H and offset (X, Y). Thus the VNC screen
+   will be the clipped sub-region of the display and be only WxH in size.
+   One user used -clip to split up a large [492]Xinerama screen into two
+   more managable smaller screens.
 
    This also works to view a sub-region of a single application window if
    the [493]-id or [494]-sid options are used. The offset is measured
@@ -4831,11 +4811,11 @@ ied)
    extension? Whenever I rotate or resize the screen x11vnc just seems to
    crash.
 
-   As of Dec/2004 in the libvncserver CVS x11vnc supports XRANDR. You
-   enable it with the [495]-xrandr option to make x11vnc monitor XRANDR
-   events and also trap X server errors if the screen change occurred in
-   the middle of an X call like XGetImage. Once it traps the screen
-   change it will create a new framebuffer using the new screen.
+   As of Dec/2004 x11vnc supports XRANDR. You enable it with the
+   [495]-xrandr option to make x11vnc monitor XRANDR events and also trap
+   X server errors if the screen change occurred in the middle of an X
+   call like XGetImage. Once it traps the screen change it will create a
+   new framebuffer using the new screen.
 
    If the connected vnc viewers support the NewFBSize VNC extension
    (Windows TightVNC viewer and RealVNC 4.0 windows and Unix viewers do)
@@ -4934,11 +4914,10 @@ ied)
    Q-83: Can non-X devices (e.g. a raw framebuffer) be viewed and/or
    controlled by x11vnc?
 
-   As of Apr/2005 in the libvncserver CVS there is rudimentary support
-   for this. Two options were added: "-rawfb string" (to indicate the raw
-   framembuffer and its parameters) and "-pipeinput cmd" (to provide an
-   external program that will inject or otherwise process mouse and
-   keystroke input).
+   As of Apr/2005 there is rudimentary support for this. Two options were
+   added: "-rawfb string" (to indicate the raw framembuffer and its
+   parameters) and "-pipeinput cmd" (to provide an external program that
+   will inject or otherwise process mouse and keystroke input).
 
    This non-X mode for x11vnc is experimental because it is so removed in
    scope from the intended usage of the tool. Little attempt is made to
@@ -5098,13 +5077,12 @@ ied)
    Q-85: Does the Clipboard/Selection get transferred between the
    vncviewer and the X display?
 
-   As of Jan/2004 in the libvncserver CVS x11vnc supports the "CutText"
-   part of the rfb protocol. Furthermore, x11vnc is able to hold the
-   PRIMARY selection (Xvnc does not seem to do this). If you don't want
-   the Clipboard/Selection exchanged use the [504]-nosel option. If you
-   don't want the PRIMARY selection to be polled for changes use the
-   [505]-noprimary option. You can also fine-tune it a bit with the
-   [506]-seldir dir option.
+   As of Jan/2004 x11vnc supports the "CutText" part of the rfb protocol.
+   Furthermore, x11vnc is able to hold the PRIMARY selection (Xvnc does
+   not seem to do this). If you don't want the Clipboard/Selection
+   exchanged use the [504]-nosel option. If you don't want the PRIMARY
+   selection to be polled for changes use the [505]-noprimary option. You
+   can also fine-tune it a bit with the [506]-seldir dir option.
 
    You may need to watch out for desktop utilities such as KDE's
    "Klipper" that do odd things with the selection, clipboard, and
@@ -5122,10 +5100,10 @@ ied)
    Q-87: Why don't I hear the "Beeps" in my X session (e.g. when typing
    tput bel in an xterm)?
 
-   As of Dec/2003 in the libvncserver CVS "Beep" XBell events are tracked
-   by default. The X server must support the XKEYBOARD extension (this is
-   not on by default in Solaris, see Xserver(1) for how to turn it on via
-   +kb), and so you won't hear them if the extension is not present.
+   As of Dec/2003 "Beep" XBell events are tracked by default. The X
+   server must support the XKEYBOARD extension (this is not on by default
+   in Solaris, see Xserver(1) for how to turn it on via +kb), and so you
+   won't hear them if the extension is not present.
 
    If you don't want to hear the beeps use the [508]-nobell option. If
    you want to hear the audio from the remote applications, consider
@@ -5423,7 +5401,7 @@ References
  275. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-storepasswd
  276. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-rfbauth
  277. http://www.karlrunge.com/x11vnc/index.html#faq-passwdfile
- 278. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-storepasswd
+ 278. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-usepw
  279. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-viewpasswd
  280. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-passwd
  281. http://www.karlrunge.com/x11vnc/x11vnc_opts.html#opt-passwdfile
@@ -5666,7 +5644,7 @@ x11vnc: a VNC server for real X displays
    Here are all of x11vnc command line options:
 % x11vnc -opts      (see below for -help long descriptions)
 
-x11vnc: allow VNC connections to real X11 displays. 0.8.1 lastmod: 2006-03-27
+x11vnc: allow VNC connections to real X11 displays. 0.8.1 lastmod: 2006-04-05
 
 x11vnc options:
   -display disp            -auth file               -id windowid           
@@ -5680,7 +5658,9 @@ x11vnc options:
   -vncconnect              -novncconnect            -allow host1[,host2..] 
   -localhost               -nolookup                -input string          
   -viewpasswd string       -passwdfile filename     -unixpw [list]         
-  -unixpw_nis [list]       -ssl [pem]               -sslverify [path]      
+  -unixpw_nis [list]       -ssl [pem]               -ssldir [dir]          
+  -sslverify [path]        -sslGenCA [dir]          -sslGenCert type name  
+  -sslEncKey [pem]         -sslCertInfo [pem]       -sslDelCert [pem]      
   -stunnel [pem]           -stunnel3  [pem]         -https [port]          
   -usepw                   -storepasswd pass file   -nopw                  
   -accept string           -afteraccept string      -gone string           
@@ -5715,16 +5695,16 @@ x11vnc options:
   -debug_keyboard          -defer time              -wait time             
   -wait_ui factor          -nowait_bog              -slow_fb time          
   -readtimeout n           -nap                     -nonap                 
-  -sb time                 -noxdamage               -xd_area A             
-  -xd_mem f                -sigpipe string          -threads               
-  -nothreads               -fs f                    -gaps n                
-  -grow n                  -fuzz n                  -debug_tiles           
-  -snapfb                  -rawfb string            -pipeinput cmd         
-  -gui [gui-opts]          -remote command          -query variable        
-  -QD variable             -sync                    -noremote              
-  -yesremote               -unsafe                  -safer                 
-  -privremote              -nocmds                  -deny_all              
-
+  -sb time                 -nofbpm                  -fbpm                  
+  -noxdamage               -xd_area A               -xd_mem f              
+  -sigpipe string          -threads                 -nothreads             
+  -fs f                    -gaps n                  -grow n                
+  -fuzz n                  -debug_tiles             -snapfb                
+  -rawfb string            -pipeinput cmd           -gui [gui-opts]        
+  -remote command          -query variable          -QD variable           
+  -sync                    -noremote                -yesremote             
+  -unsafe                  -safer                   -privremote            
+  -nocmds                  -deny_all              
 
 libvncserver options:
 -rfbport port          TCP port for RFB protocol
@@ -5756,7 +5736,7 @@ libvncserver-tight-extension options:
 
 % x11vnc -help
 
-x11vnc: allow VNC connections to real X11 displays. 0.8.1 lastmod: 2006-03-27
+x11vnc: allow VNC connections to real X11 displays. 0.8.1 lastmod: 2006-04-05
 
 (type "x11vnc -opts" to just list the options.)
 
@@ -6267,14 +6247,14 @@ Options:
 -unixpw_nis [list]     As -unixpw above, however do not use su(1) but rather
                        use the traditional getpwnam(3) + crypt(3) method to
                        verify passwords instead.  This requires that the
-                       encrpyted passwords be readable.  Passwords stored
+                       encrypted passwords be readable.  Passwords stored
                        in /etc/shadow will be inaccessible unless x11vnc
                        is run as root.
 
                        This is called "NIS" mode simply because in most
                        NIS setups the user encrypted passwords are accessible
                        (e.g. "ypcat passwd").  NIS is not required for this
-                       mode to work (only that getpwnam(3) return the encrpyted
+                       mode to work (only that getpwnam(3) return the encrypted
                        password is required), but it is unlikely it will work
                        for any other modern environment.  All of the -unixpw
                        options and contraints apply.
@@ -6288,18 +6268,19 @@ Options:
 
                        [pem] is optional, use "-ssl /path/to/mycert.pem"
                        to specify a PEM certificate file to use to identify
-                       and provide a key for this server.  See openssl(1)
-                       for what a PEM can be.
+                       and provide a key for this server.  See openssl(1) for
+                       more info about PEMs and the -sslGenCert option below.
 
-                       Connecting VNC viewer SSL tunnels can optionally
+                       The connecting VNC viewer SSL tunnel can optionally
                        authenticate this server if they have the public
                        key part of the certificate (or a common certificate
                        authority, CA, is a more sophisicated way to verify
-                       this server's cert).  This is used to prevent
-                       man-in-the-middle attacks.  Otherwise, if the VNC
-                       viewer accepts this server's key without verification,
-                       at least the traffic is protected from passive sniffing
-                       on the network (but NOT from man-in-the-middle attacks).
+                       this server's cert, see -sslGenCA below).  This is
+                       used to prevent man-in-the-middle attacks.  Otherwise,
+                       if the VNC viewer accepts this server's key without
+                       verification, at least the traffic is protected
+                       from passive sniffing on the network (but NOT from
+                       man-in-the-middle attacks).
 
                        If [pem] is not supplied and the openssl(1) utility
                        command exists in PATH, then a temporary, self-signed
@@ -6312,15 +6293,34 @@ Options:
                        temporary certificate, the public part of it will be
                        displayed to stderr (e.g. one could copy it to the
                        client-side to provide authentication of the server to
-                       VNC viewers.)
+                       VNC viewers.)  See following paragraphs for how to save
+                       keys to reuse when x11vnc is restarted.
 
                        Set the env. var. X11VNC_SHOW_TMP_PEM=1 to have x11vnc
                        print out the entire certificate, including the PRIVATE
                        KEY part, to stderr.  One could reuse this cert if saved
                        in a [pem] file.  Similarly, set X11VNC_KEEP_TMP_PEM=1
                        to not delete the temporary PEM file: the file name
-                       will be printed to stderr (so one could move it to a
-                       safe place for reuse).
+                       will be printed to stderr (so one could move it to
+                       a safe place for reuse).  You will be prompted for a
+                       passphrase for the private key.
+
+                       If [pem] is "SAVE" then the certificate will be saved
+                       to the file ~/.vnc/certs/server.pem, or if that file
+                       exists it will be used directly.  Similarly, if [pem]
+                       is "SAVE_PROMPT" the server.pem certificate will be
+                       made based on your answers to its prompts for info such
+                       as OrganizationalName, CommonName, etc.
+
+                       Use "SAVE-<string>" and "SAVE_PROMPT-<string>"
+                       to refer to the file ~/.vnc/certs/server-<string>.pem
+                       instead.  E.g. "SAVE-charlie" will store to the file
+                       ~/.vnc/certs/server-charlie.pem
+
+                       See -ssldir below to use a directory besides the
+                       default ~/.vnc/certs
+
+                       Example: x11vnc -ssl SAVE -display :0 ...
 
                        Reverse connections are disabled in -ssl mode because
                        there is no way to ensure that data channel will
@@ -6328,33 +6328,368 @@ Options:
                        override this.
 
                        Your VNC viewer will also need to be able to connect
-                       via SSL.  See the discussion below under -stunnel
-                       and the FAQ for how this might be achieved.  E.g. on
-                       Unix it is easy to write a shell script that starts up
-                       stunnel and then vncviewer.  Also in the x11vnc source
-                       a SSL enabled Java VNC Viewer applet is provided in
-                       the classes/ssl directory.
+                       via SSL.  See the discussion below under -stunnel and
+                       the FAQ (ssl_vncviewer script) for how this might be
+                       achieved.  E.g. on Unix it is easy to write a shell
+                       script that starts up stunnel and then vncviewer.
+                       Also in the x11vnc source a SSL enabled Java VNC Viewer
+                       applet is provided in the classes/ssl directory.
+
+-ssldir [dir]          Use [dir] as an alternate ssl certificate and key
+                       management toplevel directory.  The default is
+                       ~/.vnc/certs
+
+                       This directory is used to store server and other
+                       certificates and keys and also other materials.  E.g. in
+                       the simplest case, "-ssl SAVE" will store the x11vnc
+                       server cert in [dir]/server.pem
+
+                       Use of alternate directories via -ssldir allows you to
+                       manage multiple VNC Certificate Authority (CA) keys.
+                       Another use is if ~/.vnc/cert is on an NFS share you
+                       might want your certificates and keys to be on a local
+                       filesystem to prevent network snooping (for example
+                       -ssldir /var/lib/x11vnc-certs).
+
+                       -ssldir effects the other -ssl* options.  In the case
+                       of maintenance commands where the VNC server is not run
+                       (e.g. -sslGenCA), the -ssldir option must precede the
+                       command. E.g. x11vnc -ssldir ~/mydir -sslCertInfo LIST
 
 -sslverify [path]      For either of the -ssl or -stunnel modes, use [path]
                        to provide certificates to authenticate incoming VNC
-                       client connections.  This can be used as a method to
-                       replace standard password authentication of clients.
+                       *Client* connections (normally only the server is
+                       authenticated in SSL.)  This can be used as a method
+                       to replace standard password authentication of clients.
 
                        If [path] is a directory it contains the client (or CA)
-                       certificates in separate files.  If [path] is a file, it
-                       contains multiple certificates.  These correspond to the
-                       "CApath = dir" and "CAfile = file" stunnel options.
-                       See the stunnel(8) manpage for details.
+                       certificates in separate files.  If [path] is a file,
+                       it contains multiple certificates.  See special tokens
+                       below.  These correspond to the "CApath = dir" and
+                       "CAfile = file" stunnel options.  See the stunnel(8)
+                       manpage for details.
+
+                       Examples:
+                              x11vnc -ssl -sslverify ~/my.pem
+                              x11vnc -ssl -sslverify ~/my_pem_dir/
+
+                       Note that if [path] is a directory, it must contain
+                       the certs in separate files named like <HASH>.0, where
+                       the value of <HASH> is found by running the command
+                       "openssl x509 -hash -noout -in file.crt". Evidently
+                       one uses <HASH>.1 if there is a collision...
+
+                       The the key-management utility "-sslCertInfo HASHON"
+                       and "-sslCertInfo HASHOFF" will create/delete these
+                       hashes for you automatically (via symlink) in the HASH
+                       subdirs it manages.  Then you can point -sslverify to
+                       the HASH subdir.
+
+                       Special tokens: in -ssl mode, if [path] is not a file or
+                       a directory, it is taken as a comma separated list of
+                       tokens that are interpreted as follows:
+
+                       If a token is "CA" that means load the CA/cacert.pem
+                       file from the ssl directory.  If a token is "clients"
+                       then all the files clients/*.crt in the ssl directory
+                       are loaded.  Otherwise the file clients/token.crt
+                       is attempted to be loaded.  As a kludge, use a token
+                       like ../server-foo to load a server cert if you find
+                       that necessary.
+
+                       Use -ssldir to use a directory different from the
+                       ~/.vnc/certs default.
+
+                       Note that if the "CA" cert is loaded you do not need
+                       to load any of the certs that have been signed by it.
+                       You will need to load any additional self-signed certs
+                       however.
+
+                       Examples:
+                              x11vnc -ssl -sslverify CA
+                              x11vnc -ssl -sslverify self:fred,self:jim
+                              x11vnc -ssl -sslverify CA,clients
+
+                       Usually "-sslverify CA" is the most effective.
+                       See the -sslGenCA and -sslGenCert options below for
+                       how to set up and manage the CA framework.
+
+
+
+                       NOTE: the following utilities, -sslGenCA, -sslGenCert,
+                       -sslEncKey, and -sslCertInfo are provided for
+                       completeness, but for casual usage they are overkill.
+
+                       They provide VNC Certificate Authority (CA) key creation
+                       and server / client key generation and signing.  So they
+                       provide a basic Public Key management framework for
+                       VNC-ing with x11vnc. (note that they require openssl(1)
+                       be installed on the system)
+
+                       However, the simplest usage mode (where x11vnc
+                       automatically generates its own, self-signed, temporary
+                       key and the VNC viewers always accept it, e.g. accepting
+                       via a dialog box) is probably safe enough for most
+                       scenarios.  CA management is not needed.
+
+                       To protect against Man-In-The-Middle attacks the
+                       simplest mode can be improved by using "-ssl SAVE"
+                       to have x11vnc create a longer term self-signed
+                       certificate, and then (safely) copy the corresponding
+                       public key cert to the desired client machines (care
+                       must be taken the private key part is not stolen;
+                       you will be prompted for a passphrase).
+
+                       So keep in mind no CA key creation or management
+                       (-sslGenCA and -sslGenCert) is needed for either of
+                       the above two common usage modes.
+
+                       One might want to use -sslGenCA and -sslGenCert
+                       if you had a large number of VNC client and server
+                       workstations.  That way the administrator could generate
+                       a single CA key with -sslGenCA and distribute its
+                       certificate part to all of the workstations.
+
+                       Next, he could create signed VNC server keys
+                       (-sslGenCert server ...) for each workstation or user
+                       that then x11vnc would use to authenticate itself to
+                       any VNC client that has the CA cert.
+
+                       Optionally, the admin could also make it so the
+                       VNC clients themselves are authenticated to x11vnc
+                       (-sslGenCert client ...)  For this -sslverify would be
+                       pointed to the CA cert (and/or self-signed certs).
+
+                       x11vnc will be able to use all of these cert and
+                       key files.  On the VNC client side, they will need to
+                       be "imported" somehow.  Web browsers have "Manage
+                       Certificates" actions as does the Java applet plugin
+                       Control Panel.  stunnel can also use these files (see
+                       the ssl_vncviewer example script in the FAQ.)
+
+-sslGenCA [dir]        Generate your own Certificate Authority private key,
+                       certificate, and other files in directory [dir].
+
+                       If [dir] is not supplied, a -ssldir setting is used,
+                       or otherwise ~/.vnc/certs is used.
+
+                       This command also creates directories where server and
+                       client certs and keys will be stored.  The openssl(1)
+                       program must be installed on the system and available
+                       in PATH.
+
+                       After the CA files and directories are created the
+                       command exits; the VNC server is not run.
+
+                       You will be prompted for information to put into the CA
+                       certificate.  The info does not have to be accurate just
+                       as long as clients accept the cert for VNC connections.
+                       You will also need to supply a passphrase of at least
+                       4 characters for the CA private key.
+
+                       Once you have generated the CA you can distribute
+                       its certificate part, [dir]/CA/cacert.pem, to other
+                       workstations where VNC viewers will be run.  One will
+                       need to "import" this certicate in the applications,
+                       e.g. Web browser, Java applet plugin, stunnel, etc.
+                       Next, you can create and sign keys using the CA with
+                       the -sslGenCert option below.
+
+                       Examples:
+                                x11vnc -sslGenCA
+                                x11vnc -sslGenCA  ~/myCAdir
+                                x11vnc -ssldir ~/myCAdir -sslGenCA
+
+                       (the last two lines are equivalent)
+
+-sslGenCert type name  Generate a VNC server or client certificate and private
+                       key pair signed by the CA created previously with
+                       -sslGenCA.  The openssl(1) program must be installed
+                       on the system and available in PATH.
+
+                       After the Certificate is generated the command exits;
+                       the VNC server is not run.
+
+                       The type of key to be generated is the string "type".
+                       It is either "server" (i.e. for use by x11vnc) or
+                       "client" (for a VNC viewer).  Note that typically
+                       only "server" is used: the VNC clients authenticate
+                       themselves by a non-public-key method (e.g. VNC or
+                       unix password).  "type" is required.
+
+                       An arbitrary default name you want to associate with
+                       the key is supplied by the "name" string.  You can
+                       change it at the various prompts when creating the key.
+                       "name" is optional.
+
+                       If name is left blank for clients keys then "nobody"
+                       is used.  If left blank for server keys, then the
+                       primary server key: "server.pem" is created (this
+                       is the saved one referenced by "-ssl SAVE" when the
+                       server is started)
+
+                       If "name" begins with the string "self:" then
+                       a self-signed certificate is created instead of one
+                       signed by your CA key.
+
+                       If "name" begins with the string "req:" then only a
+                       key (.key) and a certificate signing *request* (.req)
+                       are generated.  You can then send the .req file to
+                       an external CA (even a professional one, e.g. Thawte)
+                       and then combine the .key and the received cert into
+                       the .pem file with the same basename.
+
+                       The distinction between "server" and "client" is
+                       simply the choice of output filenames and sub-directory.
+                       This makes it so the -ssl SAVE-name option can easily
+                       pick up the x11vnc PEM file this option generates.
+                       And similarly makes it easy for the -sslverify option
+                       to pick up your client certs.
+
+                       There is nothing special about the filename or directory
+                       location of either the "server" and "client" certs.
+                       You can rename the files or move them to wherever
+                       you like.
+
+                       Precede this option with -ssldir [dir] to use a
+                       directory other than the default ~/.vnc/certs You will
+                       need to run -sslGenCA on that directory first before
+                       doing any -sslGenCert key creation.
+
+                       Note you cannot recreate a cert with exactly the same
+                       distiguished name (DN) as an existing one.  To do so,
+                       you will need to edit the [dir]/CA/index.txt file to
+                       delete the line.
+
+                       Similar to -sslGenCA, you will be prompted to fill
+                       in some information that will be recorded in the
+                       certificate when it is created.  Tip: if you know
+                       the fully-quailified hostname other people will be
+                       connecting to you can use that as the CommonName "CN"
+                       to avoid some applications (e.g. web browsers and java
+                       plugin) complaining it does not match the hostname.
+
+                       You will also need to supply the CA private key
+                       passphrase to unlock the private key created from
+                       -sslGenCA.  This private key is used to sign the server
+                       or client certicate.
+
+                       The "server" certs can be used by x11vnc directly by
+                       pointing to them via the -ssl [pem] option.  The default
+                       file will be ~/.vnc/certs/server.pem.  This one would
+                       be used by simply typing -ssl SAVE.  The pem file
+                       contains both the certificate and the private key.
+                       server.crt file contains the cert only.
+
+                       The "client" cert + private key file will need
+                       to be copied and imported into the VNC viewer
+                       side applications (Web browser, Java plugin,
+                       stunnel, etc.)  Once that is done you can delete the
+                       "client" private key file on this machine since
+                       it is only needed on the VNC viewer side.  The,
+                       e.g. ~/.vnc/certs/clients/<name>.pem contains both
+                       the cert and private key.  The <name>.crt contains the
+                       certificate only.
+
+                       NOTE: It is very important to know one should always
+                       generate new keys with a passphrase.  Otherwise if an
+                       untrusted user steals the key file he could use it to
+                       masquerade as the x11vnc server (or VNC viewer client).
+                       You will be prompted whether to encrypt the key with
+                       a passphrase or not.  It is recommended that you do.
+                       One inconvenience to a passphrase is that it must
+                       be suppled every time x11vnc or the client app is
+                       started up.
+
+                       Examples:
+
+                               x11vnc -sslGenCert server
+                               x11vnc -ssl SAVE -display :0 ...
+
+                       and then on viewer using ssl_vncviewer stunnel wrapper
+                       (see the FAQ):
+                               ssl_vncviewer -verify ./cacert.crt hostname:0
+
+                       (this assumes the cacert.crt cert from -sslGenCA
+                       was safely copied to the VNC viewer machine where
+                       ssl_vncviewer is run)
+
+                       Example using a name:
+
+                               x11vnc -sslGenCert server charlie
+                               x11vnc -ssl SAVE-charlie -display :0 ...
+
+                       Example for a client certificate (rarely used):
+
+                               x11vnc -sslGenCert client roger
+                               scp ~/.vnc/certs/clients/roger.pem somehost:.
+                               rm  ~/.vnc/certs/clients/roger.pem
+
+                       x11vnc is then started with the the option -sslverify
+                       ~/.vnc/certs/clients/roger.crt (or simply -sslverify
+                       roger), and on the viewer user on somehost could do
+                       for example:
+
+                               ssl_vncviewer -mycert ./roger.pem hostname:0
+
+-sslEncKey [pem]       Utility to encrypt an existing PEM file with a
+                       passphrase you supply when prompted.  For that key to be
+                       used (e.g. by x11vnc) the passphrase must be supplied
+                       each time.
+
+                       The "SAVE" notation described under -ssl applies as
+                       well. (precede this option with -ssldir [dir] to refer
+                       a directory besides the default ~/.vnc/certs)
+
+                       The openssl(1) program must be installed on the system
+                       and available in PATH.  After the Key file is encrypted
+                       the command exits; the VNC server is not run.
+
+                       Examples:
+                               x11vnc -sslEncKey /path/to/foo.pem
+                               x11vnc -sslEncKey SAVE
+                               x11vnc -sslEncKey SAVE-charlie
+
+-sslCertInfo [pem]     Prints out information about an existing PEM file.
+                       In addition the public certificate is also printed.
+                       The openssl(1) program must be in PATH. Basically the
+                       command "openssl x509 -text" is run on the pem.
+
+                       The "SAVE" notation described under -ssl applies
+                       as well.
+
+                       Using  "LIST" will give a list of all certs being
+                       managed (in the ~/.vnc/certs dir, use -ssldir to refer
+                       to another dir).  "ALL" will print out the info for
+                       every managed key (this can be very long).  Giving a
+                       client or server cert shortname will also try a lookup
+                       (e.g. -sslCertInfo charlie).  Use "LISTL" or "LL"
+                       for a long (ls -l style) listing.
+
+                       Using "HASHON" will create subdirs [dir]/HASH and
+                       [dir]/HASH with OpenSSL hash filenames (e.g. 0d5fbbf1.0)
+                       symlinks pointing up to the corresponding *.crt file.
+                       ([dir] is ~/.vnc/certs or one given by -ssldir.)
+                       This is a useful way for other OpenSSL applications
+                       (e.g. stunnel) to access all of the certs without
+                       having to concatenate them.  x11vnc will not use them
+                       unless you specifically reference them.  "HASHOFF"
+                       removes these HASH subdirs.
+
+                       The LIST, LISTL, LL, ALL, HASHON, HASHOFF words can
+                       also be lowercase, e.g. "list".
+
+-sslDelCert [pem]      Prompts you to delete all .crt .pem .key .req files
+                       associated with [pem].  "SAVE" and lookups as in
+                       -sslCertInfo apply as well.
 
-                       To create certificates for all sorts of authentications
-                       (clients, servers, via CA, etc) see the openssl(1)
-                       command.  Of particular usefulness is the "x509"
-                       subcommand of openssl(1).
 
 -stunnel [pem]         Use the stunnel(8) (www.stunnel.org) to provide an
-                       encrypted SSL tunnel between viewers and x11vnc.  This
-                       was implemented prior to the integrated -ssl encrpytion.
-                       It works well.  This requires stunnel to be installed
+                       encrypted SSL tunnel between viewers and x11vnc.
+
+                       This external tunnel method was implemented prior to the
+                       integrated -ssl encryption described above.  It still
+                       works well.  This requires stunnel to be installed
                        on the system and available via PATH (n.b. stunnel is
                        often installed in sbin directories).  Version 4.x of
                        stunnel is assumed (but see -stunnel3 below.)
@@ -6380,14 +6715,13 @@ Options:
                        SSL.  Unfortunately not too many do this.  UltraVNC has
                        an encryption plugin but it does not seem to be SSL.
 
-                       In the x11vnc distribution, a patched TightVNC Java
-                       applet is provided in classes/ssl that does SSL
+                       Also, in the x11vnc distribution, a patched TightVNC
+                       Java applet is provided in classes/ssl that does SSL
                        connections (only).
 
                        It is also not too difficult to set up an stunnel or
-                       other SSL tunnel on the viewer side.
-
-                       A simple example on Unix using stunnel 3.x is:
+                       other SSL tunnel on the viewer side.  A simple example
+                       on Unix using stunnel 3.x is:
 
                          % stunnel -c -d localhost:5901 -r remotehost:5900
                          % vncviewer localhost:1
@@ -6419,9 +6753,9 @@ Options:
                        or VNC Viewer applet.  That's right 3 separate "Are
                        you sure you want to connect" dialogs!)
 
-                       So use the -https option to provide a separate,
-                       more reliable HTTPS port that x11vnc will listen on.
-                       If [port] is not provided, one is autoselected.
+                       So use the -https option to provide a separate, more
+                       reliable HTTPS port that x11vnc will listen on.  If
+                       [port] is not provided (or is 0), one is autoselected.
                        The URL to use is printed out at startup.
 
                        The SSL Java applet directory is specified via the
@@ -6443,9 +6777,10 @@ Options:
                        file "file".  Once the password is stored the
                        program exits.  Use the password via "-rfbauth file"
 
-                       If called with no arguments, i.e., "-storepasswd",
+                       If called with no arguments, "x11vnc -storepasswd",
                        the user is prompted for a password and it is stored
-                       in the file ~/.vnc/passwd
+                       in the file ~/.vnc/passwd.  Called with one argument,
+                       that will be the file to store the prompted password in.
 
 -nopw                  Disable the big warning message when you use x11vnc
                        without some sort of password.
@@ -7449,6 +7784,22 @@ Options:
                        to really throttle down the screen polls (i.e. sleep
                        for about 1.5 secs). Use 0 to disable.  Default: 60
 
+-nofbpm                If the system supports the FBPM (Frame Buffer Power
+-fbpm                  Management) extension (i.e. some Sun systems), then
+                       prevent the video h/w from going into a reduced power
+                       state when VNC clients are connected.
+
+                       FBPM capable video h/w save energy when the workstation
+                       is idle by going into low power states (similar to DPMS
+                       for monitors).  This interferes with x11vnc's polling
+                       of the framebuffer data.
+
+                       "-nofbpm" means prevent FBPM low power states whenever
+                       VNC clients are connected, while "-fbpm" means to not
+                       monitor the FBPM state at all.  See the xset(1) manpage
+                       for details.  -nofbpm is basically the same as running
+                       "xset fbpm force on" periodically.  Default: -fbpm
+
 -noxdamage             Do not use the X DAMAGE extension to detect framebuffer
                        changes even if it is available.  Use -xdamage if your
                        default is to have it off.
@@ -7901,6 +8252,8 @@ n
                        nap             enable  -nap mode.
                        nonap           disable -nap mode.
                        sb:n            set -sb to n s, same as screen_blank:n
+                       fbpm            disable -nofbpm mode.
+                       nofbpm          enable  -nofbpm mode.
                        xdamage         enable  xdamage polling hints.
                        noxdamage       disable xdamage polling hints.
                        xd_area:A       set -xd_area max pixel area to "A"
@@ -8021,8 +8374,8 @@ n
                        debug_pointer dp nodebug_pointer nodp debug_keyboard
                        dk nodebug_keyboard nodk deferupdate defer wait_ui
                        wait_bog nowait_bog slow_fb wait readtimeout nap nonap
-                       sb screen_blank fs gaps grow fuzz snapfb nosnapfb
-                       rawfb progressive rfbport http nohttp httpport
+                       sb screen_blank fbpm nofbpm fs gaps grow fuzz snapfb
+                       nosnapfb rawfb progressive rfbport http nohttp httpport
                        httpdir enablehttpproxy noenablehttpproxy alwaysshared
                        noalwaysshared nevershared noalwaysshared dontdisconnect
                        nodontdisconnect desktop debug_xevents nodebug_xevents
@@ -8037,9 +8390,9 @@ n
                        http_url auth xauth users rootshift clipshift
                        scale_str scaled_x scaled_y scale_numer scale_denom
                        scale_fac scaling_blend scaling_nomult4 scaling_pad
-                       scaling_interpolate inetd privremote unsafe safer
-                       nocmds passwdfile unixpw unixpw_nis unixpw_list ssl
-                       ssl_pem sslverify stunnel stunnel_pem usepw using_shm
+                       scaling_interpolate inetd privremote unsafe safer nocmds
+                       passwdfile unixpw unixpw_nis unixpw_list ssl ssl_pem
+                       sslverify stunnel stunnel_pem https usepw using_shm
                        logfile o flag rc norc h help V version lastmod bg
                        sigpipe threads readrate netrate netlatency pipeinput
                        clients client_count pid ext_xtest ext_xtrap ext_xrecord
diff --git a/x11vnc/cleanup.c b/x11vnc/cleanup.c
index 23e810c..e966d61 100644
--- a/x11vnc/cleanup.c
+++ b/x11vnc/cleanup.c
@@ -33,6 +33,7 @@ int trap_getimage_xerror(Display *d, XErrorEvent *error);
 char *xerror_string(XErrorEvent *error);
 void initialize_crash_handler(void);
 void initialize_signals(void);
+void unset_signals(void);
 int known_sigpipe_mode(char *s);
 
 
@@ -107,8 +108,13 @@ static void clean_icon_mode(void) {
  * Normal exiting
  */
 void clean_up_exit (int ret) {
+	static int depth = 0;
 	exit_flag = 1;
 
+	if (depth++ > 2) {
+		exit(ret);
+	}
+
 	if (icon_mode) {
 		clean_icon_mode();
 	}
@@ -427,6 +433,19 @@ void initialize_signals(void) {
 	X_UNLOCK;
 }
 
+void unset_signals(void) {
+	signal(SIGHUP,  SIG_DFL);
+	signal(SIGINT,  SIG_DFL);
+	signal(SIGQUIT, SIG_DFL);
+	signal(SIGABRT, SIG_DFL);
+	signal(SIGTERM, SIG_DFL);
+	signal(SIGBUS,  SIG_DFL);
+	signal(SIGSEGV, SIG_DFL);
+	signal(SIGFPE,  SIG_DFL);
+	signal(SIGPIPE, SIG_DFL);
+}
+
+
 int known_sigpipe_mode(char *s) {
 /*
  * skip, ignore, exit
diff --git a/x11vnc/cleanup.h b/x11vnc/cleanup.h
index c34b7e5..c0b02d2 100644
--- a/x11vnc/cleanup.h
+++ b/x11vnc/cleanup.h
@@ -20,6 +20,7 @@ extern int trap_getimage_xerror(Display *d, XErrorEvent *error);
 extern char *xerror_string(XErrorEvent *error);
 extern void initialize_crash_handler(void);
 extern void initialize_signals(void);
+extern void unset_signals(void);
 extern int known_sigpipe_mode(char *s);
 
 #endif /* _X11VNC_CLEANUP_H */
diff --git a/x11vnc/connections.c b/x11vnc/connections.c
index baf1e84..7d23c42 100644
--- a/x11vnc/connections.c
+++ b/x11vnc/connections.c
@@ -2190,4 +2190,3 @@ void check_new_clients(void) {
 	}
 }
 
-
diff --git a/x11vnc/help.c b/x11vnc/help.c
index 544d26b..409ecd9 100644
--- a/x11vnc/help.c
+++ b/x11vnc/help.c
@@ -528,14 +528,14 @@ void print_help(int mode) {
 "-unixpw_nis [list]     As -unixpw above, however do not use su(1) but rather\n"
 "                       use the traditional getpwnam(3) + crypt(3) method to\n"
 "                       verify passwords instead.  This requires that the\n"
-"                       encrpyted passwords be readable.  Passwords stored\n"
+"                       encrypted passwords be readable.  Passwords stored\n"
 "                       in /etc/shadow will be inaccessible unless x11vnc\n"
 "                       is run as root.\n"
 "\n"
 "                       This is called \"NIS\" mode simply because in most\n"
 "                       NIS setups the user encrypted passwords are accessible\n"
 "                       (e.g. \"ypcat passwd\").  NIS is not required for this\n"
-"                       mode to work (only that getpwnam(3) return the encrpyted\n"
+"                       mode to work (only that getpwnam(3) return the encrypted\n"
 "                       password is required), but it is unlikely it will work\n"
 "                       for any other modern environment.  All of the -unixpw\n"
 "                       options and contraints apply.\n"
@@ -549,18 +549,19 @@ void print_help(int mode) {
 "\n"
 "                       [pem] is optional, use \"-ssl /path/to/mycert.pem\"\n"
 "                       to specify a PEM certificate file to use to identify\n"
-"                       and provide a key for this server.  See openssl(1)\n"
-"                       for what a PEM can be.\n"
+"                       and provide a key for this server.  See openssl(1) for\n"
+"                       more info about PEMs and the -sslGenCert option below.\n"
 "\n"
-"                       Connecting VNC viewer SSL tunnels can optionally\n"
+"                       The connecting VNC viewer SSL tunnel can optionally\n"
 "                       authenticate this server if they have the public\n"
 "                       key part of the certificate (or a common certificate\n"
 "                       authority, CA, is a more sophisicated way to verify\n"
-"                       this server's cert).  This is used to prevent\n"
-"                       man-in-the-middle attacks.  Otherwise, if the VNC\n"
-"                       viewer accepts this server's key without verification,\n"
-"                       at least the traffic is protected from passive sniffing\n"
-"                       on the network (but NOT from man-in-the-middle attacks).\n"
+"                       this server's cert, see -sslGenCA below).  This is\n"
+"                       used to prevent man-in-the-middle attacks.  Otherwise,\n"
+"                       if the VNC viewer accepts this server's key without\n"
+"                       verification, at least the traffic is protected\n"
+"                       from passive sniffing on the network (but NOT from\n"
+"                       man-in-the-middle attacks).\n"
 "\n"
 "                       If [pem] is not supplied and the openssl(1) utility\n"
 "                       command exists in PATH, then a temporary, self-signed\n"
@@ -573,15 +574,34 @@ void print_help(int mode) {
 "                       temporary certificate, the public part of it will be\n"
 "                       displayed to stderr (e.g. one could copy it to the\n"
 "                       client-side to provide authentication of the server to\n"
-"                       VNC viewers.)\n"
+"                       VNC viewers.)  See following paragraphs for how to save\n"
+"                       keys to reuse when x11vnc is restarted.\n"
 "\n"
 "                       Set the env. var. X11VNC_SHOW_TMP_PEM=1 to have x11vnc\n"
 "                       print out the entire certificate, including the PRIVATE\n"
 "                       KEY part, to stderr.  One could reuse this cert if saved\n"
 "                       in a [pem] file.  Similarly, set X11VNC_KEEP_TMP_PEM=1\n"
 "                       to not delete the temporary PEM file: the file name\n"
-"                       will be printed to stderr (so one could move it to a\n"
-"                       safe place for reuse).\n"
+"                       will be printed to stderr (so one could move it to\n"
+"                       a safe place for reuse).  You will be prompted for a\n"
+"                       passphrase for the private key.\n"
+"\n"
+"                       If [pem] is \"SAVE\" then the certificate will be saved\n"
+"                       to the file ~/.vnc/certs/server.pem, or if that file\n"
+"                       exists it will be used directly.  Similarly, if [pem]\n"
+"                       is \"SAVE_PROMPT\" the server.pem certificate will be\n"
+"                       made based on your answers to its prompts for info such\n"
+"                       as OrganizationalName, CommonName, etc.\n"
+"\n"
+"                       Use \"SAVE-<string>\" and \"SAVE_PROMPT-<string>\"\n"
+"                       to refer to the file ~/.vnc/certs/server-<string>.pem\n"
+"                       instead.  E.g. \"SAVE-charlie\" will store to the file\n"
+"                       ~/.vnc/certs/server-charlie.pem\n"
+"\n"
+"                       See -ssldir below to use a directory besides the\n"
+"                       default ~/.vnc/certs\n"
+"\n"
+"                       Example: x11vnc -ssl SAVE -display :0 ...\n"
 "\n"
 "                       Reverse connections are disabled in -ssl mode because\n"
 "                       there is no way to ensure that data channel will\n"
@@ -589,33 +609,369 @@ void print_help(int mode) {
 "                       override this.\n"
 "\n"
 "                       Your VNC viewer will also need to be able to connect\n"
-"                       via SSL.  See the discussion below under -stunnel\n"
-"                       and the FAQ for how this might be achieved.  E.g. on\n"
-"                       Unix it is easy to write a shell script that starts up\n"
-"                       stunnel and then vncviewer.  Also in the x11vnc source\n"
-"                       a SSL enabled Java VNC Viewer applet is provided in\n"
-"                       the classes/ssl directory.\n"
+"                       via SSL.  See the discussion below under -stunnel and\n"
+"                       the FAQ (ssl_vncviewer script) for how this might be\n"
+"                       achieved.  E.g. on Unix it is easy to write a shell\n"
+"                       script that starts up stunnel and then vncviewer.\n"
+"                       Also in the x11vnc source a SSL enabled Java VNC Viewer\n"
+"                       applet is provided in the classes/ssl directory.\n"
+"\n"
+"-ssldir [dir]          Use [dir] as an alternate ssl certificate and key\n"
+"                       management toplevel directory.  The default is\n"
+"                       ~/.vnc/certs\n"
+"\n"
+"                       This directory is used to store server and other\n"
+"                       certificates and keys and also other materials.  E.g. in\n"
+"                       the simplest case, \"-ssl SAVE\" will store the x11vnc\n"
+"                       server cert in [dir]/server.pem\n"
+"\n"
+"                       Use of alternate directories via -ssldir allows you to\n"
+"                       manage multiple VNC Certificate Authority (CA) keys.\n"
+"                       Another use is if ~/.vnc/cert is on an NFS share you\n"
+"                       might want your certificates and keys to be on a local\n"
+"                       filesystem to prevent network snooping (for example\n"
+"                       -ssldir /var/lib/x11vnc-certs).\n"
+"\n"
+"                       -ssldir effects the other -ssl* options.  In the case\n"
+"                       of maintenance commands where the VNC server is not run\n"
+"                       (e.g. -sslGenCA), the -ssldir option must precede the\n"
+"                       command. E.g. x11vnc -ssldir ~/mydir -sslCertInfo LIST\n"
 "\n"
 "-sslverify [path]      For either of the -ssl or -stunnel modes, use [path]\n"
 "                       to provide certificates to authenticate incoming VNC\n"
-"                       client connections.  This can be used as a method to\n"
-"                       replace standard password authentication of clients.\n"
+"                       *Client* connections (normally only the server is\n"
+"                       authenticated in SSL.)  This can be used as a method\n"
+"                       to replace standard password authentication of clients.\n"
 "\n"
 "                       If [path] is a directory it contains the client (or CA)\n"
-"                       certificates in separate files.  If [path] is a file, it\n"
-"                       contains multiple certificates.  These correspond to the\n"
-"                       \"CApath = dir\" and \"CAfile = file\" stunnel options.\n"
-"                       See the stunnel(8) manpage for details.\n"
+"                       certificates in separate files.  If [path] is a file,\n"
+"                       it contains multiple certificates.  See special tokens\n"
+"                       below.  These correspond to the \"CApath = dir\" and\n"
+"                       \"CAfile = file\" stunnel options.  See the stunnel(8)\n"
+"                       manpage for details.\n"
+"\n"
+"                       Examples:\n"
+"                              x11vnc -ssl -sslverify ~/my.pem\n"
+"                              x11vnc -ssl -sslverify ~/my_pem_dir/\n"
+"\n"
+"                       Note that if [path] is a directory, it must contain\n"
+"                       the certs in separate files named like <HASH>.0, where\n"
+"                       the value of <HASH> is found by running the command\n"
+"                       \"openssl x509 -hash -noout -in file.crt\". Evidently\n"
+"                       one uses <HASH>.1 if there is a collision...\n"
+"\n"
+"                       The the key-management utility \"-sslCertInfo HASHON\"\n"
+"                       and \"-sslCertInfo HASHOFF\" will create/delete these\n"
+"                       hashes for you automatically (via symlink) in the HASH\n"
+"                       subdirs it manages.  Then you can point -sslverify to\n"
+"                       the HASH subdir.\n"
+"\n"
+"                       Special tokens: in -ssl mode, if [path] is not a file or\n"
+"                       a directory, it is taken as a comma separated list of\n"
+"                       tokens that are interpreted as follows:\n"
+"\n"
+"                       If a token is \"CA\" that means load the CA/cacert.pem\n"
+"                       file from the ssl directory.  If a token is \"clients\"\n"
+"                       then all the files clients/*.crt in the ssl directory\n"
+"                       are loaded.  Otherwise the file clients/token.crt\n"
+"                       is attempted to be loaded.  As a kludge, use a token\n"
+"                       like ../server-foo to load a server cert if you find\n"
+"                       that necessary.\n"
+"                       \n"
+"                       Use -ssldir to use a directory different from the\n"
+"                       ~/.vnc/certs default.\n"
+"                       \n"
+"                       Note that if the \"CA\" cert is loaded you do not need\n"
+"                       to load any of the certs that have been signed by it.\n"
+"                       You will need to load any additional self-signed certs\n"
+"                       however.\n"
+"                       \n"
+"                       Examples:\n"
+"                              x11vnc -ssl -sslverify CA\n"
+"                              x11vnc -ssl -sslverify self:fred,self:jim\n"
+"                              x11vnc -ssl -sslverify CA,clients\n"
+"                       \n"
+"                       Usually \"-sslverify CA\" is the most effective.\n"
+"                       See the -sslGenCA and -sslGenCert options below for\n"
+"                       how to set up and manage the CA framework.\n"
+"                       \n"
+"\n"
+"\n"
+"                       NOTE: the following utilities, -sslGenCA, -sslGenCert,\n"
+"                       -sslEncKey, and -sslCertInfo are provided for\n"
+"                       completeness, but for casual usage they are overkill.\n"
+"\n"
+"                       They provide VNC Certificate Authority (CA) key creation\n"
+"                       and server / client key generation and signing.  So they\n"
+"                       provide a basic Public Key management framework for\n"
+"                       VNC-ing with x11vnc. (note that they require openssl(1)\n"
+"                       be installed on the system)\n"
+"\n"
+"                       However, the simplest usage mode (where x11vnc\n"
+"                       automatically generates its own, self-signed, temporary\n"
+"                       key and the VNC viewers always accept it, e.g. accepting\n"
+"                       via a dialog box) is probably safe enough for most\n"
+"                       scenarios.  CA management is not needed.\n"
+"\n"
+"                       To protect against Man-In-The-Middle attacks the\n"
+"                       simplest mode can be improved by using \"-ssl SAVE\"\n"
+"                       to have x11vnc create a longer term self-signed\n"
+"                       certificate, and then (safely) copy the corresponding\n"
+"                       public key cert to the desired client machines (care\n"
+"                       must be taken the private key part is not stolen;\n"
+"                       you will be prompted for a passphrase).\n"
+"\n"
+"                       So keep in mind no CA key creation or management\n"
+"                       (-sslGenCA and -sslGenCert) is needed for either of\n"
+"                       the above two common usage modes.\n"
+"\n"
+"                       One might want to use -sslGenCA and -sslGenCert\n"
+"                       if you had a large number of VNC client and server\n"
+"                       workstations.  That way the administrator could generate\n"
+"                       a single CA key with -sslGenCA and distribute its\n"
+"                       certificate part to all of the workstations.\n"
+"\n"
+"                       Next, he could create signed VNC server keys\n"
+"                       (-sslGenCert server ...) for each workstation or user\n"
+"                       that then x11vnc would use to authenticate itself to\n"
+"                       any VNC client that has the CA cert.\n"
+"\n"
+"                       Optionally, the admin could also make it so the\n"
+"                       VNC clients themselves are authenticated to x11vnc\n"
+"                       (-sslGenCert client ...)  For this -sslverify would be\n"
+"                       pointed to the CA cert (and/or self-signed certs).\n"
+"\n"
+"                       x11vnc will be able to use all of these cert and\n"
+"                       key files.  On the VNC client side, they will need to\n"
+"                       be \"imported\" somehow.  Web browsers have \"Manage\n"
+"                       Certificates\" actions as does the Java applet plugin\n"
+"                       Control Panel.  stunnel can also use these files (see\n"
+"                       the ssl_vncviewer example script in the FAQ.)\n"
+"\n"
+"-sslGenCA [dir]        Generate your own Certificate Authority private key,\n"
+"                       certificate, and other files in directory [dir].\n"
+"\n"
+"                       If [dir] is not supplied, a -ssldir setting is used,\n"
+"                       or otherwise ~/.vnc/certs is used.\n"
+"\n"
+"                       This command also creates directories where server and\n"
+"                       client certs and keys will be stored.  The openssl(1)\n"
+"                       program must be installed on the system and available\n"
+"                       in PATH.\n"
+"\n"
+"                       After the CA files and directories are created the\n"
+"                       command exits; the VNC server is not run.\n"
+"\n"
+"                       You will be prompted for information to put into the CA\n"
+"                       certificate.  The info does not have to be accurate just\n"
+"                       as long as clients accept the cert for VNC connections.\n"
+"                       You will also need to supply a passphrase of at least\n"
+"                       4 characters for the CA private key.\n"
+"\n"
+"                       Once you have generated the CA you can distribute\n"
+"                       its certificate part, [dir]/CA/cacert.pem, to other\n"
+"                       workstations where VNC viewers will be run.  One will\n"
+"                       need to \"import\" this certicate in the applications,\n"
+"                       e.g. Web browser, Java applet plugin, stunnel, etc.\n"
+"                       Next, you can create and sign keys using the CA with\n"
+"                       the -sslGenCert option below.\n"
+"\n"
+"                       Examples:\n"
+"                                x11vnc -sslGenCA\n"
+"                                x11vnc -sslGenCA  ~/myCAdir\n"
+"                                x11vnc -ssldir ~/myCAdir -sslGenCA\n"
+"\n"
+"                       (the last two lines are equivalent)\n"
+"\n"
+"-sslGenCert type name  Generate a VNC server or client certificate and private\n"
+"                       key pair signed by the CA created previously with\n"
+"                       -sslGenCA.  The openssl(1) program must be installed\n"
+"                       on the system and available in PATH.\n"
+"\n"
+"                       After the Certificate is generated the command exits;\n"
+"                       the VNC server is not run.\n"
+"\n"
+"                       The type of key to be generated is the string \"type\".\n"
+"                       It is either \"server\" (i.e. for use by x11vnc) or\n"
+"                       \"client\" (for a VNC viewer).  Note that typically\n"
+"                       only \"server\" is used: the VNC clients authenticate\n"
+"                       themselves by a non-public-key method (e.g. VNC or\n"
+"                       unix password).  \"type\" is required.\n"
+"\n"
+"                       An arbitrary default name you want to associate with\n"
+"                       the key is supplied by the \"name\" string.  You can\n"
+"                       change it at the various prompts when creating the key.\n"
+"                       \"name\" is optional.\n"
+"\n"
+"                       If name is left blank for clients keys then \"nobody\"\n"
+"                       is used.  If left blank for server keys, then the\n"
+"                       primary server key: \"server.pem\" is created (this\n"
+"                       is the saved one referenced by \"-ssl SAVE\" when the\n"
+"                       server is started)\n"
+"\n"
+"                       If \"name\" begins with the string \"self:\" then\n"
+"                       a self-signed certificate is created instead of one\n"
+"                       signed by your CA key.\n"
+"\n"
+"                       If \"name\" begins with the string \"req:\" then only a\n"
+"                       key (.key) and a certificate signing *request* (.req)\n"
+"                       are generated.  You can then send the .req file to\n"
+"                       an external CA (even a professional one, e.g. Thawte)\n"
+"                       and then combine the .key and the received cert into\n"
+"                       the .pem file with the same basename.\n"
+"\n"
+"                       The distinction between \"server\" and \"client\" is\n"
+"                       simply the choice of output filenames and sub-directory.\n"
+"                       This makes it so the -ssl SAVE-name option can easily\n"
+"                       pick up the x11vnc PEM file this option generates.\n"
+"                       And similarly makes it easy for the -sslverify option\n"
+"                       to pick up your client certs.\n"
+"\n"
+"                       There is nothing special about the filename or directory\n"
+"                       location of either the \"server\" and \"client\" certs.\n"
+"                       You can rename the files or move them to wherever\n"
+"                       you like.\n"
+"\n"
+"                       Precede this option with -ssldir [dir] to use a\n"
+"                       directory other than the default ~/.vnc/certs You will\n"
+"                       need to run -sslGenCA on that directory first before\n"
+"                       doing any -sslGenCert key creation.\n"
+"\n"
+"                       Note you cannot recreate a cert with exactly the same\n"
+"                       distiguished name (DN) as an existing one.  To do so,\n"
+"                       you will need to edit the [dir]/CA/index.txt file to\n"
+"                       delete the line.\n"
+"\n"
+"                       Similar to -sslGenCA, you will be prompted to fill\n"
+"                       in some information that will be recorded in the\n"
+"                       certificate when it is created.  Tip: if you know\n"
+"                       the fully-quailified hostname other people will be\n"
+"                       connecting to you can use that as the CommonName \"CN\"\n"
+"                       to avoid some applications (e.g. web browsers and java\n"
+"                       plugin) complaining it does not match the hostname.\n"
+"\n"
+"                       You will also need to supply the CA private key\n"
+"                       passphrase to unlock the private key created from\n"
+"                       -sslGenCA.  This private key is used to sign the server\n"
+"                       or client certicate.\n"
+"\n"
+"                       The \"server\" certs can be used by x11vnc directly by\n"
+"                       pointing to them via the -ssl [pem] option.  The default\n"
+"                       file will be ~/.vnc/certs/server.pem.  This one would\n"
+"                       be used by simply typing -ssl SAVE.  The pem file\n"
+"                       contains both the certificate and the private key.\n"
+"                       server.crt file contains the cert only.\n"
+"\n"
+"                       The \"client\" cert + private key file will need\n"
+"                       to be copied and imported into the VNC viewer\n"
+"                       side applications (Web browser, Java plugin,\n"
+"                       stunnel, etc.)  Once that is done you can delete the\n"
+"                       \"client\" private key file on this machine since\n"
+"                       it is only needed on the VNC viewer side.  The,\n"
+"                       e.g. ~/.vnc/certs/clients/<name>.pem contains both\n"
+"                       the cert and private key.  The <name>.crt contains the\n"
+"                       certificate only.\n"
+"\n"
+"                       NOTE: It is very important to know one should always\n"
+"                       generate new keys with a passphrase.  Otherwise if an\n"
+"                       untrusted user steals the key file he could use it to\n"
+"                       masquerade as the x11vnc server (or VNC viewer client).\n"
+"                       You will be prompted whether to encrypt the key with\n"
+"                       a passphrase or not.  It is recommended that you do.\n"
+"                       One inconvenience to a passphrase is that it must\n"
+"                       be suppled every time x11vnc or the client app is\n"
+"                       started up.\n"
+"\n"
+"                       Examples:\n"
+"\n"
+"                               x11vnc -sslGenCert server\n"
+"                               x11vnc -ssl SAVE -display :0 ...\n"
+"\n"
+"                       and then on viewer using ssl_vncviewer stunnel wrapper\n"
+"                       (see the FAQ):\n"
+
+"                               ssl_vncviewer -verify ./cacert.crt hostname:0\n"
+"\n"
+"                       (this assumes the cacert.crt cert from -sslGenCA\n"
+"                       was safely copied to the VNC viewer machine where\n"
+"                       ssl_vncviewer is run)\n"
+"\n"
+"                       Example using a name:\n"
+"\n"
+"                               x11vnc -sslGenCert server charlie\n"
+"                               x11vnc -ssl SAVE-charlie -display :0 ...\n"
+"\n"
+"                       Example for a client certificate (rarely used):\n"
+"\n"
+"                               x11vnc -sslGenCert client roger\n"
+"                               scp ~/.vnc/certs/clients/roger.pem somehost:.\n"
+"                               rm  ~/.vnc/certs/clients/roger.pem\n"
+"\n"
+"                       x11vnc is then started with the the option -sslverify\n"
+"                       ~/.vnc/certs/clients/roger.crt (or simply -sslverify\n"
+"                       roger), and on the viewer user on somehost could do\n"
+"                       for example:\n"
+"\n"
+"                               ssl_vncviewer -mycert ./roger.pem hostname:0\n"
+"\n"
+"-sslEncKey [pem]       Utility to encrypt an existing PEM file with a\n"
+"                       passphrase you supply when prompted.  For that key to be\n"
+"                       used (e.g. by x11vnc) the passphrase must be supplied\n"
+"                       each time.\n"
+"\n"
+"                       The \"SAVE\" notation described under -ssl applies as\n"
+"                       well. (precede this option with -ssldir [dir] to refer\n"
+"                       a directory besides the default ~/.vnc/certs)\n"
+"\n"
+"                       The openssl(1) program must be installed on the system\n"
+"                       and available in PATH.  After the Key file is encrypted\n"
+"                       the command exits; the VNC server is not run.\n"
+"\n"
+"                       Examples:\n"
+"                               x11vnc -sslEncKey /path/to/foo.pem\n"
+"                               x11vnc -sslEncKey SAVE\n"
+"                               x11vnc -sslEncKey SAVE-charlie\n"
+"\n"
+"-sslCertInfo [pem]     Prints out information about an existing PEM file.\n"
+"                       In addition the public certificate is also printed.\n"
+"                       The openssl(1) program must be in PATH. Basically the\n"
+"                       command \"openssl x509 -text\" is run on the pem.\n"
+"\n"
+"                       The \"SAVE\" notation described under -ssl applies\n"
+"                       as well.\n"
+"\n"
+"                       Using  \"LIST\" will give a list of all certs being\n"
+"                       managed (in the ~/.vnc/certs dir, use -ssldir to refer\n"
+"                       to another dir).  \"ALL\" will print out the info for\n"
+"                       every managed key (this can be very long).  Giving a\n"
+"                       client or server cert shortname will also try a lookup\n"
+"                       (e.g. -sslCertInfo charlie).  Use \"LISTL\" or \"LL\"\n"
+"                       for a long (ls -l style) listing.\n"
+"\n"
+"                       Using \"HASHON\" will create subdirs [dir]/HASH and\n"
+"                       [dir]/HASH with OpenSSL hash filenames (e.g. 0d5fbbf1.0)\n"
+"                       symlinks pointing up to the corresponding *.crt file.\n"
+"                       ([dir] is ~/.vnc/certs or one given by -ssldir.)\n"
+"                       This is a useful way for other OpenSSL applications\n"
+"                       (e.g. stunnel) to access all of the certs without\n"
+"                       having to concatenate them.  x11vnc will not use them\n"
+"                       unless you specifically reference them.  \"HASHOFF\"\n"
+"                       removes these HASH subdirs.\n"
+"\n"
+"                       The LIST, LISTL, LL, ALL, HASHON, HASHOFF words can\n"
+"                       also be lowercase, e.g. \"list\".\n"
+"\n"
+"-sslDelCert [pem]      Prompts you to delete all .crt .pem .key .req files\n"
+"                       associated with [pem].  \"SAVE\" and lookups as in\n"
+"                       -sslCertInfo apply as well.\n"
 "\n"
-"                       To create certificates for all sorts of authentications\n"
-"                       (clients, servers, via CA, etc) see the openssl(1)\n"
-"                       command.  Of particular usefulness is the \"x509\"\n"
-"                       subcommand of openssl(1).\n"
 "\n"
 "-stunnel [pem]         Use the stunnel(8) (www.stunnel.org) to provide an\n"
-"                       encrypted SSL tunnel between viewers and x11vnc.  This\n"
-"                       was implemented prior to the integrated -ssl encrpytion.\n"
-"                       It works well.  This requires stunnel to be installed\n"
+"                       encrypted SSL tunnel between viewers and x11vnc.\n"
+"\n"
+"                       This external tunnel method was implemented prior to the\n"
+"                       integrated -ssl encryption described above.  It still\n"
+"                       works well.  This requires stunnel to be installed\n"
 "                       on the system and available via PATH (n.b. stunnel is\n"
 "                       often installed in sbin directories).  Version 4.x of\n"
 "                       stunnel is assumed (but see -stunnel3 below.)\n"
@@ -641,14 +997,13 @@ void print_help(int mode) {
 "                       SSL.  Unfortunately not too many do this.  UltraVNC has\n"
 "                       an encryption plugin but it does not seem to be SSL.\n"
 "\n"
-"                       In the x11vnc distribution, a patched TightVNC Java\n"
-"                       applet is provided in classes/ssl that does SSL\n"
+"                       Also, in the x11vnc distribution, a patched TightVNC\n"
+"                       Java applet is provided in classes/ssl that does SSL\n"
 "                       connections (only).\n"
 "\n"
 "                       It is also not too difficult to set up an stunnel or\n"
-"                       other SSL tunnel on the viewer side.\n"
-"\n"
-"                       A simple example on Unix using stunnel 3.x is:\n"
+"                       other SSL tunnel on the viewer side.  A simple example\n"
+"                       on Unix using stunnel 3.x is:\n"
 "\n"
 "                         %% stunnel -c -d localhost:5901 -r remotehost:5900\n"
 "                         %% vncviewer localhost:1\n"
@@ -704,9 +1059,10 @@ void print_help(int mode) {
 "                       file \"file\".  Once the password is stored the\n"
 "                       program exits.  Use the password via \"-rfbauth file\"\n"
 "\n"
-"                       If called with no arguments, i.e., \"-storepasswd\",\n"
+"                       If called with no arguments, \"x11vnc -storepasswd\",\n"
 "                       the user is prompted for a password and it is stored\n"
-"                       in the file ~/.vnc/passwd\n"
+"                       in the file ~/.vnc/passwd.  Called with one argument,\n"
+"                       that will be the file to store the prompted password in.\n"
 "\n"
 "-nopw                  Disable the big warning message when you use x11vnc\n"
 "                       without some sort of password.\n"
@@ -1718,6 +2074,22 @@ void print_help(int mode) {
 "                       to really throttle down the screen polls (i.e. sleep\n"
 "                       for about 1.5 secs). Use 0 to disable.  Default: %d\n"
 "\n"
+"-nofbpm                If the system supports the FBPM (Frame Buffer Power\n"
+"-fbpm                  Management) extension (i.e. some Sun systems), then\n"
+"                       prevent the video h/w from going into a reduced power\n"
+"                       state when VNC clients are connected.\n"
+"\n"
+"                       FBPM capable video h/w save energy when the workstation\n"
+"                       is idle by going into low power states (similar to DPMS\n"
+"                       for monitors).  This interferes with x11vnc's polling\n"
+"                       of the framebuffer data.\n"
+"\n"
+"                       \"-nofbpm\" means prevent FBPM low power states whenever\n"
+"                       VNC clients are connected, while \"-fbpm\" means to not\n"
+"                       monitor the FBPM state at all.  See the xset(1) manpage\n"
+"                       for details.  -nofbpm is basically the same as running\n"
+"                       \"xset fbpm force on\" periodically.  Default: %s\n"
+"\n"
 "-noxdamage             Do not use the X DAMAGE extension to detect framebuffer\n"
 "                       changes even if it is available.  Use -xdamage if your\n"
 "                       default is to have it off.\n"
@@ -2176,6 +2548,8 @@ void print_help(int mode) {
 "                       nap             enable  -nap mode.\n"
 "                       nonap           disable -nap mode.\n"
 "                       sb:n            set -sb to n s, same as screen_blank:n\n"
+"                       fbpm            disable -nofbpm mode.\n"
+"                       nofbpm          enable  -nofbpm mode.\n"
 "                       xdamage         enable  xdamage polling hints.\n"
 "                       noxdamage       disable xdamage polling hints.\n"
 "                       xd_area:A       set -xd_area max pixel area to \"A\"\n"
@@ -2296,8 +2670,8 @@ void print_help(int mode) {
 "                       debug_pointer dp nodebug_pointer nodp debug_keyboard\n"
 "                       dk nodebug_keyboard nodk deferupdate defer wait_ui\n"
 "                       wait_bog nowait_bog slow_fb wait readtimeout nap nonap\n"
-"                       sb screen_blank fs gaps grow fuzz snapfb nosnapfb\n"
-"                       rawfb progressive rfbport http nohttp httpport\n"
+"                       sb screen_blank fbpm nofbpm fs gaps grow fuzz snapfb\n"
+"                       nosnapfb rawfb progressive rfbport http nohttp httpport\n"
 "                       httpdir enablehttpproxy noenablehttpproxy alwaysshared\n"
 "                       noalwaysshared nevershared noalwaysshared dontdisconnect\n"
 "                       nodontdisconnect desktop debug_xevents nodebug_xevents\n"
@@ -2458,6 +2832,7 @@ void print_help(int mode) {
 		rfbMaxClientWait/1000,
 		take_naps ? "take naps":"no naps",
 		screen_blank,
+		watch_fbpm ? "-nofbpm":"-fbpm",
 		xdamage_max_area, NSCAN, xdamage_memory,
 		use_threads ? "-threads":"-nothreads",
 		fs_frac,
@@ -2574,17 +2949,28 @@ void nopassword_warning_msg(int gotloc) {
 "#@                                                           @#\n"
 "#@  an existing ~/.vnc/passwd file will work too.            @#\n"
 "#@                                                           @#\n"
+"#@  Running \"x11vnc -storepasswd\" with no arguments          @#\n"
+"#@  will prompt for a passwd to store in ~/.vnc/passwd.      @#\n"
+"#@                                                           @#\n"
 "#@  You can also use the -passwdfile or -passwd options.     @#\n"
 "#@  (note -passwd is unsafe if local users are not trusted)  @#\n"
 "#@                                                           @#\n"
 "#@  Make sure any -rfbauth and -passwdfile password files    @#\n"
 "#@  cannot be read by untrusted users.                       @#\n"
 "#@                                                           @#\n"
+"#@  Use x11vnc -usepw to automatically use your              @#\n"
+"#@  ~/.vnc/passwd or ~/.vnc/passwdfile password files.       @#\n"
+"#@  (and prompt you to create ~/.vnc/passwd if neither       @#\n"
+"#@  file exists.)                                            @#\n"
+"#@                                                           @#\n"
+"#@                                                           @#\n"
 "#@  Even with a password, the subsequent VNC traffic is      @#\n"
 "#@  sent in the clear.  Consider tunnelling via ssh(1):      @#\n"
 "#@                                                           @#\n"
 "#@    http://www.karlrunge.com/x11vnc/#tunnelling            @#\n"
 "#@                                                           @#\n"
+"#@  Or using the x11vnc SSL options: -ssl and -stunnel       @#\n"
+"#@                                                           @#\n"
 "#@  Please Read the documention for more info about          @#\n"
 "#@  passwords, security, and encryption.                     @#\n"
 "#@                                                           @#\n"
diff --git a/x11vnc/options.c b/x11vnc/options.c
index ec51880..a4ddee5 100644
--- a/x11vnc/options.c
+++ b/x11vnc/options.c
@@ -23,6 +23,7 @@ int stunnel_port = 0;
 char *stunnel_pem = NULL;
 int use_openssl = 0;
 char *openssl_pem = NULL;
+char *ssl_certs_dir = NULL;
 int https_port_num = -1;
 char *ssl_verify = NULL;
 int ssl_initialized = 0;
@@ -279,6 +280,13 @@ int napfac = 4;		/* time = napfac*waitms, cut load with extra waits */
 int napmax = 1500;	/* longest nap in ms. */
 int ui_skip = 10;	/* see watchloop.  negative means ignore input */
 
+
+#if LIBVNCSERVER_HAVE_FBPM
+int watch_fbpm = 1;	/* -nofbpm */
+#else
+int watch_fbpm = 0;
+#endif
+
 int watch_selection = 1;	/* normal selection/cutbuffer maintenance */
 int watch_primary = 1;		/* more dicey, poll for changes in PRIMARY */
 int watch_clipboard = 1;
diff --git a/x11vnc/options.h b/x11vnc/options.h
index 2daf4e0..a0976af 100644
--- a/x11vnc/options.h
+++ b/x11vnc/options.h
@@ -23,6 +23,7 @@ extern int stunnel_port;
 extern char *stunnel_pem;
 extern int use_openssl;
 extern char *openssl_pem;
+extern char *ssl_certs_dir;
 extern int https_port_num;
 extern char *ssl_verify;
 extern int ssl_initialized;
@@ -208,6 +209,8 @@ extern int napfac;
 extern int napmax;
 extern int ui_skip;
 
+extern int watch_fbpm;
+
 extern int watch_selection;
 extern int watch_primary;
 extern int watch_clipboard;
diff --git a/x11vnc/pm.c b/x11vnc/pm.c
new file mode 100644
index 0000000..8b3eab5
--- /dev/null
+++ b/x11vnc/pm.c
@@ -0,0 +1,93 @@
+/* -- pm.c -- */
+#include "x11vnc.h"
+#include "cleanup.h"
+
+void check_pm(void);
+static void check_fbpm(void);
+
+#if LIBVNCSERVER_HAVE_FBPM
+#include <X11/Xmd.h>
+#include <X11/extensions/fbpm.h>
+#endif
+
+void check_pm(void) {
+	check_fbpm();
+	/* someday dpms activities? */
+}
+
+static void check_fbpm(void) {
+	static int init_fbpm = 0;
+#if LIBVNCSERVER_HAVE_FBPM
+	static int fbpm_capable = 0;
+	static time_t last_fbpm = 0;
+	int db = 1;
+
+	CARD16 level;
+	BOOL enabled;
+
+	if (raw_fb && ! dpy) return;	/* raw_fb hack */
+
+	if (! init_fbpm) {
+		if (FBPMCapable(dpy)) {
+			fbpm_capable = 1;
+			rfbLog("X display is capable of FBPM.\n");
+			if (watch_fbpm) {
+				rfbLog("Preventing low-power FBPM modes when"
+				    " VNC clients are connected.\n");
+			}
+		} else {
+			rfbLog("X display is not capable of FBPM.\n");
+			fbpm_capable = 0;
+		}
+		init_fbpm = 1;
+	}
+
+	if (! watch_fbpm) {
+		return;
+	}
+	if (! fbpm_capable) {
+		return;
+	}
+	if (! client_count) {
+		return;
+	}
+	if (time(0) < last_fbpm + 5) {
+		return;
+	}
+	last_fbpm = time(0);
+
+	if (FBPMInfo(dpy, &level, &enabled)) {
+		if (db) fprintf(stderr, "FBPMInfo level: %d enabled: %d\n", level, enabled);
+
+		if (enabled && level != FBPMModeOn) {
+			char *from = "unknown-fbpm-state";
+			XErrorHandler old_handler = XSetErrorHandler(trap_xerror);
+			trapped_xerror = 0;
+
+			if (level == FBPMModeStandby) {
+				from = "FBPMModeStandby";
+			} else if (level == FBPMModeSuspend) {
+				from = "FBPMModeSuspend";
+			} else if (level == FBPMModeOff) {
+				from = "FBPMModeOff";
+			}
+
+			rfbLog("switching FBPM state from %s to FBPMModeOn\n", from);
+			
+			FBPMForceLevel(dpy, FBPMModeOn);
+		
+			XSetErrorHandler(old_handler);
+			trapped_xerror = 0;
+		}
+	} else {
+		if (db) fprintf(stderr, "FBPMInfo failed.\n");
+	}
+#else
+	if (raw_fb && ! dpy) return;	/* raw_fb hack */
+	if (! init_fbpm) {
+		rfbLog("X FBPM extension not supported.\n");
+		init_fbpm = 1;
+	}
+#endif
+}
+
diff --git a/x11vnc/pm.h b/x11vnc/pm.h
new file mode 100644
index 0000000..4b046d4
--- /dev/null
+++ b/x11vnc/pm.h
@@ -0,0 +1,7 @@
+#ifndef _X11VNC_PM_H
+#define _X11VNC_PM_H
+
+/* -- pm.h -- */
+extern void check_pm(void);
+
+#endif /* _X11VNC_PM_H */
diff --git a/x11vnc/remote.c b/x11vnc/remote.c
index 4080554..7c68493 100644
--- a/x11vnc/remote.c
+++ b/x11vnc/remote.c
@@ -3173,6 +3173,21 @@ char *process_remote_cmd(char *cmd, int stringonly) {
 		    screen_blank, w);
 		screen_blank = w;
 
+	} else if (!strcmp(p, "fbpm")) {
+		if (query) {
+			snprintf(buf, bufn, "ans=%s:%d", p, !watch_fbpm);
+			    goto qry;
+		}
+		rfbLog("remote_cmd: turning off -nofbpm mode.\n");
+		watch_fbpm = 0;
+	} else if (!strcmp(p, "nofbpm")) {
+		if (query) {
+			snprintf(buf, bufn, "ans=%s:%d", p, watch_fbpm);
+			    goto qry;
+		}
+		rfbLog("remote_cmd: turning on -nofbpm mode.\n");
+		watch_fbpm = 1;
+
 	} else if (strstr(p, "fs") == p) {
 		COLON_CHECK("fs:")
 		if (query) {
diff --git a/x11vnc/scan.c b/x11vnc/scan.c
index c35f823..c6dc481 100644
--- a/x11vnc/scan.c
+++ b/x11vnc/scan.c
@@ -2148,7 +2148,6 @@ static void ping_clients(int tile_cnt) {
 		last_send = now;
 	} else if (now - last_send > 2) {
 		/* Send small heartbeat to client */
-if (0) fprintf(stderr, "ping_clients 2\n");
 		mark_rect_as_modified(0, 0, 1, 1, 1);
 		last_send = now;
 	}
diff --git a/x11vnc/screen.c b/x11vnc/screen.c
index 9858ba3..3eaeb87 100644
--- a/x11vnc/screen.c
+++ b/x11vnc/screen.c
@@ -704,7 +704,9 @@ static XImage *initialize_raw_fb(void) {
 	if (! raw_fb_str) {
 		return NULL;
 	}
-
+	if (!strcasecmp(raw_fb_str, "NULL") || !strcasecmp(raw_fb_str, "ZERO")) {
+		raw_fb_str = strdup("map:/dev/zero@640x480x32");
+	}
 
 	if ( (q = strstr(raw_fb_str, "setup:")) == raw_fb_str) {
 		FILE *pipe;
diff --git a/x11vnc/sslcmds.c b/x11vnc/sslcmds.c
index 4b05a7d..f00232f 100644
--- a/x11vnc/sslcmds.c
+++ b/x11vnc/sslcmds.c
@@ -3,6 +3,8 @@
 #include "x11vnc.h"
 #include "inet.h"
 #include "cleanup.h"
+#include "sslhelper.h"
+#include "ssltools.h"
 
 #if LIBVNCSERVER_HAVE_FORK
 #if LIBVNCSERVER_HAVE_SYS_WAIT_H
@@ -17,6 +19,10 @@ void check_stunnel(void);
 int start_stunnel(int stunnel_port, int x11vnc_port);
 void stop_stunnel(void);
 void setup_stunnel(int rport, int *argc, char **argv);
+char *get_Cert_dir(char *cdir_in, char **tmp_in);
+void sslGenCA(char *cdir);
+void sslGenCert(char *ty, char *nm);
+void sslEncKey(char *path, int info_only);
 
 static pid_t stunnel_pid = 0;
 
@@ -293,3 +299,381 @@ void setup_stunnel(int rport, int *argc, char **argv) {
 	clean_up_exit(1);
 }
 
+char *get_Cert_dir(char *cdir_in, char **tmp_in) {
+	char *cdir, *home, *tmp;
+	struct stat sbuf;
+	int i;
+	char *cases1[] = {"/.vnc", "/.vnc/certs", "/.vnc/certs/CA"};
+	char *cases2[] = {"", "/CA", "/tmp"};
+
+	if (cdir_in != NULL) {
+		cdir = cdir_in;
+	} else {
+		cdir = ssl_certs_dir;
+	}
+
+	if (cdir == NULL) {
+		home = get_home_dir();
+		if (! home) {
+			return NULL;
+		}
+		cdir = (char *) malloc(strlen(home) + strlen("/.vnc/certs/CA") + 1);
+		for (i=0; i<3; i++) {
+			sprintf(cdir, "%s%s", home, cases1[i]);
+			if (stat(cdir, &sbuf) != 0) {
+				rfbLog("creating dir: %s\n", cdir);
+				if (mkdir(cdir, 0755) != 0) {
+					rfbLog("could not create directory %s\n", cdir);
+					rfbLogPerror("mkdir");
+					return NULL;
+				}
+			} else if (! S_ISDIR(sbuf.st_mode)) {
+				rfbLog("not a directory: %s\n", cdir);
+				return NULL;
+			}
+		}
+		sprintf(cdir, "%s%s", home, cases1[1]);
+	}
+
+	tmp = (char *) malloc(strlen(cdir) + 10);
+	for (i=0; i<3; i++) {
+		int ret;
+		sprintf(tmp, "%s%s", cdir, cases2[i]);
+		if (stat(tmp, &sbuf) != 0) {
+			rfbLog("creating dir: %s\n", tmp);
+			if (! strcmp(cases2[i], "/tmp")) {
+				ret = mkdir(tmp, 0700);
+			} else {
+				ret = mkdir(tmp, 0755);
+			}
+				
+			if (ret != 0) {
+				rfbLog("could not create directory %s\n", tmp);
+				rfbLogPerror("mkdir");
+				return NULL;
+			}
+		} else if (! S_ISDIR(sbuf.st_mode)) {
+			rfbLog("not a directory: %s\n", tmp);
+			return NULL;
+		}
+	}
+	sprintf(tmp, "%s/tmp", cdir);
+	*tmp_in = tmp;
+	return cdir;
+}
+
+void sslGenCA(char *cdir) {
+	char *openssl = find_openssl_bin();
+	char *tmp, *cmd, *scr, *cdir_use;
+	FILE *out;
+
+	if (! openssl) {
+		exit(1);
+	}
+
+	cdir_use = get_Cert_dir(cdir, &tmp);
+	if (! cdir_use) {
+		exit(1);
+	}
+
+	cmd = (char *) malloc(strlen(tmp) + 100);
+	scr = (char *) malloc(strlen(tmp) + 100);
+
+	sprintf(cmd, "%s/genca.%d.sh", tmp, getpid());
+	out = fopen(cmd, "w");
+	if (! out) {
+		rfbLog("could not open: %s\n", cmd);
+		rfbLogPerror("fopen");
+		exit(1);
+	}
+	fprintf(out, "%s", genCA);
+	fclose(out);
+
+	sprintf(scr, "/bin/sh %s", cmd);
+
+	rfbLog("Using openssl:   %s\n", openssl);
+	rfbLog("Using certs dir: %s\n", cdir_use);
+	fprintf(stderr, "\n");
+
+	set_env("BASE_DIR", cdir_use);
+	set_env("OPENSSL", openssl);
+
+	system(scr);
+	unlink(cmd);
+}
+
+void sslGenCert(char *ty, char *nm) {
+	char *openssl = find_openssl_bin();
+	char *tmp, *cmd, *scr, *cdir_use;
+	FILE *out;
+
+	if (! openssl) {
+		exit(1);
+	}
+
+	cdir_use = get_Cert_dir(NULL, &tmp);
+	if (! cdir_use) {
+		exit(1);
+	}
+
+	cmd = (char *) malloc(strlen(tmp) + 100);
+	scr = (char *) malloc(strlen(tmp) + 100);
+
+	sprintf(cmd, "%s/gencert.%d.sh", tmp, getpid());
+	out = fopen(cmd, "w");
+	if (! out) {
+		rfbLog("could not open: %s\n", cmd);
+		rfbLogPerror("fopen");
+		exit(1);
+	}
+	fprintf(out, "%s", genCert);
+	fclose(out);
+
+	sprintf(scr, "/bin/sh %s", cmd);
+
+	rfbLog("Using openssl:   %s\n", openssl);
+	rfbLog("Using certs dir: %s\n", cdir_use);
+	fprintf(stderr, "\n");
+
+	set_env("BASE_DIR", cdir_use);
+	set_env("OPENSSL", openssl);
+	if (! ty) {
+		set_env("TYPE", "");
+	} else {
+		set_env("TYPE", ty);
+	}
+	if (! nm) {
+		set_env("NAME", "");
+	} else {
+		char *q = strstr(nm, "SAVE-");
+		if (!strcmp(nm, "SAVE")) {
+			set_env("NAME", "");
+		} else if (q == nm) {
+			q += strlen("SAVE-");
+			set_env("NAME", q);
+		} else {
+			set_env("NAME", nm);
+		}
+	}
+
+	system(scr);
+	unlink(cmd);
+}
+
+void sslEncKey(char *path, int mode) {
+	char *openssl = find_openssl_bin();
+	char *scr, *cert = NULL, *tca;
+	char line[1024], tmp[] = "/tmp/x11vnc-tmp.XXXXXX";
+	char *cdir = NULL;
+	int tmp_fd, incert, info_only = 0, delete_only = 0;
+	int listlong = 0;
+	struct stat sbuf;
+	FILE *file;
+	static int depth = 0;
+
+	if (depth > 0) {
+		/* get_saved_pem may call us back. */
+		return;
+	}
+	depth++;
+
+	if (mode == 1) {
+		info_only = 1;
+	} else if (mode == 2) {
+		delete_only = 1;
+	}
+
+	if (! openssl) {
+		exit(1);
+	}
+	cdir = get_Cert_dir(NULL, &tca);
+	if (! cdir) {
+		fprintf(stderr, "could not find Cert dir\n");
+		exit(1);
+	}
+
+	if (!strcasecmp(path, "LL") || !strcasecmp(path, "LISTL")) {
+		listlong = 1;
+		path = "LIST";
+	}
+
+	if (strstr(path, "SAVE") == path) {
+		char *p = get_saved_pem(path, 0);
+		if (p == NULL) {
+			fprintf(stderr, "could not find saved pem matching: %s\n", path);
+			exit(1);
+		}
+		path = p;
+
+	} else if (!strcmp(path, "CA") && cdir) {
+		tca = (char *) malloc(strlen(cdir) + strlen("/CA/cacert.pem") + 1);
+		sprintf(tca, "%s/CA/cacert.pem", cdir);
+		path = tca;
+
+	} else if (info_only && (!strcasecmp(path, "LIST") ||
+	    !strcasecmp(path, "ALL"))) {
+		if (! cdir || strchr(cdir, '\'')) {
+			fprintf(stderr, "bad certdir char: %s\n", cdir ? cdir : "null");
+			exit(1);
+		}
+		tca = (char *) malloc(2*strlen(cdir) + strlen(program_name) + 1000);
+		sprintf(tca, "find '%s' -type f | egrep '\\.(crt|pem|key|req)$' "
+		    "| grep -v CA/newcerts", cdir);
+		if (!strcasecmp(path, "ALL")) {
+			/* ugh.. */
+			strcat(tca, " | grep -v private/cakey.pem | xargs -n1 ");
+			strcat(tca, program_name);
+			strcat(tca, " -ssldir '");
+			strcat(tca, cdir);
+			strcat(tca, "' -sslCertInfo 2>&1 ");
+		} else if (listlong) {
+			strcat(tca, " | xargs ls -l ");
+		}
+		system(tca);
+		return;
+
+	} else if (info_only && (!strcasecmp(path, "HASHON") ||
+	    !strcasecmp(path, "HASHOFF"))) {
+
+		tmp_fd = mkstemp(tmp);
+		if (tmp_fd < 0) {
+			exit(1);
+		}
+
+		write(tmp_fd, genCert, strlen(genCert));
+		close(tmp_fd);
+
+		scr = (char *) malloc(strlen(tmp) + 100);
+		sprintf(scr, "/bin/sh %s", tmp);
+
+		set_env("BASE_DIR", cdir);
+		set_env("OPENSSL", openssl);
+		set_env("TYPE", "server");
+		if (!strcasecmp(path, "HASHON")) {
+			set_env("HASHON", "1");
+		} else {
+			set_env("HASHOFF", "1");
+		}
+		system(scr);
+		unlink(tmp);
+		return;
+	}
+
+	if (stat(path, &sbuf) != 0) {
+		if (strstr(path, "client") || strchr(path, '/') == NULL) {
+			int i;
+			tca = (char *) malloc(strlen(cdir) + strlen("/clients")
+			    + strlen(path) + 100);
+			for (i = 1; i <= 15; i++)  {
+				tca[0] = '\0';
+				if (       i == 1) {
+				    sprintf(tca, "%s/%s", cdir, path); 
+				} else if (i == 2 && mode > 0) {
+				    sprintf(tca, "%s/%s.crt", cdir, path); 
+				} else if (i == 3) {
+				    sprintf(tca, "%s/%s.pem", cdir, path); 
+				} else if (i == 4 && mode > 1) {
+				    sprintf(tca, "%s/%s.req", cdir, path); 
+				} else if (i == 5 && mode > 1) {
+				    sprintf(tca, "%s/%s.key", cdir, path); 
+				} else if (i == 6) {
+				    sprintf(tca, "%s/clients/%s", cdir, path); 
+				} else if (i == 7 && mode > 0) {
+				    sprintf(tca, "%s/clients/%s.crt", cdir, path); 
+				} else if (i == 8) {
+				    sprintf(tca, "%s/clients/%s.pem", cdir, path); 
+				} else if (i == 9 && mode > 1) {
+				    sprintf(tca, "%s/clients/%s.req", cdir, path); 
+				} else if (i == 10 && mode > 1) {
+				    sprintf(tca, "%s/clients/%s.key", cdir, path); 
+				} else if (i == 11) {
+				    sprintf(tca, "%s/server-%s", cdir, path); 
+				} else if (i == 12 && mode > 0) {
+				    sprintf(tca, "%s/server-%s.crt", cdir, path); 
+				} else if (i == 13) {
+				    sprintf(tca, "%s/server-%s.pem", cdir, path); 
+				} else if (i == 14 && mode > 1) {
+				    sprintf(tca, "%s/server-%s.req", cdir, path); 
+				} else if (i == 15 && mode > 1) {
+				    sprintf(tca, "%s/server-%s.key", cdir, path); 
+				}
+				if (tca[0] == '\0') {
+					continue;
+				}
+				if (stat(tca, &sbuf) == 0) {
+					path = tca;
+					break;
+				}
+			}
+		}
+	}
+
+	if (stat(path, &sbuf) != 0) {
+		rfbLog("sslEncKey: %s\n", path);
+		rfbLogPerror("stat");
+		exit(1);
+	}
+
+	if (! info_only) {
+		cert = (char *) malloc(2*sbuf.st_size);
+		file = fopen(path, "r");
+		if (file == NULL) {
+			rfbLog("sslEncKey: %s\n", path);
+			rfbLogPerror("fopen");
+			exit(1);
+		}
+		incert = 0;
+		cert[0] = '\0';
+		while (fgets(line, 1024, file) != NULL) {
+			if (strstr(line, "-----BEGIN CERTIFICATE-----") == line) {
+				incert = 1;
+			}
+			if (incert) {
+				strcat(cert, line);
+			}
+			if (strstr(line, "-----END CERTIFICATE-----") == line) {
+				incert = 0;
+			}
+		}
+		fclose(file);
+	}
+
+	tmp_fd = mkstemp(tmp);
+	if (tmp_fd < 0) {
+		exit(1);
+	}
+
+	write(tmp_fd, genCert, strlen(genCert));
+	close(tmp_fd);
+
+        scr = (char *) malloc(strlen(tmp) + 100);
+	sprintf(scr, "/bin/sh %s", tmp);
+
+	set_env("BASE_DIR", "/no/such/dir");
+	set_env("OPENSSL", openssl);
+	set_env("TYPE", "server");
+	if (info_only) {
+		set_env("INFO_ONLY", path);
+	} else if (delete_only) {
+		set_env("DELETE_ONLY", path);
+	} else {
+		set_env("ENCRYPT_ONLY", path);
+	}
+	system(scr);
+	unlink(tmp);
+
+	if (! mode && cert && cert[0] != '\0') {
+		file = fopen(path, "a");
+		if (file == NULL) {
+			rfbLog("sslEncKey: %s\n", path);
+			rfbLogPerror("fopen");
+			exit(1);
+		}
+		fprintf(file, cert);
+		fclose(file);
+		free(cert);
+	}
+
+	depth--;
+}
+
diff --git a/x11vnc/sslcmds.h b/x11vnc/sslcmds.h
index e75af7c..4573ef0 100644
--- a/x11vnc/sslcmds.h
+++ b/x11vnc/sslcmds.h
@@ -7,6 +7,10 @@ extern void check_stunnel(void);
 extern int start_stunnel(int stunnel_port, int x11vnc_port);
 extern void stop_stunnel(void);
 extern void setup_stunnel(int rport, int *argc, char **argv);
+extern char *get_Cert_dir(char *cdir_in, char **tmp_in);
+extern void sslGenCA(char *cdir);
+extern void sslGenCert(char *ty, char *nm);
+extern void sslEncKey(char *path, int info_only);
 
 
 #endif /* _X11VNC_SSLCMDS_H */
diff --git a/x11vnc/sslhelper.c b/x11vnc/sslhelper.c
index 53249db..cc84f3c 100644
--- a/x11vnc/sslhelper.c
+++ b/x11vnc/sslhelper.c
@@ -6,6 +6,7 @@
 #include "screen.h"
 #include "scan.h"
 #include "connections.h"
+#include "sslcmds.h"
 
 #define OPENSSL_INETD 1
 #define OPENSSL_VNC   2
@@ -24,16 +25,21 @@ pid_t openssl_last_helper_pid = 0;
 
 #if !LIBVNCSERVER_HAVE_LIBSSL
 int openssl_present(void) {return 0;}
-void openssl_init(void) {
-	rfbLog("not compiled with libssl support.\n");
+static void badnews(void) {
+	use_openssl = 0;
+	use_stunnel = 0;
+	rfbLog("** not compiled with libssl OpenSSL support **\n");
 	clean_up_exit(1);
 }
-void openssl_port(void) {}
-void https_port(void) {}
-void check_openssl(void) {}
-void check_https(void) {}
-void ssl_helper_pid(pid_t pid, int sock) {sock = pid;}
-void accept_openssl(int mode) {mode = 0; clean_up_exit(1);}
+void openssl_init(void) {badnews();}
+void openssl_port(void) {badnews();}
+void https_port(void) {badnews();}
+void check_openssl(void) {badnews();}
+void check_https(void) {badnews();}
+void ssl_helper_pid(pid_t pid, int sock) {badnews(); sock = pid;}
+void accept_openssl(int mode) {mode = 0; badnews();}
+char *find_openssl_bin(void) {badnews(); return NULL;}
+char *get_saved_pem(char *string, int create) {badnews(); return NULL;}
 #else
 
 #include <openssl/ssl.h>
@@ -47,6 +53,8 @@ void check_openssl(void);
 void check_https(void);
 void ssl_helper_pid(pid_t pid, int sock);
 void accept_openssl(int mode);
+char *find_openssl_bin(void);
+char *get_saved_pem(char *string, int create);
 
 static SSL_CTX *ctx = NULL;
 static RSA *rsa_512 = NULL;
@@ -56,8 +64,9 @@ static SSL *ssl = NULL;
 
 static void init_prng(void);
 static void sslerrexit(void);
-static char *create_tmp_pem(void);
+static char *create_tmp_pem(char *path, int prompt);
 static int  ssl_init(int s_in, int s_out);
+static void raw_xfer(int csock, int s_in, int s_out);
 static void ssl_xfer(int csock, int s_in, int s_out, int is_https);
 
 #ifndef FORK_OK
@@ -81,47 +90,169 @@ static void sslerrexit(void) {
 	clean_up_exit(1);
 }
 
+char *get_saved_pem(char *save, int create) {
+	char *s = NULL, *path, *cdir, *tmp;
+	int prompt = 0, len;
+	struct stat sbuf;
+
+	if (strstr(save, "SAVE_PROMPT") == save) {
+		prompt = 1;
+		s = save + strlen("SAVE_PROMPT");
+	} else if (strstr(save, "SAVE") == save) {
+		s = save + strlen("SAVE");
+	} else {
+		rfbLog("get_saved_pem: invalid save string: %s\n", save);
+		clean_up_exit(1);
+	}
+	if (strchr(s, '/')) {
+		rfbLog("get_saved_pem: invalid save string: %s\n", s);
+		clean_up_exit(1);
+	}
+
+	cdir = get_Cert_dir(NULL, &tmp);
+	if (! cdir) {
+		rfbLog("get_saved_pem: could not find Cert dir.\n");
+		clean_up_exit(1);
+	}
+	len = strlen(cdir) + strlen("/server.pem") + strlen(s) + 1;
+	path = (char *) malloc(len);
+	sprintf(path, "%s/server%s.pem", cdir, s);
+
+	if (stat(path, &sbuf) != 0) {
+		char *new = NULL;
+		if (create) {
+			new = create_tmp_pem(path, prompt);
+			sslEncKey(new, 0);
+		}
+		return new;
+	} else {
+		return strdup(path);
+	}
+}
+
+static char *get_input(char *tag, char **in) {
+	char line[1024], *str;
+	fprintf(stderr, "%s:\n     [%s] ", tag, *in);
+	if (fgets(line, 1024, stdin) == NULL) {
+		rfbLog("could not read stdin!\n");
+		rfbLogPerror("fgets");
+		clean_up_exit(1);
+	}
+	if ((str = strrchr(line, '\n')) != NULL) {
+		*str = '\0';
+	}
+	str = lblanks(line);
+	if (! strcmp(str, "")) {
+		return *in;
+	} else if (0 && !strcmp(str, "none")) {
+		free(*in);
+		return strdup("");
+	} else {
+		free(*in);
+		return strdup(line);
+	}
+}
+
+char *find_openssl_bin(void) {
+	char *path, *exe, *p;
+	struct stat sbuf;
+	int found_openssl = 0;
+	char extra[] = ":/usr/bin:/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/sfw/bin";
+	
+	if (! getenv("PATH")) {
+		fprintf(stderr, "could not find openssl(1) program in PATH.\n");
+		return NULL;
+	}
+	path = (char *) malloc(strlen(getenv("PATH")) + strlen(extra) + 1);
+	strcpy(path, getenv("PATH"));
+	strcat(path, extra);
+
+	/* find openssl binary: */
+	exe = (char *) malloc(strlen(path) + strlen("/openssl") + 1);
+	p = strtok(path, ":");
+
+	while (p) {
+		sprintf(exe, "%s/openssl", p);
+		if (stat(exe, &sbuf) == 0) {
+			if (! S_ISDIR(sbuf.st_mode)) {
+				found_openssl = 1;
+				break;
+			}
+		}
+		p = strtok(NULL, ":");
+	}
+	free(path);
+
+	if (! found_openssl) {
+		fprintf(stderr, "could not find openssl(1) program in PATH.\n");
+		fprintf(stderr, "(also checked: %s)\n", extra);
+		return NULL;
+	}
+	return exe;
+}
+
 /* uses /usr/bin/openssl to create a tmp cert */
 
-static char *create_tmp_pem(void) {
+static char *create_tmp_pem(char *pathin, int prompt) {
 	pid_t pid, pidw;
 	FILE *in, *out;
 	char cnf[] = "/tmp/x11vnc-cnf.XXXXXX";
 	char pem[] = "/tmp/x11vnc-pem.XXXXXX";
-	char str[4096], line[1024], *path, *p, *exe;
-	int found_openssl = 0, cnf_fd, pem_fd, status, show_cert = 1;
-	struct stat sbuf;
+	char str[7*1024], line[1024], *exe;
+	int cnf_fd, pem_fd, status, show_cert = 1;
+	char *days;
+	char *C, *L, *OU, *O, *CN, *EM;
 	char tmpl[] = 
 "[ req ]\n"
 "prompt = no\n"
-"default_bits = 1024\n"
+"default_bits = 2048\n"
 "encrypt_key = yes\n"
 "distinguished_name = req_dn\n"
 "x509_extensions = cert_type\n"
 "\n"
 "[ req_dn ]\n"
-"countryName=AU\n"
+"countryName=%s\n"
 "localityName=%s\n"
-"organizationalUnitName=%s-%f\n"
-"organizationName=x11vnc\n"
-"commonName=x11vnc-SELF-SIGNED-TEMPORARY-CERT-%d\n"
-"emailAddress=nobody@x11vnc.server\n"
+"organizationalUnitName=%s\n"
+"organizationName=%s\n"
+"commonName=%s\n"
+"emailAddress=%s\n"
 "\n"
 "[ cert_type ]\n"
 "nsCertType = server\n"
 ;
 
+	C = strdup("AU");
+	L = strdup(UT.sysname);
+	snprintf(line, 1024, "%s-%f", UT.nodename, dnow());
+	line[1024-1] = '\0';
+	OU = strdup(line);
+	O = strdup("x11vnc");
+	if (pathin) {
+		snprintf(line, 1024, "x11vnc-SELF-SIGNED-CERT-%d", getpid());
+	} else {
+		snprintf(line, 1024, "x11vnc-SELF-SIGNED-TEMPORARY-CERT-%d", getpid());
+	}
+	line[1024-1] = '\0';
+	CN = strdup(line);
+	EM = strdup("x11vnc@server.nowhere");
+
 	if (no_external_cmds) {
 		rfbLog("create_tmp_pem: cannot run external commands.\n");	
 		return NULL;
 	}
 	rfbLog("\n");	
-	rfbLog("Creating a temporary, self-signed PEM certificate...\n");	
+	if (pathin) {
+		rfbLog("Creating a self-signed PEM certificate...\n");	
+	} else {
+		rfbLog("Creating a temporary, self-signed PEM certificate...\n");	
+	}
 	rfbLog("\n");	
 	rfbLog("This will NOT prevent man-in-the-middle attacks UNLESS you\n");	
 	rfbLog("get the certificate information to the VNC viewers SSL\n");	
-	rfbLog("tunnel configuration. However, it will prevent passive\n");	
-	rfbLog("network sniffing.\n");	
+	rfbLog("tunnel configuration or you take the extra steps to sign it\n");
+	rfbLog("with a CA key. However, it will prevent passive network\n");
+	rfbLog("sniffing.\n");	
 	rfbLog("\n");	
 	rfbLog("The cert inside -----BEGIN CERTIFICATE-----\n");	
 	rfbLog("                           ....\n");	
@@ -132,31 +263,27 @@ static char *create_tmp_pem(void) {
 	rfbLog("server certificate.\n");	
 	rfbLog("\n");	
 
-	if (! getenv("PATH")) {
-		return NULL;
-	}
-	path = strdup(getenv("PATH"));
-
-	/* find openssl binary: */
-	exe = (char *) malloc(strlen(path) + strlen("/openssl") + 1);
-	p = strtok(path, ":");
 
-	while (p) {
-		sprintf(exe, "%s/openssl", p);
-		if (stat(exe, &sbuf) == 0) {
-			if (! S_ISDIR(sbuf.st_mode)) {
-				found_openssl = 1;
-				break;
-			}
-		}
-		p = strtok(NULL, ":");
-	}
-	free(path);
-
-	if (! found_openssl) {
+	exe = find_openssl_bin();
+	if (exe == NULL) {
 		return NULL;
 	}
 
+	/* create template file with our made up stuff: */
+	if (prompt) {
+		fprintf(stderr, "\nReply to the following prompts to set"
+		    " your Certificate parameters.\n");
+		fprintf(stderr, "(press Enter to accept the default in [...], "
+		    "or type in the value you want)\n\n");
+		C = get_input("CountryName", &C);
+		L = get_input("LocalityName", &L);
+		OU = get_input("OrganizationalUnitName", &OU);
+		O = get_input("OrganizationalName", &O);
+		CN = get_input("CommonName", &CN);
+		EM = get_input("EmailAddress", &EM);
+	}
+	sprintf(str, tmpl, C, L, OU, O, CN, EM);
+
 	cnf_fd = mkstemp(cnf);
 	pem_fd = mkstemp(pem);
 
@@ -166,11 +293,15 @@ static char *create_tmp_pem(void) {
 
 	close(pem_fd);
 
-	/* create template file with our made up stuff: */
-	sprintf(str, tmpl, UT.sysname, UT.nodename, dnow(), (int) getpid());
 	write(cnf_fd, str, strlen(str));
 	close(cnf_fd);
 
+	if (pathin) {
+		days = "365";
+	} else {
+		days = "30";
+	}
+
 	/* make RSA key */
 	pid = fork();
 	if (pid < 0) {
@@ -181,7 +312,8 @@ static char *create_tmp_pem(void) {
 			close(i);
 		}
 		execlp(exe, exe, "req", "-new", "-x509", "-nodes",
-		    "-config", cnf, "-out", pem, "-keyout", pem, (char *)0);
+		    "-days", days, "-config", cnf, "-out", pem,
+		    "-keyout", pem, (char *)0);
 		exit(1);
 	}
 	pidw = waitpid(pid, &status, 0); 
@@ -194,6 +326,7 @@ static char *create_tmp_pem(void) {
 		return NULL;
 	}
 
+#if DO_DH
 	/* make DH parameters */
 	pid = fork();
 	if (pid < 0) {
@@ -203,6 +336,7 @@ static char *create_tmp_pem(void) {
 		for (i=0; i<256; i++) {
 			close(i);
 		}
+		/* rather slow at 1024 */
 		execlp(exe, exe, "dhparam", "-out", cnf, "512", (char *)0);
 		exit(1);
 	}
@@ -231,10 +365,67 @@ static char *create_tmp_pem(void) {
 	}
 	fclose(in);
 	fclose(out);
+#endif
 
 	unlink(cnf);
 	free(exe);
 
+	if (pathin != NULL) {
+		char *q, *pathcrt = strdup(pathin);
+		FILE *crt = NULL;
+		int on = 0;
+
+		q = strrchr(pathcrt, '/');
+		if (q) {
+			q = strstr(q, ".pem");
+			if (q) {
+				*(q+1) = 'c';
+				*(q+2) = 'r';
+				*(q+3) = 't';
+				crt = fopen(pathcrt, "w");
+			}
+		}
+		if (crt == NULL) {
+			rfbLog("could not open: %s\n", pathcrt);
+			rfbLogPerror("fopen");
+			return NULL;
+		}
+		out = fopen(pathin, "w");
+		if (out == NULL) {
+			rfbLog("could not open: %s\n", pathin);
+			rfbLogPerror("fopen");
+			fclose(crt);
+			return NULL;
+		}
+		chmod(pathin,  0600);
+
+		in = fopen(pem, "r");
+		if (in == NULL) {
+			rfbLog("could not open: %s\n", pem);
+			rfbLogPerror("fopen");
+			fclose(out);
+			fclose(crt);
+			unlink(pathin);
+			unlink(pathcrt);
+			return NULL;
+		}
+		while (fgets(line, 1024, in) != NULL) {
+			if (strstr(line, "-----BEGIN CERTIFICATE-----")) {
+				on = 1;
+			}
+			fprintf(out, "%s", line);
+			if (on) {
+				fprintf(crt, "%s", line);
+			}
+			if (strstr(line, "-----END CERTIFICATE-----")) {
+				on = 0;
+			}
+		}
+		fclose(in);
+		fclose(out);
+		fclose(crt);
+	}
+
 	if (show_cert) {
 		char cmd[100];
 		if (inetd) {
@@ -247,15 +438,172 @@ static char *create_tmp_pem(void) {
 		fprintf(stderr, "\n");
 	}
 
-	return strdup(pem);
+	if (pathin) {
+		unlink(pem);
+		return strdup(pathin);
+	} else {
+		return strdup(pem);
+	}
+}
+
+static int pem_passwd_callback(char *buf, int size, int rwflag,
+    void *userdata) {
+	char *q, line[1024];
+
+	fprintf(stderr, "\nA passphrase is needed to unlock an OpenSSL "
+	    "private key (PEM file).\n");
+	fprintf(stderr, "Enter passphrase> ");
+	system("stty -echo");
+	if(fgets(line, 1024, stdin) == NULL) {
+		fprintf(stdout, "\n");
+		system("stty echo");
+		exit(1);
+	}
+	system("stty echo");
+	fprintf(stdout, "\n\n");
+	q = strrchr(line, '\n');
+	if (q) {
+		*q = '\0';
+	}
+	line[1024 - 1] = '\0';
+	strncpy(buf, line, size);                                  
+	buf[size - 1] = '\0';
+
+	if (0) rwflag = 0;	/* compiler warning. */
+	if (0) userdata = 0;	/* compiler warning. */
+
+	return strlen(buf);
+}
+
+static int appendfile(FILE *out, char *infile) {
+	char line[1024];
+	FILE *in = fopen(infile, "r");
+
+	if (in == NULL) {
+		rfbLog("appendfile: %s\n", infile);
+		rfbLogPerror("fopen");
+		return 0;
+	}
+
+	while (fgets(line, 1024, in) != NULL) {
+		fprintf(out, "%s", line);
+	}
+	fclose(in);
+	return 1;
+}
+	
+static char *get_ssl_verify_file(char *str_in) {
+	char *p, *str, *cdir, *tmp;
+	char *tfile, *tfile2;
+	FILE *file;
+	struct stat sbuf;
+	int count = 0;
+
+	if (! str_in) {
+		rfbLog("get_ssl_verify_file: no filename\n");
+		exit(1);
+	}
+
+	if (stat(str_in, &sbuf) == 0) {
+		/* assume he knows what he is doing. */
+		return str_in;
+	}
+
+	str = strdup(str_in);
+	p = strtok(str, ",");
+
+	cdir = get_Cert_dir(NULL, &tmp);
+	if (! cdir) {
+		rfbLog("get_ssl_verify_file: invalid cert-dir.\n");
+		exit(1);
+	}
+
+	tfile  = (char *) malloc(strlen(tmp) + 1024);
+	tfile2 = (char *) malloc(strlen(tmp) + 1024);
+
+	sprintf(tfile, "%s/sslverify-load-%d.crts", tmp, getpid());
+
+	file = fopen(tfile, "w");
+	if (file == NULL) {
+		rfbLog("get_ssl_verify_file: %s\n", tfile);
+		rfbLogPerror("fopen");
+		exit(1);
+	}
+	chmod(tfile, 0600);
+
+	while (p) {
+		if (!strcmp(p, "CA")) {
+			sprintf(tfile2, "%s/CA/cacert.pem", cdir);
+			if (! appendfile(file, tfile2)) {
+				unlink(tfile);
+				exit(1);
+			}
+			fprintf(stderr, "sslverify: loaded %s\n", tfile2);
+			count++;
+		} else if (!strcmp(p, "clients")) {
+			DIR *dir;
+			struct dirent *dp;
+			sprintf(tfile2, "%s/clients", cdir);
+			dir = opendir(tfile2);
+			if (! dir) {
+				rfbLog("get_ssl_verify_file: %s\n", tfile2);
+				rfbLogPerror("opendir");
+				unlink(tfile);
+				exit(1);
+			}
+			while ( (dp = readdir(dir)) != NULL) {
+				char *n = dp->d_name;
+				char *q = strstr(n, ".crt");
+				if (! q || strlen(q) != strlen(".crt")) {
+					continue;
+				}
+				sprintf(tfile2, "%s/clients/%s", cdir, n);
+				if (! appendfile(file, tfile2)) {
+					unlink(tfile);
+					exit(1);
+				}
+				fprintf(stderr, "sslverify: loaded %s\n", tfile2);
+				count++;
+			}
+			closedir(dir);
+			
+		} else {
+			if (strlen(p) > 512) {
+				unlink(tfile);
+				exit(1);
+			}
+			sprintf(tfile2, "%s/clients/%s.crt", cdir, p);
+			if (stat(tfile2, &sbuf) != 0) {
+				sprintf(tfile2, "%s/clients/%s", cdir, p);
+			}
+			if (! appendfile(file, tfile2)) {
+				unlink(tfile);
+				exit(1);
+			}
+			fprintf(stderr, "sslverify: loaded %s\n", tfile2);
+			count++;
+		}
+		p = strtok(NULL, ",");
+	}
+	fclose(file);
+	free(tfile2);
+	free(str);
+	fprintf(stderr, "sslverify: using %d client certs in %s\n", count, tfile);
+	return tfile;
 }
 
 void openssl_init(void) {
-	int db = 0, tmp_pem = 0, do_dh = 1;
+	int db = 0, tmp_pem = 0, do_dh;
 	FILE *in;
 	double ds;
 	long mode;
 
+#if DO_DH
+	do_dh = 1;
+#else
+	do_dh = 0;
+#endif
+
 	if (! quiet) {
 		rfbLog("\n");
 		rfbLog("Initializing SSL.\n");
@@ -314,17 +662,27 @@ void openssl_init(void) {
 
 	ds = dnow();
 	if (! openssl_pem) {
-		openssl_pem = create_tmp_pem();
+		openssl_pem = create_tmp_pem(NULL, 0);
 		if (! openssl_pem) {
 			rfbLog("openssl_init: could not create temporary,"
 			    " self-signed PEM.\n");	
 			clean_up_exit(1);
 		}
 		tmp_pem = 1;
+	} else if (strstr(openssl_pem, "SAVE") == openssl_pem) {
+		openssl_pem = get_saved_pem(openssl_pem, 1);
+		if (! openssl_pem) {
+			rfbLog("openssl_init: could not create or open"
+			    " saved PEM:\n", openssl_pem);	
+			clean_up_exit(1);
+		}
+		tmp_pem = 0;
 	}
 
 	rfbLog("using PEM %s  %.3fs\n", openssl_pem, dnow() - ds);
 
+	SSL_CTX_set_default_passwd_cb(ctx, pem_passwd_callback);
+
 	if (do_dh) {
 		DH *dh;
 		BIO *bio;
@@ -387,23 +745,23 @@ void openssl_init(void) {
 
 	if (ssl_verify) {
 		struct stat sbuf;
+		char *file;
 		int lvl;
-		if (stat(ssl_verify, &sbuf) != 0) {
+		file = get_ssl_verify_file(ssl_verify);
+		if (stat(file, &sbuf) != 0) {
 			rfbLog("openssl_init: -sslverify does not exists %s.\n",
-			    ssl_verify);	
+			    file);	
 			rfbLogPerror("stat");
 			clean_up_exit(1);
 		}
 		if (! S_ISDIR(sbuf.st_mode)) {
-			if (! SSL_CTX_load_verify_locations(ctx, ssl_verify,
-			    NULL)) {
+			if (! SSL_CTX_load_verify_locations(ctx, file, NULL)) {
 				rfbLog("openssl_init: SSL_CTX_load_verify_"
 				    "locations() failed.\n");	
 				sslerrexit();
 			}
 		} else {
-			if (! SSL_CTX_load_verify_locations(ctx, NULL,
-			    ssl_verify)) {
+			if (! SSL_CTX_load_verify_locations(ctx, NULL, file)) {
 				rfbLog("openssl_init: SSL_CTX_load_verify_"
 				    "locations() failed.\n");	
 				sslerrexit();
@@ -411,6 +769,10 @@ void openssl_init(void) {
 		}
 		lvl = SSL_VERIFY_FAIL_IF_NO_PEER_CERT|SSL_VERIFY_PEER;
 		SSL_CTX_set_verify(ctx, lvl, NULL);
+		if (strstr(file, "tmp/sslverify-load-")) {
+			/* temporary file */
+			unlink(file);
+		}
 	} else {
 		SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL);
 	}
@@ -511,10 +873,6 @@ static void lose_ram(void) {
 		free(snap_fb);
 		snap_fb = NULL;
 	}
-	if (raw_fb) {
-		free(raw_fb);
-		raw_fb = NULL;
-	}
 	free_tiles();
 }
 
@@ -645,6 +1003,7 @@ static int is_ssl_readable(int s_in, time_t last_https, char *last_get,
 			tv.tv_sec  = 4;
 		}
 	}
+if (1) fprintf(stderr, "tv_sec: %d - %s\n", (int) tv.tv_sec, last_get);
 
 	FD_ZERO(&rd);
 	FD_SET(s_in, &rd);
@@ -662,10 +1021,10 @@ static int is_ssl_readable(int s_in, time_t last_https, char *last_get,
 }
 
 #define BSIZE 16384
-static int watch_for_http_traffic(char **buf_a, int *n_a) {
+static int watch_for_http_traffic(char *buf_a, int *n_a) {
 	int is_http, err, n, n2;
-	char *buf = *buf_a;
-	int db = 0;
+	char *buf;
+	int db = 1;
 	/*
 	 * sniff the first couple bytes of the stream and try to see
 	 * if it is http or not.  if we read them OK, we must read the
@@ -674,6 +1033,7 @@ static int watch_for_http_traffic(char **buf_a, int *n_a) {
 	 * *buf_a is BSIZE+1 long and zeroed.
 	 */
 
+	buf = (char *) calloc(sizeof(BSIZE+1), 1);
 	*n_a = 0;
 
 	n = SSL_read(ssl, buf, 2);
@@ -681,6 +1041,7 @@ static int watch_for_http_traffic(char **buf_a, int *n_a) {
 
 	if (err != SSL_ERROR_NONE || n < 2) {
 		if (n > 0) {
+			strncpy(buf_a, buf, n);
 			*n_a = n;
 		}
 		return -1;
@@ -708,6 +1069,9 @@ static int watch_for_http_traffic(char **buf_a, int *n_a) {
 		n += n2;
 	}
 	*n_a = n;
+	if (n > 0) {
+		strncpy(buf_a, buf, n);
+	}
 	return is_http;
 }
 
@@ -720,8 +1084,91 @@ static void csock_timeout (int sig) {
 	}
 }
 
+static int wait_conn(int sock) {
+	int conn;
+	struct sockaddr_in addr;
+	socklen_t addrlen = sizeof(addr);
+
+	signal(SIGALRM, csock_timeout);
+	csock_timeout_sock = sock;
+	
+	alarm(15);
+	conn = accept(sock, (struct sockaddr *)&addr, &addrlen);
+	alarm(0);
+
+	signal(SIGALRM, SIG_DFL);
+	return conn;
+}
+
+int proxy_hack(int vncsock, int listen, int s_in, int s_out, char *cookie,
+    int mode) {
+	char reply[] = "HTTP/1.1 200 OK\r\n"
+	    "Content-Type: octet-stream\r\n"
+	    "Pragma: no-cache\r\n\r\n";
+	char reply0[] = "HTTP/1.0 200 OK\r\n"
+	    "Content-Type: octet-stream\r\n"
+	    "Content-Length: 9\r\n"
+	    "Pragma: no-cache\r\n\r\nGO_AHEAD\n";
+	int sock1, db = 0;
+
+	rfbLog("SSL: accept_openssl: detected https proxied connection"
+	    " request.\n");
+
+	SSL_write(ssl, reply0, strlen(reply0));
+	SSL_shutdown(ssl);
+	SSL_shutdown(ssl);
+	close(s_in);
+	close(s_out);
+	SSL_free(ssl);
+
+	if (mode == OPENSSL_VNC) {
+		listen = openssl_sock;
+	} else if (mode == OPENSSL_HTTPS) {
+		listen = https_sock;
+	} else {
+		return 0;
+	}
+	sock1 = wait_conn(listen);
+
+	if (csock_timeout_sock < 0 || sock1 < 0) {
+		close(sock1);
+		return 0;
+	}
+if (db) fprintf(stderr, "got applet input sock1: %d\n", sock1);
+
+	if (! ssl_init(sock1, sock1)) {
+if (db) fprintf(stderr, "ssl_init FAILED\n");
+		exit(1);
+	}
+	SSL_write(ssl, reply, strlen(reply));
+
+	{
+		char *buf;
+		int n, ptr;
+	
+		buf  = (char *) calloc((8192+1), 1);
+		n = 0;
+		ptr = 0;
+		while (ptr < 8192) {
+			n = SSL_read(ssl, buf + ptr, 8192 - ptr);
+			if (n > 0) {
+				ptr += n;
+			}
+if (db) fprintf(stderr, "buf: '%s'\n", buf);
+			if (strstr(buf, "\r\n\r\n") || strstr(buf, "\n\n")) {
+				break;
+			}
+		}
+	}
+
+	write(vncsock, cookie, strlen(cookie));
+	ssl_xfer(vncsock, sock1, sock1, 0);
+
+	return 1;
+}
+
 void accept_openssl(int mode) {
-	int sock = -1, cport, csock, vsock;	
+	int sock = -1, cport, csock, vsock, listen = -1;	
 	int status, n, i, db = 0;
 	struct sockaddr_in addr;
 	socklen_t addrlen = sizeof(addr);
@@ -751,6 +1198,7 @@ void accept_openssl(int mode) {
 
 	} else if (mode == OPENSSL_VNC && openssl_sock >= 0) {
 		sock = accept(openssl_sock, (struct sockaddr *)&addr, &addrlen);
+		listen = openssl_sock;
 		if (sock < 0)  {
 			rfbLog("SSL: accept_openssl: accept connection failed\n");
 			rfbLogPerror("accept");
@@ -759,6 +1207,7 @@ void accept_openssl(int mode) {
 
 	} else if (mode == OPENSSL_HTTPS && https_sock >= 0) {
 		sock = accept(https_sock, (struct sockaddr *)&addr, &addrlen);
+		listen = https_sock;
 		if (sock < 0)  {
 			rfbLog("SSL: accept_openssl: accept connection failed\n");
 			rfbLogPerror("accept");
@@ -834,21 +1283,25 @@ void accept_openssl(int mode) {
 		int f_out = fileno(stdout);
 
 		/* reset all handlers to default (no interrupted() calls) */
-		signal(SIGHUP,  SIG_DFL);
-		signal(SIGINT,  SIG_DFL);
-		signal(SIGQUIT, SIG_DFL);
-		signal(SIGTERM, SIG_DFL);
+		unset_signals();
 
 		/* close all non-essential fd's */
 		for (i=0; i<256; i++) {
-			if (i != sslsock && i != 2) {
-				if (mode == OPENSSL_INETD) {
-					if (i == f_in || i == f_out) {
-						continue;
-					}
+			if (mode == OPENSSL_INETD) {
+				if (i == f_in || i == f_out) {
+					continue;
 				}
-				close(i);
 			}
+			if (i == sslsock) {
+				continue;
+			}
+			if (i == 2) {
+				continue;
+			}
+			if (i == listen) {
+				continue;	
+			}
+			close(i);
 		}
 
 		/*
@@ -861,6 +1314,7 @@ void accept_openssl(int mode) {
 		/* now connect back to parent socket: */
 		vncsock = rfbConnectToTcpAddr("127.0.0.1", cport);
 		if (vncsock < 0) {
+			rfbLog("SSL: ssl_helper: could not connect back to: %d\n", cport);
 			close(vncsock);
 			exit(1);
 		}
@@ -898,11 +1352,10 @@ void accept_openssl(int mode) {
 			int n, is_http;
 			int hport = screen->httpPort; 
 			char *iface = NULL;
-			static char *buf = NULL;
+			char *buf, *tbuf;
 
-			if (buf == NULL) {
-				buf = (char *) calloc(sizeof(BSIZE+1), 1);
-			}
+			buf  = (char *) calloc((BSIZE+1), 1);
+			tbuf = (char *) calloc((2*BSIZE+1), 1);
 
 			if (mode == OPENSSL_HTTPS) {
 				/*
@@ -918,6 +1371,7 @@ void accept_openssl(int mode) {
 			 * Check if there is stuff to read from remote end
 			 * if so it is likely a GET or HEAD.
 			 */
+			if (1) fprintf(stderr, "is_ssl_readable\n");
 			if (! is_ssl_readable(s_in, last_https, last_get,
 			    mode)) {
 				goto write_cookie;
@@ -930,7 +1384,8 @@ void accept_openssl(int mode) {
 			 * is ever sent.  So often we timeout here.
 			 */
 
-			is_http = watch_for_http_traffic(&buf, &n);
+			if (1) fprintf(stderr, "watch_for_http_traffic\n");
+			is_http = watch_for_http_traffic(buf, &n);
 
 			if (is_http < 0 || is_http == 0) {
 				/*
@@ -943,7 +1398,38 @@ void accept_openssl(int mode) {
 				}
 				goto wrote_cookie;
 			}
+			if (1) fprintf(stderr, "buf: '%s'\n", buf);
+
+			if (strstr(buf, "/request.https.proxy.connection")) {
+				/*
+				 * special case proxy coming thru https
+				 * instead of a direct SSL connection.
+				 */
+				if (! proxy_hack(vncsock, listen, s_in, s_out,
+				    cookie, mode)) {
+					strcpy(tbuf, uniq);
+					strcat(tbuf, cookie);
+					write(vncsock, tbuf, strlen(tbuf));
+					close(vncsock);
+				}
+				exit(0);
+
+			} else if (strstr(buf, "/check.https.proxy.connection")) {
+				char reply[] = "HTTP/1.0 200 OK\r\n"
+				    "Connection: close\r\n"
+				    "Content-Type: octet-stream\r\n"
+				    "Pragma: no-cache\r\n\r\n";
+
+				SSL_write(ssl, reply, strlen(reply));
+				SSL_shutdown(ssl);
 
+				strcpy(tbuf, uniq);
+				strcat(tbuf, cookie);
+				write(vncsock, tbuf, strlen(tbuf));
+				close(vncsock);
+
+				exit(0);
+			}
 			connect_to_httpd:
 
 			/*
@@ -953,18 +1439,19 @@ void accept_openssl(int mode) {
 			 */
 
 			/* send the failure tag: */
-			write(vncsock, uniq, strlen(uniq));
+			strcpy(tbuf, uniq);
 
 			if (strstr(buf, "HTTP/") != NULL)  {
+				char *q, *str;
 				/*
 				 * Also send back the GET line for heuristics.
 				 * (last_https, get file).
 				 */
-				char *q, *str = strdup(buf);
+				str = strdup(buf);
 				q = strstr(str, "HTTP/");
 				if (q != NULL) {
 					*q = '\0';	
-					write(vncsock, str, strlen(str));
+					strcat(tbuf, str);
 				}
 				free(str);
 			}
@@ -975,11 +1462,13 @@ void accept_openssl(int mode) {
 			 * Since this is the failure case, it does not
 			 * matter that we send more than strlen(cookie).
 			 */
-			write(vncsock, cookie, strlen(cookie));
+			strcat(tbuf, cookie);
+			write(vncsock, tbuf, strlen(tbuf));
+
 			usleep(150*1000);
+if (db) fprintf(stderr, "close vncsock: %d\n", vncsock);
 			close(vncsock);
 
-
 			/* now, finally, connect to the libvncserver httpd: */
 			if (screen->listenInterface == htonl(INADDR_ANY) ||
 			    screen->listenInterface == htonl(INADDR_NONE)) {
@@ -992,6 +1481,7 @@ void accept_openssl(int mode) {
 			if (iface == NULL || !strcmp(iface, "")) {
 				iface = "127.0.0.1";
 			}
+if (db) fprintf(stderr, "iface: %s\n", iface);
 			usleep(150*1000);
 
 			httpsock = rfbConnectToTcpAddr(iface, hport);
@@ -1069,7 +1559,7 @@ void accept_openssl(int mode) {
 
 		if (strstr(rcookie, uniq) == rcookie) {
 			int i;
-			rfbLog("SSL: https for helper process succeeded.\n");
+			rfbLog("SSL: but https for helper process succeeded.\n");
 			if (mode != OPENSSL_HTTPS) {
 				last_https = time(0);
 				for (i=0; i<128; i++) {
@@ -1081,6 +1571,7 @@ void accept_openssl(int mode) {
 			ssl_helper_pid(pid, -2);
 
 			if (mode == OPENSSL_INETD) {
+				double start;
 				/* to expand $PORT correctly in index.vnc */
 				if (screen->port == 0) {
 					int fd = fileno(stdin);
@@ -1097,7 +1588,7 @@ void accept_openssl(int mode) {
 				rfbLog("SSL: screen->port %d\n", screen->port);
 
 				/* kludge for https fetch via inetd */
-				double start = dnow();
+				start = dnow();
 				while (dnow() < start + 10.0) {
 					rfbPE(10000);
 					usleep(10000);
@@ -1127,6 +1618,7 @@ void accept_openssl(int mode) {
 
 	openssl_last_helper_pid = pid;
 	ssl_helper_pid(pid, vsock);
+
 	client = rfbNewClient(screen, vsock);
 	openssl_last_helper_pid = 0;
 
@@ -1159,17 +1651,19 @@ static void ssl_timeout (int sig) {
 static int ssl_init(int s_in, int s_out) {
 	unsigned char *sid = (unsigned char *) "x11vnc SID";
 	char *name;
-	int db = 0, rc, err;
+	int db = 1, rc, err;
 	int ssock = s_in;
 	double start = dnow();
 	int timeout = 20;
 
 	if (db) fprintf(stderr, "ssl_init: %d/%d\n", s_in, s_out);
+
 	ssl = SSL_new(ctx);
 	if (ssl == NULL) {
 		fprintf(stderr, "SSL_new failed\n");
 		return 0;
 	}
+if (db > 1) fprintf(stderr, "a\n");
 
 	SSL_set_session_id_context(ssl, sid, strlen((char *)sid));
 
@@ -1188,10 +1682,13 @@ static int ssl_init(int s_in, int s_out) {
 			return 0;
 		}
 	}
+if (db > 1) fprintf(stderr, "b\n");
 
 	SSL_set_accept_state(ssl);
+if (db > 1) fprintf(stderr, "c\n");
 
 	name = get_remote_host(ssock);
+if (db > 1) fprintf(stderr, "d\n");
 
 	while (1) {
 		if (db) fprintf(stderr, "calling SSL_accept...\n");
@@ -1258,9 +1755,9 @@ static int ssl_init(int s_in, int s_out) {
 	return 1;
 }
 
-static void ssl_xfer_debug(int csock, int s_in, int s_out) {
-	char buf[2048];
-	int sz = 2048, n, m, status;
+static void raw_xfer(int csock, int s_in, int s_out) {
+	char buf[8192];
+	int sz = 8192, n, m, status;
 	pid_t pid = fork();
 	int db = 1;
 
@@ -1269,7 +1766,7 @@ static void ssl_xfer_debug(int csock, int s_in, int s_out) {
 		exit(1);
 	}
 	if (pid) {
-		if (db) fprintf(stderr, "ssl_xfer start: %d -> %d/%d\n", csock, s_in, s_out);
+		if (db) fprintf(stderr, "raw_xfer start: %d -> %d/%d\n", csock, s_in, s_out);
 
 		while (1) {
 			n = read(csock, buf, sz);
@@ -1277,8 +1774,9 @@ static void ssl_xfer_debug(int csock, int s_in, int s_out) {
 				break;
 			} else if (n > 0) {
 				m = write(s_out, buf, n);
+if (db > 1) write(2, buf, n);
 				if (m != n) {
-		if (db) fprintf(stderr, "ssl_xfer bad write:  %d -> %d | %d/%d\n", csock, s_out, m, n);
+		if (db) fprintf(stderr, "raw_xfer bad write:  %d -> %d | %d/%d\n", csock, s_out, m, n);
 					break;
 				}
 			
@@ -1286,10 +1784,10 @@ static void ssl_xfer_debug(int csock, int s_in, int s_out) {
 		}
 		kill(pid, SIGTERM);
 		waitpid(pid, &status, WNOHANG); 
-		if (db) fprintf(stderr, "ssl_xfer done:  %d -> %d\n", csock, s_out);
+		if (db) fprintf(stderr, "raw_xfer done:  %d -> %d\n", csock, s_out);
 
 	} else {
-		if (db) fprintf(stderr, "ssl_xfer start: %d <- %d\n", csock, s_in);
+		if (db) fprintf(stderr, "raw_xfer start: %d <- %d\n", csock, s_in);
 
 		while (1) {
 			n = read(s_in, buf, sz);
@@ -1297,19 +1795,19 @@ static void ssl_xfer_debug(int csock, int s_in, int s_out) {
 				break;
 			} else if (n > 0) {
 				m = write(csock, buf, n);
+if (db > 1) write(2, buf, n);
 				if (m != n) {
-		if (db) fprintf(stderr, "ssl_xfer bad write:  %d <- %d | %d/%d\n", csock, s_in, m, n);
+		if (db) fprintf(stderr, "raw_xfer bad write:  %d <- %d | %d/%d\n", csock, s_in, m, n);
 					break;
 				}
 			}
 		}
-		if (db) fprintf(stderr, "ssl_xfer done:  %d <- %d\n", csock, s_in);
+		if (db) fprintf(stderr, "raw_xfer done:  %d <- %d\n", csock, s_in);
 
 	}
 	close(csock);
 	close(s_in);
 	close(s_out);
-	exit(0);
 }
 
 static void ssl_xfer(int csock, int s_in, int s_out, int is_https) {
@@ -1321,16 +1819,18 @@ static void ssl_xfer(int csock, int s_in, int s_out, int is_https) {
 	int ssock;
 
 	if (dbxfer) {
-		ssl_xfer_debug(csock, s_in, s_out);
+		raw_xfer(csock, s_in, s_out);
 		return;
 	}
 
+if (db) fprintf(stderr, "ssl_xfer begin\n");
+
 	/*
 	 * csock: clear text socket with libvncserver.    "C"
 	 * ssock: ssl data socket with remote vnc viewer. "S"
 	 *
-	 * to cover inetd mode, we have s_in and s_out, but in non-ssl mode they
-	 * both ssock.
+	 * to cover inetd mode, we have s_in and s_out, but in non-inetd
+	 * mode they both ssock.
 	 *
 	 * cbuf[] is data from csock that we have read but not passed on to ssl 
 	 * sbuf[] is data from ssl that we have read but not passed on to csock 
@@ -1428,9 +1928,9 @@ static void ssl_xfer(int csock, int s_in, int s_out, int is_https) {
 		}
 
 		if (is_https) {
-			tv.tv_sec  = 45;
+			tv.tv_sec  = 50;
 		} else {
-			tv.tv_sec  = 20;
+			tv.tv_sec  = 35;
 		}
 		tv.tv_usec = 0;
 
diff --git a/x11vnc/sslhelper.h b/x11vnc/sslhelper.h
index f8561ad..7aa7db0 100644
--- a/x11vnc/sslhelper.h
+++ b/x11vnc/sslhelper.h
@@ -8,6 +8,8 @@
 #define OPENSSL_VNC   2
 #define OPENSSL_HTTPS 3
 
+#define DO_DH 0
+
 extern int openssl_sock;
 extern int openssl_port_num;
 extern int https_sock;
@@ -21,6 +23,8 @@ extern void check_openssl(void);
 extern void check_https(void);
 extern void ssl_helper_pid(pid_t pid, int sock);
 extern void accept_openssl(int mode);
+extern char *find_openssl_bin(void);
+extern char *get_saved_pem(char *string, int create);
 
 
 #endif /* _X11VNC_SSLHELPER_H */
diff --git a/x11vnc/ssltools.h b/x11vnc/ssltools.h
new file mode 100644
index 0000000..42f68eb
--- /dev/null
+++ b/x11vnc/ssltools.h
@@ -0,0 +1,674 @@
+#ifndef _SSLTOOLS_H
+#define _SSLTOOLS_H
+
+/* quoted scripts, edit source not this file. */
+
+
+char genCA[] = 
+"#!/bin/sh\n"
+"\n"
+"DIR=$BASE_DIR\n"
+"if [ \"x$DIR\" = \"x\" ]; then\n"
+"	DIR=\"$HOME/dotkjr_vnc/certs\"\n"
+"	rm -rf \"$DIR\"\n"
+"fi\n"
+"if echo \"$DIR\" | grep '^/' > /dev/null; then\n"
+"        :\n"
+"else\n"
+"        DIR=\"`pwd`/$DIR\"\n"
+"fi\n"
+"\n"
+"PATH=/usr/bin:/bin:/usr/sbin:$PATH; export PATH\n"
+"if [ \"x$OPENSSL\" = \"x\" ]; then\n"
+"	OPENSSL=\"openssl\"\n"
+"fi\n"
+"\n"
+"type \"$OPENSSL\" > /dev/null	|| exit 1\n"
+"\n"
+"if [ -f \"$DIR/CA/cacert.pem\" ]; then\n"
+"	echo \"Files will be overwritten in $DIR/CA\"\n"
+"	printf \"Continue? [y]/n \"\n"
+"	read x\n"
+"	if [ \"x$x\" = \"xn\" ]; then\n"
+"		exit 1;\n"
+"	fi\n"
+"fi\n"
+"\n"
+"#mkdir -p \"$DIR/HASH\"		|| exit 1\n"
+"mkdir -p \"$DIR/clients\"		|| exit 1\n"
+"#mkdir -p \"$DIR/clients/HASH\"	|| exit 1\n"
+"mkdir -p \"$DIR/CA/certs\"	|| exit 1\n"
+"mkdir -p \"$DIR/CA/crl\"		|| exit 1\n"
+"mkdir -p \"$DIR/CA/newcerts\"	|| exit 1\n"
+"mkdir -p \"$DIR/CA/private\"	|| exit 1\n"
+"chmod go-rwx \"$DIR/CA/private\"	|| exit 1\n"
+"mkdir -p \"$DIR/tmp\"		|| exit 1\n"
+"chmod go-rwx \"$DIR/tmp\"		|| exit 1\n"
+"touch \"$DIR/CA/index.txt\"	|| exit 1\n"
+"if [ ! -f \"$DIR/CA/serial\" ]; then\n"
+"	echo \"01\" > \"$DIR/CA/serial\"	|| exit 1\n"
+"fi\n"
+"\n"
+"cnf='\n"
+"HOME			= .\n"
+"RANDFILE		= $ENV::HOME/.rnd\n"
+"\n"
+"####################################################################\n"
+"[ ca ]\n"
+"default_ca	= CA_default		# The default ca section\n"
+"\n"
+"####################################################################\n"
+"[ CA_default ]\n"
+"\n"
+"dir		= ./CA			# Where everything is kept\n"
+"certs		= $dir/certs		# Where the issued certs are kept\n"
+"crl_dir		= $dir/crl		# Where the issued crl are kept\n"
+"database	= $dir/index.txt	# database index file.\n"
+"new_certs_dir	= $dir/newcerts		# default place for new certs.\n"
+"certificate	= $dir/cacert.pem 	# The CA certificate\n"
+"serial		= $dir/serial 		# The current serial number\n"
+"crl		= $dir/crl.pem 		# The current CRL\n"
+"private_key	= $dir/private/cakey.pem # The private key\n"
+"RANDFILE	= $dir/private/.rand	# private random number file\n"
+"\n"
+"x509_extensions	= usr_cert		# The extentions to add to the cert\n"
+"\n"
+"name_opt 	= ca_default		# Subject Name options\n"
+"cert_opt 	= ca_default		# Certificate field options\n"
+"\n"
+"default_days	= 365			# how long to certify for\n"
+"default_crl_days= 30			# how long before next CRL\n"
+"default_md	= md5			# which md to use.\n"
+"preserve	= no			# keep passed DN ordering\n"
+"\n"
+"policy		= policy_match\n"
+"\n"
+"# For the CA policy\n"
+"[ policy_match ]\n"
+"countryName		= match\n"
+"stateOrProvinceName	= match\n"
+"organizationName	= match\n"
+"organizationalUnitName	= optional\n"
+"commonName		= supplied\n"
+"emailAddress		= optional\n"
+"\n"
+"[ policy_anything ]\n"
+"countryName		= optional\n"
+"stateOrProvinceName	= optional\n"
+"localityName		= optional\n"
+"organizationName	= optional\n"
+"organizationalUnitName	= optional\n"
+"commonName		= supplied\n"
+"emailAddress		= optional\n"
+"\n"
+"####################################################################\n"
+"[ req ]\n"
+"default_bits		= 2048\n"
+"default_keyfile 	= privkey.pem\n"
+"distinguished_name	= req_distinguished_name\n"
+"attributes		= req_attributes\n"
+"x509_extensions	= v3_ca	# The extentions to add to the self signed cert\n"
+"\n"
+"string_mask = nombstr\n"
+"\n"
+"# req_extensions = v3_req # The extensions to add to a certificate request\n"
+"\n"
+"[ req_distinguished_name ]\n"
+"countryName			= Country Name (2 letter code)\n"
+"countryName_default		= AU\n"
+"countryName_min			= 2\n"
+"countryName_max			= 2\n"
+"\n"
+"stateOrProvinceName		= State or Province Name (full name)\n"
+"stateOrProvinceName_default	= mystate\n"
+"\n"
+"localityName			= Locality Name (eg, city)\n"
+"\n"
+"0.organizationName		= Organization Name (eg, company)\n"
+"0.organizationName_default	= x11vnc server CA\n"
+"\n"
+"organizationalUnitName		= Organizational Unit Name (eg, section)\n"
+"\n"
+"commonName			= Common Name (eg, YOUR name)\n"
+"commonName_default		= %USER x11vnc server CA\n"
+"commonName_max			= 64\n"
+"\n"
+"emailAddress			= Email Address\n"
+"emailAddress_default		= x11vnc@CA.nowhere\n"
+"emailAddress_max		= 64\n"
+"\n"
+"[ req_attributes ]\n"
+"challengePassword		= A challenge password\n"
+"challengePassword_min		= 4\n"
+"challengePassword_max		= 20\n"
+"\n"
+"unstructuredName		= An optional company name\n"
+"\n"
+"[ usr_cert ]\n"
+"\n"
+"basicConstraints=CA:FALSE\n"
+"\n"
+"nsComment			= \"OpenSSL Generated Certificate\"\n"
+"\n"
+"subjectKeyIdentifier=hash\n"
+"authorityKeyIdentifier=keyid,issuer:always\n"
+"\n"
+"[ v3_req ]\n"
+"\n"
+"basicConstraints = CA:FALSE\n"
+"keyUsage = nonRepudiation, digitalSignature, keyEncipherment\n"
+"\n"
+"[ v3_ca ]\n"
+"\n"
+"subjectKeyIdentifier=hash\n"
+"\n"
+"authorityKeyIdentifier=keyid:always,issuer:always\n"
+"\n"
+"basicConstraints = CA:true\n"
+"\n"
+"[ crl_ext ]\n"
+"\n"
+"authorityKeyIdentifier=keyid:always,issuer:always\n"
+"\n"
+"'\n"
+"selfcnf='\n"
+"####################################################################\n"
+"[ req ]\n"
+"default_bits		= 2048\n"
+"encrypt_key		= yes\n"
+"distinguished_name	= req_distinguished_name\n"
+"x509_extensions		= cert_type\n"
+"\n"
+"[ req_distinguished_name ]\n"
+"countryName			= Country Name (2 letter code)\n"
+"countryName_default		= AU\n"
+"countryName_min			= 2\n"
+"countryName_max			= 2\n"
+"\n"
+"stateOrProvinceName		= State or Province Name (full name)\n"
+"stateOrProvinceName_default	= mystate\n"
+"\n"
+"localityName			= Locality Name (eg, city)\n"
+"\n"
+"0.organizationName		= Organization Name (eg, company)\n"
+"0.organizationName_default	= x11vnc server self-signed\n"
+"\n"
+"organizationalUnitName		= Organizational Unit Name (eg, section)\n"
+"\n"
+"commonName			= Common Name (eg, YOUR name)\n"
+"commonName_default		= x11vnc server self-signed %NAME\n"
+"commonName_max			= 64\n"
+"\n"
+"emailAddress			= Email Address\n"
+"emailAddress_default		= x11vnc@self-signed.nowhere\n"
+"emailAddress_max		= 64\n"
+"\n"
+"[ cert_type ]\n"
+"nsCertType = server\n"
+"\n"
+"'\n"
+"echo \"$cnf\" | sed -e \"s/%USER/$USER/\" \\\n"
+"	> \"$DIR/CA/ssl.cnf\" || exit 1\n"
+"echo \"$cnf\" | sed -e \"s/%USER *//\" -e 's/server CA/server %NAME/g' -e 's/@CA/@server/' \\\n"
+"	> \"$DIR/CA/ssl.cnf.server\" || exit 1\n"
+"echo \"$cnf\" | sed -e \"s/%USER *//\" -e 's/server CA/client %NAME/g' -e 's/@CA/@client/' \\\n"
+"	> \"$DIR/CA/ssl.cnf.client\" || exit 1\n"
+"\n"
+"echo \"$selfcnf\" > \"$DIR/CA/self.cnf.server\" || exit 1\n"
+"echo \"$selfcnf\" | sed -e 's/ server/ client/g' \\\n"
+"	> \"$DIR/CA/self.cnf.client\" || exit 1\n"
+"\n"
+"cd \"$DIR\"	|| exit 1\n"
+"\n"
+"echo \"\"\n"
+"echo \"----------------------------------------------------------------------\"\n"
+"echo \"Generating your x11vnc CA (certificate authority) key and certificate:\"\n"
+"echo \"\"\n"
+"echo \"Please supply a passphrase and any other information you care to.\"\n"
+"echo \"----------------------------------------------------------------------\"\n"
+"echo \"\"\n"
+"\n"
+"\"$OPENSSL\" req -config \"$DIR/CA/ssl.cnf\" -new -x509 \\\n"
+"	-keyout \"$DIR/CA/private/cakey.pem\" \\\n"
+"	-out \"$DIR/CA/cacert.pem\"\n"
+"\n"
+"chmod go-rwx \"$DIR/CA/private/cakey.pem\"\n"
+"\n"
+"if [ $? != 0 ]; then\n"
+"	echo \"openssl failed.\"\n"
+"	exit 1\n"
+"fi\n"
+"\n"
+"echo \"\"\n"
+"echo \"----------------------------------------------------------------------\"\n"
+"echo \"Your public x11vnc CA cert is:\"\n"
+"echo \"\"\n"
+"echo \"        $DIR/CA/cacert.pem\"\n"
+"echo \"\"\n"
+"echo \"   It may be copied to other applications, e.g. Web browser, Java\"\n"
+"echo \"   Applet keystore, or stunnel cfg, to use to verify signed server\"\n"
+"echo \"   or client certs, etc.\"\n"
+"echo \"\"\n"
+"echo \"Your private x11vnc CA key is:\"\n"
+"echo \"\"\n"
+"echo \"        $DIR/CA/private/cakey.pem\"\n"
+"echo \"\"\n"
+"echo \"   It will be used to sign server or client certs, keep it secret.\"\n"
+"echo \"----------------------------------------------------------------------\"\n"
+"echo \"\"\n"
+"printf \"Press Enter to print the cacert.pem certificate to the screen: \"\n"
+"read x\n"
+"echo \"\"\n"
+"cat \"$DIR/CA/cacert.pem\"\n"
+;
+
+char genCert[] = 
+"#!/bin/sh\n"
+"\n"
+"direrror() {\n"
+"	echo \"\"\n"
+"	if echo \"$DIR\" | grep '/\\.vnc/certs' > /dev/null; then\n"
+"		echo \"You need first to run:  x11vnc -sslGenCA\"\n"
+"	else\n"
+"		echo \"You need first to run:  x11vnc -sslGenCA $DIR\"\n"
+"	fi\n"
+"	echo \"to create the CA cert file and other needed config files and directories.\"\n"
+"	echo \"\"\n"
+"	if [ \"X$1\" != \"X\" ]; then\n"
+"		echo \"(missing: $1)\"\n"
+"		echo \"\"\n"
+"	fi\n"
+"	exit 1\n"
+"}\n"
+"\n"
+"make_HASH() {\n"
+"	crt=\"$1\"\n"
+"	remove=\"$2\"\n"
+"	if [ ! -f \"$crt\" ]; then\n"
+"		return\n"
+"	fi\n"
+"	dirhash=`dirname \"$crt\"`/HASH\n"
+"	bashash=`basename \"$crt\"`\n"
+"	if [ ! -d \"$dirhash\" ]; then\n"
+"		return\n"
+"	fi\n"
+"	hash=`\"$OPENSSL\" x509 -hash -noout -in \"$crt\" 2>/dev/null | head -1`\n"
+"	if [ \"X$hash\" != \"X\" ]; then\n"
+"		for i in 0 1 2 3 4 5 6 7 8 9\n"
+"		do\n"
+"			lnk=\"$dirhash/$hash.$i\"\n"
+"			if [ \"X$remove\" = \"X1\" ]; then\n"
+"				if [ -h \"$lnk\" ]; then\n"
+"					if cmp \"$lnk\" \"$crt\" > /dev/null 2>&1; then\n"
+"						ls -l \"$lnk\"\n"
+"						rm -i \"$lnk\"\n"
+"					fi\n"
+"				fi\n"
+"			else\n"
+"				if [ -h \"$lnk\" ]; then\n"
+"					if [ ! -f \"$lnk\" ]; then\n"
+"						rm -f \"$lnk\" 1>/dev/null 2>&1\n"
+"					else\n"
+"						continue\n"
+"					fi\n"
+"				fi\n"
+"				if [ \"x$HASH_verbose\" = \"x1\" ]; then\n"
+"					echo \"creating: $lnk -> ../$bashash\"\n"
+"				fi\n"
+"				ln -s \"../$bashash\" \"$lnk\"\n"
+"				break\n"
+"			fi\n"
+"		done\n"
+"	fi\n"
+"}\n"
+"\n"
+"create_key() {\n"
+"	\n"
+"	echo \"----------------------------------------------------------------------\"\n"
+"	echo \"Creating new x11vnc certificate and key for name: $type $name0\"\n"
+"	echo \"\"\n"
+"\n"
+"	cnf=\"$DIR/tmp/cnf.$$\"\n"
+"	trap \"rm -f \\\"$cnf\\\"\" 0 1 2 15\n"
+"\n"
+"	rm -f \"$DIR/$dest.key\" \"$DIR/$dest.crt\" \"$DIR/$dest.req\"\n"
+"\n"
+"	if [ \"x$self\" = \"x1\" ]; then\n"
+"		if [ ! -f \"$DIR/CA/self.cnf.$type\" ]; then\n"
+"			direrror \"$DIR/CA/self.cnf.$type\"\n"
+"		fi\n"
+"		cat \"$DIR/CA/self.cnf.$type\" | sed -e \"s/%NAME/$name0/\" > \"$cnf\" || exit 1\n"
+"		\"$OPENSSL\" req -config \"$cnf\" -nodes -new -newkey rsa:2048 -x509 \\\n"
+"			-keyout \"$DIR/$dest.key\" \\\n"
+"			-out    \"$DIR/$dest.crt\"\n"
+"	else\n"
+"		if [ ! -f \"$DIR/CA/ssl.cnf.$type\" ]; then\n"
+"			direrror \"$DIR/CA/ssl.cnf.$type\"\n"
+"		fi\n"
+"		cat \"$DIR/CA/ssl.cnf.$type\" | sed  -e \"s/%NAME/$name0/\" > \"$cnf\" || exit 1\n"
+"		\"$OPENSSL\" req -config \"$cnf\" -nodes -new -newkey rsa:2048 \\\n"
+"			-keyout \"$DIR/$dest.key\" \\\n"
+"			-out    \"$DIR/$dest.req\"\n"
+"	fi\n"
+"	rc=$?\n"
+"	if [ -f \"$DIR/$dest.key\" ]; then\n"
+"		chmod go-rwx \"$DIR/$dest.key\"\n"
+"	fi\n"
+"\n"
+"\n"
+"\n"
+"	if [ $rc != 0 ]; then\n"
+"		echo \"openssl 'req' command failed\"\n"
+"		rm -f \"$DIR/$dest.key\" \"$DIR/$dest.crt\" \"$DIR/$dest.req\"\n"
+"		exit 1\n"
+"	fi\n"
+"}\n"
+"\n"
+"enc_key() {\n"
+"	\n"
+"	echo \"\"\n"
+"	echo \"----------------------------------------------------------------------\"\n"
+"	echo \"Do you want to protect the generated private key with a passphrase?\"\n"
+"	echo \"Doing so will significantly decrease the chances someone could steal\"\n"
+"	if [ \"x$type\" = \"xserver\" ]; then\n"
+"	echo \"the key and pretend to be your x11vnc server.  The downside is it is\"\n"
+"	else\n"
+"	echo \"the key and pretend to be your VNC client.  The downside is it is\"\n"
+"	fi\n"
+"	echo \"inconvenient because you will have to supply the passphrase every\"\n"
+"	if [ \"x$type\" = \"xserver\" ]; then\n"
+"	echo \"time you start x11vnc using this key.\"\n"
+"	else\n"
+"	echo \"time you start the VNC viewer SSL tunnel using this key.\"\n"
+"	fi\n"
+"	echo \"\"\n"
+"	printf \"Protect key with a passphrase?  [y]/n \"\n"
+"	read x\n"
+"	estr=\" *unencrypted*\"\n"
+"	if [ \"x$ENCRYPT_ONLY\" != \"x\" ]; then\n"
+"		target=\"$ENCRYPT_ONLY\"\n"
+"	else\n"
+"		target=\"$DIR/$dest.key\"\n"
+"		bdir=`dirname \"$DIR/$dest.key\"`\n"
+"		if [ ! -d \"$bdir\" ]; then\n"
+"			direrror \"$bdir\"\n"
+"		fi\n"
+"	fi\n"
+"	if [ \"x$x\" != \"xn\" ]; then\n"
+"		\"$OPENSSL\" rsa -in \"$target\" -des3 -out \"$target\"\n"
+"		if [ $? != 0 ]; then\n"
+"			echo \"openssl 'rsa' command failed\"\n"
+"			rm -f \"$DIR/$dest.key\" \"$DIR/$dest.crt\" \"$DIR/$dest.req\"\n"
+"			exit 1\n"
+"		fi\n"
+"		estr=\" encrypted\"\n"
+"	fi\n"
+"	echo \"\"\n"
+"}\n"
+"\n"
+"sign_key() {\n"
+"	cd \"$DIR\" || exit 1\n"
+"\n"
+"	if [ \"x$self\" = \"x1\" ]; then\n"
+"		:\n"
+"	else\n"
+"		if echo \"$name0\" | grep '^req:' > /dev/null; then\n"
+"			echo \"\"\n"
+"			echo \"----------------------------------------------------------------------\"\n"
+"			echo \"Your x11vnc $type certificate request is:\"\n"
+"			echo \"\"\n"
+"			echo \"        $DIR/$dest.req\"\n"
+"			echo \"\"\n"
+"			echo \"   It may be sent to an external CA for signing, afterward you can\"\n"
+"			echo \"   save the cert they send you in:\"\n"
+"			echo \"\"\n"
+"			echo \"        $DIR/$dest.crt\"\n"
+"			echo \"\"\n"
+"			echo \"Your$estr private x11vnc $type key is:\"\n"
+"			echo \"\"\n"
+"			echo \"        $DIR/$dest.key\"\n"
+"			echo \"\"\n"
+"			echo \"   You should combine it and the received cert in the file:\"\n"
+"			echo \"\"\n"
+"			echo \"        $DIR/$dest.pem\"\n"
+"			echo \"\"\n"
+"			echo \"   It will be needed by applications to identify themselves.\"\n"
+"			echo \"   This file should be kept secret.\"\n"
+"			echo \"----------------------------------------------------------------------\"\n"
+"			echo \"\"\n"
+"			printf \"Press Enter to print the $dest.req cert request to the screen: \"\n"
+"			read x\n"
+"			echo \"\"\n"
+"			cat \"$DIR/$dest.req\"\n"
+"			exit 0\n"
+"		fi\n"
+"		echo \"\"\n"
+"		echo \"\"\n"
+"		echo \"----------------------------------------------------------------------\"\n"
+"		echo \"Now signing the new key with CA private key.  You will need to supply\"\n"
+"		echo \"the CA key passphrase and reply \\\"y\\\" to sign and commit the key.\"\n"
+"		echo \"\"\n"
+"		\"$OPENSSL\" ca -config \"$cnf\" -policy policy_anything -notext \\\n"
+"			-in  \"$DIR/$dest.req\" \\\n"
+"			-out \"$DIR/$dest.crt\"\n"
+"		if [ $? != 0 ]; then\n"
+"			echo \"\"\n"
+"			echo \"openssl 'ca' command failed\"\n"
+"			echo \"\"\n"
+"			echo \"  You may have a duplicate DN entry for this name in:\"\n"
+"			echo \"\"\n"
+"			echo \"          $DIR/CA/index.txt\"\n"
+"			echo \"\"\n"
+"			echo \"  remove the duplicate in that file and try again.\"\n"
+"			echo \"\"\n"
+"			rm -f \"$DIR/$dest.key\" \"$DIR/$dest.crt\" \"$DIR/$dest.req\"\n"
+"			exit 1\n"
+"		fi\n"
+"	fi\n"
+"\n"
+"	cat  \"$DIR/$dest.key\"  \"$DIR/$dest.crt\" \\\n"
+"		> \"$DIR/$dest.pem\" || exit 1 \n"
+"\n"
+"	make_HASH \"$DIR/$dest.crt\" 0\n"
+"\n"
+"	rm -f \"$DIR/$dest.key\" \"$DIR/$dest.req\" || exit 1\n"
+"	chmod go-rwx \"$DIR/$dest.pem\" || exit 1\n"
+"\n"
+"	if [ \"x$type\" = \"xserver\" -o \"x$type\" = \"xclient\" ]; then\n"
+"		echo \"\"\n"
+"		echo \"----------------------------------------------------------------------\"\n"
+"		echo \"Your public x11vnc $type cert is:\"\n"
+"		echo \"\"\n"
+"		echo \"        $DIR/$dest.crt\"\n"
+"		echo \"\"\n"
+"		echo \"   It may be copied to other machines / applications to be used for\"\n"
+"		echo \"   authentication.  However, since it is signed with the x11vnc CA\"\n"
+"		echo \"   key, all the applications need is the x11vnc CA certificate.\"\n"
+"		echo \"\"\n"
+"		echo \"Your$estr private x11vnc $type key is:\"\n"
+"		echo \"\"\n"
+"		echo \"        $DIR/$dest.pem\"\n"
+"		echo \"\"\n"
+"		echo \"   It will be needed by applications to identify themselves.\"\n"
+"		echo \"   This file should be kept secret.\"\n"
+"		echo \"----------------------------------------------------------------------\"\n"
+"		echo \"\"\n"
+"	fi\n"
+"\n"
+"	printf \"Press Enter to print the $dest.crt certificate to the screen: \"\n"
+"	read x\n"
+"	echo \"\"\n"
+"	cat \"$DIR/$dest.crt\"\n"
+"}\n"
+"\n"
+"DIR=$BASE_DIR\n"
+"if [ \"x$DIR\" = \"x\" ]; then\n"
+"        DIR=\"$HOME/dotkjr_vnc/certs\"\n"
+"fi\n"
+"if echo \"$DIR\" | grep '^/' > /dev/null; then\n"
+"	:\n"
+"else\n"
+"	DIR=\"`pwd`/$DIR\"\n"
+"fi\n"
+"\n"
+"if [ \"x$HASHON\" != \"x\" ]; then\n"
+"	for dir in \"$DIR/HASH\" \"$DIR/clients/HASH\"\n"
+"	do\n"
+"		if [ -d \"$dir\" ]; then\n"
+"			rm -rf \"$dir\"\n"
+"		fi\n"
+"	done\n"
+"	dir=\"$DIR/HASH\"\n"
+"	mkdir -p \"$dir\" || exit 1\n"
+"	dir=\"$DIR/clients/HASH\"\n"
+"	mkdir -p \"$dir\" || exit 1\n"
+"	HASH_verbose=1\n"
+"	for f in \"$DIR\"/*.crt \"$DIR\"/clients/*.crt\n"
+"	do\n"
+"		if [ -f \"$f\" ]; then\n"
+"			make_HASH \"$f\" 0\n"
+"		fi\n"
+"	done\n"
+"	exit\n"
+"fi\n"
+"if [ \"x$HASHOFF\" != \"x\" ]; then\n"
+"	dir=\"$DIR/HASH\"\n"
+"	for dir in \"$DIR/HASH\" \"$DIR/clients/HASH\"\n"
+"	do\n"
+"		if [ -d \"$dir\" ]; then\n"
+"			for f in \"$dir\"/*\n"
+"			do\n"
+"				if [ -f \"$f\" ]; then\n"
+"					echo \"deleting: $f\"\n"
+"					rm -f \"$f\"\n"
+"				fi\n"
+"			done\n"
+"			rm -rf \"$dir\"\n"
+"		fi\n"
+"	done\n"
+"	exit\n"
+"fi\n"
+"\n"
+"PATH=/usr/bin:/bin:/usr/sbin:$PATH; export PATH\n"
+"if [ \"x$OPENSSL\" = \"x\" ]; then\n"
+"        OPENSSL=\"openssl\"\n"
+"fi\n"
+"\n"
+"type \"$OPENSSL\" > /dev/null	|| exit 1\n"
+"\n"
+"self=\"\"\n"
+"if [ \"x$SELF\" != \"x\" ]; then\n"
+"	self=1\n"
+"elif [ \"x$1\" = \"x-self\" ]; then\n"
+"	shift\n"
+"	self=1\n"
+"fi\n"
+"\n"
+"if [ \"x$TYPE\" != \"x\" ]; then\n"
+"	type=\"$TYPE\"\n"
+"else\n"
+"	if [ \"X$1\" != \"X\" ]; then\n"
+"		type=\"$1\"\n"
+"		shift\n"
+"	fi\n"
+"fi\n"
+"if [ \"x$NAME\" != \"x\" ]; then\n"
+"	name=\"$NAME\"\n"
+"else\n"
+"	if [ \"X$1\" != \"X\" ]; then\n"
+"		name=\"$1\"\n"
+"		shift\n"
+"	fi\n"
+"fi\n"
+"\n"
+"if echo \"$name\" | grep '^self:' > /dev/null; then\n"
+"	self=1\n"
+"fi\n"
+"\n"
+"if [ \"x$type\" = \"xserver\" ]; then\n"
+"	name0=\"$name\"\n"
+"	if echo \"$name\" | grep '^-' > /dev/null; then\n"
+"		:\n"
+"	elif [ \"x$name\" != \"x\" ]; then\n"
+"		name=\"-$name\";\n"
+"	fi\n"
+"	dest=\"server$name\"\n"
+"elif [ \"x$type\" = \"xclient\" ]; then\n"
+"	if [ \"x$name\" = \"x\" ]; then\n"
+"		name=\"nobody\"\n"
+"	fi\n"
+"	name0=\"$name\"\n"
+"	dest=\"clients/$name\"\n"
+"else\n"
+"	exit 1\n"
+"fi\n"
+"\n"
+"#set -xv\n"
+"\n"
+"if [ \"x$INFO_ONLY\" != \"x\" ]; then\n"
+"	echo \"\"\n"
+"	echo \"VNC Certificate file:\"\n"
+"	echo \"	$INFO_ONLY\"\n"
+"	echo \"\"\n"
+"	\"$OPENSSL\" x509 -text -in \"$INFO_ONLY\"\n"
+"	exit \n"
+"elif [ \"x$DELETE_ONLY\" != \"x\" ]; then\n"
+"	echo \"\"\n"
+"	echo \"VNC Certificate file:\"\n"
+"	echo \"	$DELETE_ONLY\"\n"
+"	echo \"\"\n"
+"	\n"
+"	base=`echo \"$DELETE_ONLY\" | sed -e 's/\\....$//'`\n"
+"	for suff in crt pem key req\n"
+"	do\n"
+"		try=\"$base.$suff\"\n"
+"		if [ -f \"$try\" ]; then\n"
+"			make_HASH \"$try\" 1\n"
+"			rm -i \"$try\"\n"
+"		fi\n"
+"	done\n"
+"	if echo \"$base\" | grep 'CA/cacert$' > /dev/null; then\n"
+"		base2=`echo \"$base\" | sed -e 's,cacert$,private/cakey,'`\n"
+"	else\n"
+"		echo \"\"\n"
+"		exit\n"
+"	fi\n"
+"	echo \"\"\n"
+"	for suff in crt pem key req\n"
+"	do\n"
+"		try=\"$base2.$suff\"\n"
+"		if [ -f \"$try\" ]; then\n"
+"			make_HASH \"$try\" 1\n"
+"			rm -i \"$try\"\n"
+"		fi\n"
+"	done\n"
+"	echo \"\"\n"
+"	exit \n"
+"elif [ \"x$ENCRYPT_ONLY\" != \"x\" ]; then\n"
+"	if [ \"x$type\" = \"x\" ]; then\n"
+"		type=\"server\"\n"
+"	fi\n"
+"	echo \"\"\n"
+"	echo \"Key PEM file:\"\n"
+"	echo \"	$ENCRYPT_ONLY\"\n"
+"	enc_key\n"
+"	exit\n"
+"fi\n"
+"\n"
+"if [ ! -d \"$DIR/tmp\" ]; then\n"
+"	direrror \"$DIR/tmp\"\n"
+"fi\n"
+"bdir=`dirname \"$DIR/$dest.key\"`\n"
+"if [ ! -d \"$bdir\" ]; then\n"
+"	direrror \"$bdir\"\n"
+"fi\n"
+"if [ ! -f \"$DIR/CA/cacert.pem\" ]; then\n"
+"	direrror \"$DIR/CA/cacert.pem\"\n"
+"fi\n"
+"\n"
+"create_key\n"
+"enc_key\n"
+"sign_key\n"
+;
+
+#endif /* _SSLTOOLS_H */
diff --git a/x11vnc/tkx11vnc b/x11vnc/tkx11vnc
index 0073910..8e178ee 100755
--- a/x11vnc/tkx11vnc
+++ b/x11vnc/tkx11vnc
@@ -294,6 +294,7 @@ Permissions
 	=F ssl_pem:
 	stunnel
 	=F stunnel_pem:
+	=F ssldir:
 	=F sslverify:
 	https:
 	=GAL LOFF
@@ -358,6 +359,7 @@ Tuning
 	threads
 	wmdt:
 	rfbwait:
+	nofbpm
 	=GAL LOFF
 "
 }
diff --git a/x11vnc/tkx11vnc.h b/x11vnc/tkx11vnc.h
index 82a6a81..8bbffc9 100644
--- a/x11vnc/tkx11vnc.h
+++ b/x11vnc/tkx11vnc.h
@@ -305,6 +305,7 @@ char gui_code[] = "";
 "	=F ssl_pem:\n"
 "	stunnel\n"
 "	=F stunnel_pem:\n"
+"	=F ssldir:\n"
 "	=F sslverify:\n"
 "	https:\n"
 "	=GAL LOFF\n"
@@ -369,6 +370,7 @@ char gui_code[] = "";
 "	threads\n"
 "	wmdt:\n"
 "	rfbwait:\n"
+"	nofbpm\n"
 "	=GAL LOFF\n"
 "\"\n"
 "}\n"
diff --git a/x11vnc/x11vnc.1 b/x11vnc/x11vnc.1
index a2db39e..fcf2d6b 100644
--- a/x11vnc/x11vnc.1
+++ b/x11vnc/x11vnc.1
@@ -1,8 +1,8 @@
 .\" This file was automatically generated from x11vnc -help output.
-.TH X11VNC "1" "March 2006" "x11vnc " "User Commands"
+.TH X11VNC "1" "April 2006" "x11vnc " "User Commands"
 .SH NAME
 x11vnc - allow VNC connections to real X11 displays
-         version: 0.8.1, lastmod: 2006-03-27
+         version: 0.8.1, lastmod: 2006-04-05
 .SH SYNOPSIS
 .B x11vnc
 [OPTION]...
@@ -638,7 +638,7 @@ use the traditional
 .IR crypt (3)
 method to
 verify passwords instead.  This requires that the
-encrpyted passwords be readable.  Passwords stored
+encrypted passwords be readable.  Passwords stored
 in /etc/shadow will be inaccessible unless x11vnc
 is run as root.
 .IP
@@ -647,7 +647,7 @@ NIS setups the user encrypted passwords are accessible
 (e.g. "ypcat passwd").  NIS is not required for this
 mode to work (only that 
 .IR getpwnam (3)
-return the encrpyted
+return the encrypted
 password is required), but it is unlikely it will work
 for any other modern environment.  All of the \fB-unixpw\fR
 options and contraints apply.
@@ -665,17 +665,19 @@ is prescribed.
 to specify a PEM certificate file to use to identify
 and provide a key for this server.  See 
 .IR openssl (1)
-for what a PEM can be.
+for
+more info about PEMs and the \fB-sslGenCert\fR option below.
 .IP
-Connecting VNC viewer SSL tunnels can optionally
+The connecting VNC viewer SSL tunnel can optionally
 authenticate this server if they have the public
 key part of the certificate (or a common certificate
 authority, CA, is a more sophisicated way to verify
-this server's cert).  This is used to prevent
-man-in-the-middle attacks.  Otherwise, if the VNC
-viewer accepts this server's key without verification,
-at least the traffic is protected from passive sniffing
-on the network (but NOT from man-in-the-middle attacks).
+this server's cert, see \fB-sslGenCA\fR below).  This is
+used to prevent man-in-the-middle attacks.  Otherwise,
+if the VNC viewer accepts this server's key without
+verification, at least the traffic is protected
+from passive sniffing on the network (but NOT from
+man-in-the-middle attacks).
 .IP
 If [pem] is not supplied and the 
 .IR openssl (1)
@@ -693,15 +695,34 @@ to generate a
 temporary certificate, the public part of it will be
 displayed to stderr (e.g. one could copy it to the
 client-side to provide authentication of the server to
-VNC viewers.)
+VNC viewers.)  See following paragraphs for how to save
+keys to reuse when x11vnc is restarted.
 .IP
 Set the env. var. X11VNC_SHOW_TMP_PEM=1 to have x11vnc
 print out the entire certificate, including the PRIVATE
 KEY part, to stderr.  One could reuse this cert if saved
 in a [pem] file.  Similarly, set X11VNC_KEEP_TMP_PEM=1
 to not delete the temporary PEM file: the file name
-will be printed to stderr (so one could move it to a
-safe place for reuse).
+will be printed to stderr (so one could move it to
+a safe place for reuse).  You will be prompted for a
+passphrase for the private key.
+.IP
+If [pem] is "SAVE" then the certificate will be saved
+to the file ~/.vnc/certs/server.pem, or if that file
+exists it will be used directly.  Similarly, if [pem]
+is "SAVE_PROMPT" the server.pem certificate will be
+made based on your answers to its prompts for info such
+as OrganizationalName, CommonName, etc.
+.IP
+Use "SAVE-<string>" and "SAVE_PROMPT-<string>"
+to refer to the file ~/.vnc/certs/server-<string>.pem
+instead.  E.g. "SAVE-charlie" will store to the file
+~/.vnc/certs/server-charlie.pem
+.IP
+See \fB-ssldir\fR below to use a directory besides the
+default ~/.vnc/certs
+.IP
+Example: x11vnc \fB-ssl\fR SAVE \fB-display\fR :0 ...
 .IP
 Reverse connections are disabled in \fB-ssl\fR mode because
 there is no way to ensure that data channel will
@@ -709,43 +730,392 @@ be encrypted.  Set X11VNC_SSL_ALLOW_REVERSE=1 to
 override this.
 .IP
 Your VNC viewer will also need to be able to connect
-via SSL.  See the discussion below under \fB-stunnel\fR
-and the FAQ for how this might be achieved.  E.g. on
-Unix it is easy to write a shell script that starts up
-stunnel and then vncviewer.  Also in the x11vnc source
-a SSL enabled Java VNC Viewer applet is provided in
-the classes/ssl directory.
+via SSL.  See the discussion below under \fB-stunnel\fR and
+the FAQ (ssl_vncviewer script) for how this might be
+achieved.  E.g. on Unix it is easy to write a shell
+script that starts up stunnel and then vncviewer.
+Also in the x11vnc source a SSL enabled Java VNC Viewer
+applet is provided in the classes/ssl directory.
+.PP
+\fB-ssldir\fR \fI[dir]\fR
+.IP
+Use [dir] as an alternate ssl certificate and key
+management toplevel directory.  The default is
+~/.vnc/certs
+.IP
+This directory is used to store server and other
+certificates and keys and also other materials.  E.g. in
+the simplest case, "\fB-ssl\fR \fISAVE\fR" will store the x11vnc
+server cert in [dir]/server.pem
+.IP
+Use of alternate directories via \fB-ssldir\fR allows you to
+manage multiple VNC Certificate Authority (CA) keys.
+Another use is if ~/.vnc/cert is on an NFS share you
+might want your certificates and keys to be on a local
+filesystem to prevent network snooping (for example
+\fB-ssldir\fR /var/lib/x11vnc-certs).
+.IP
+\fB-ssldir\fR effects the other \fB-ssl*\fR options.  In the case
+of maintenance commands where the VNC server is not run
+(e.g. \fB-sslGenCA),\fR the \fB-ssldir\fR option must precede the
+command. E.g. x11vnc \fB-ssldir\fR ~/mydir \fB-sslCertInfo\fR LIST
 .PP
 \fB-sslverify\fR \fI[path]\fR
 .IP
 For either of the \fB-ssl\fR or \fB-stunnel\fR modes, use [path]
 to provide certificates to authenticate incoming VNC
-client connections.  This can be used as a method to
-replace standard password authentication of clients.
+*Client* connections (normally only the server is
+authenticated in SSL.)  This can be used as a method
+to replace standard password authentication of clients.
 .IP
 If [path] is a directory it contains the client (or CA)
-certificates in separate files.  If [path] is a file, it
-contains multiple certificates.  These correspond to the
-"CApath = dir" and "CAfile = file" stunnel options.
-See the 
+certificates in separate files.  If [path] is a file,
+it contains multiple certificates.  See special tokens
+below.  These correspond to the "CApath = dir" and
+"CAfile = file" stunnel options.  See the 
 .IR stunnel (8)
 manpage for details.
 .IP
-To create certificates for all sorts of authentications
-(clients, servers, via CA, etc) see the 
+Examples:
+x11vnc \fB-ssl\fR \fB-sslverify\fR ~/my.pem
+x11vnc \fB-ssl\fR \fB-sslverify\fR ~/my_pem_dir/
+.IP
+Note that if [path] is a directory, it must contain
+the certs in separate files named like <HASH>.0, where
+the value of <HASH> is found by running the command
+"openssl x509 \fB-hash\fR \fB-noout\fR \fB-in\fR file.crt". Evidently
+one uses <HASH>.1 if there is a collision...
+.IP
+The the key-management utility "\fB-sslCertInfo\fR \fIHASHON\fR"
+and "\fB-sslCertInfo\fR \fIHASHOFF\fR" will create/delete these
+hashes for you automatically (via symlink) in the HASH
+subdirs it manages.  Then you can point \fB-sslverify\fR to
+the HASH subdir.
+.IP
+Special tokens: in \fB-ssl\fR mode, if [path] is not a file or
+a directory, it is taken as a comma separated list of
+tokens that are interpreted as follows:
+.IP
+If a token is "CA" that means load the CA/cacert.pem
+file from the ssl directory.  If a token is "clients"
+then all the files clients/*.crt in the ssl directory
+are loaded.  Otherwise the file clients/token.crt
+is attempted to be loaded.  As a kludge, use a token
+like ../server-foo to load a server cert if you find
+that necessary.
+.IP
+Use \fB-ssldir\fR to use a directory different from the
+~/.vnc/certs default.
+.IP
+Note that if the "CA" cert is loaded you do not need
+to load any of the certs that have been signed by it.
+You will need to load any additional self-signed certs
+however.
+.IP
+Examples:
+x11vnc \fB-ssl\fR \fB-sslverify\fR CA
+x11vnc \fB-ssl\fR \fB-sslverify\fR self:fred,self:jim
+x11vnc \fB-ssl\fR \fB-sslverify\fR CA,clients
+.IP
+Usually "\fB-sslverify\fR \fICA\fR" is the most effective.
+See the \fB-sslGenCA\fR and \fB-sslGenCert\fR options below for
+how to set up and manage the CA framework.
+.IP
+NOTE: the following utilities, \fB-sslGenCA,\fR \fB-sslGenCert,\fR
+\fB-sslEncKey,\fR and \fB-sslCertInfo\fR are provided for
+completeness, but for casual usage they are overkill.
+.IP
+They provide VNC Certificate Authority (CA) key creation
+and server / client key generation and signing.  So they
+provide a basic Public Key management framework for
+VNC-ing with x11vnc. (note that they require 
 .IR openssl (1)
-command.  Of particular usefulness is the "x509"
-subcommand of 
-.IR openssl (1).
+be installed on the system)
+.IP
+However, the simplest usage mode (where x11vnc
+automatically generates its own, self-signed, temporary
+key and the VNC viewers always accept it, e.g. accepting
+via a dialog box) is probably safe enough for most
+scenarios.  CA management is not needed.
+.IP
+To protect against Man-In-The-Middle attacks the
+simplest mode can be improved by using "\fB-ssl\fR \fISAVE\fR"
+to have x11vnc create a longer term self-signed
+certificate, and then (safely) copy the corresponding
+public key cert to the desired client machines (care
+must be taken the private key part is not stolen;
+you will be prompted for a passphrase).
+.IP
+So keep in mind no CA key creation or management
+(-sslGenCA and \fB-sslGenCert)\fR is needed for either of
+the above two common usage modes.
+.IP
+One might want to use \fB-sslGenCA\fR and \fB-sslGenCert\fR
+if you had a large number of VNC client and server
+workstations.  That way the administrator could generate
+a single CA key with \fB-sslGenCA\fR and distribute its
+certificate part to all of the workstations.
+.IP
+Next, he could create signed VNC server keys
+(-sslGenCert server ...) for each workstation or user
+that then x11vnc would use to authenticate itself to
+any VNC client that has the CA cert.
+.IP
+Optionally, the admin could also make it so the
+VNC clients themselves are authenticated to x11vnc
+(-sslGenCert client ...)  For this \fB-sslverify\fR would be
+pointed to the CA cert (and/or self-signed certs).
+.IP
+x11vnc will be able to use all of these cert and
+key files.  On the VNC client side, they will need to
+be "imported" somehow.  Web browsers have "Manage
+Certificates" actions as does the Java applet plugin
+Control Panel.  stunnel can also use these files (see
+the ssl_vncviewer example script in the FAQ.)
+.PP
+\fB-sslGenCA\fR \fI[dir]\fR
+.IP
+Generate your own Certificate Authority private key,
+certificate, and other files in directory [dir].
+.IP
+If [dir] is not supplied, a \fB-ssldir\fR setting is used,
+or otherwise ~/.vnc/certs is used.
+.IP
+This command also creates directories where server and
+client certs and keys will be stored.  The 
+.IR openssl (1)
+program must be installed on the system and available
+in PATH.
+.IP
+After the CA files and directories are created the
+command exits; the VNC server is not run.
+.IP
+You will be prompted for information to put into the CA
+certificate.  The info does not have to be accurate just
+as long as clients accept the cert for VNC connections.
+You will also need to supply a passphrase of at least
+4 characters for the CA private key.
+.IP
+Once you have generated the CA you can distribute
+its certificate part, [dir]/CA/cacert.pem, to other
+workstations where VNC viewers will be run.  One will
+need to "import" this certicate in the applications,
+e.g. Web browser, Java applet plugin, stunnel, etc.
+Next, you can create and sign keys using the CA with
+the \fB-sslGenCert\fR option below.
+.IP
+Examples:
+x11vnc \fB-sslGenCA\fR
+x11vnc \fB-sslGenCA\fR  ~/myCAdir
+x11vnc \fB-ssldir\fR ~/myCAdir \fB-sslGenCA\fR
+.IP
+(the last two lines are equivalent)
+.PP
+\fB-sslGenCert\fR \fItype\fR \fIname\fR
+.IP
+Generate a VNC server or client certificate and private
+key pair signed by the CA created previously with
+\fB-sslGenCA.\fR  The 
+.IR openssl (1)
+program must be installed
+on the system and available in PATH.
+.IP
+After the Certificate is generated the command exits;
+the VNC server is not run.
+.IP
+The type of key to be generated is the string \fItype\fR.
+It is either "server" (i.e. for use by x11vnc) or
+"client" (for a VNC viewer).  Note that typically
+only "server" is used: the VNC clients authenticate
+themselves by a non-public-key method (e.g. VNC or
+unix password).  \fItype\fR is required.
+.IP
+An arbitrary default name you want to associate with
+the key is supplied by the \fIname\fR string.  You can
+change it at the various prompts when creating the key.
+\fIname\fR is optional.
+.IP
+If name is left blank for clients keys then "nobody"
+is used.  If left blank for server keys, then the
+primary server key: "server.pem" is created (this
+is the saved one referenced by "\fB-ssl\fR \fISAVE\fR" when the
+server is started)
+.IP
+If \fIname\fR begins with the string "self:" then
+a self-signed certificate is created instead of one
+signed by your CA key.
+.IP
+If \fIname\fR begins with the string "req:" then only a
+key (.key) and a certificate signing *request* (.req)
+are generated.  You can then send the .req file to
+an external CA (even a professional one, e.g. Thawte)
+and then combine the .key and the received cert into
+the .pem file with the same basename.
+.IP
+The distinction between "server" and "client" is
+simply the choice of output filenames and sub-directory.
+This makes it so the \fB-ssl\fR SAVE-name option can easily
+pick up the x11vnc PEM file this option generates.
+And similarly makes it easy for the \fB-sslverify\fR option
+to pick up your client certs.
+.IP
+There is nothing special about the filename or directory
+location of either the "server" and "client" certs.
+You can rename the files or move them to wherever
+you like.
+.IP
+Precede this option with \fB-ssldir\fR [dir] to use a
+directory other than the default ~/.vnc/certs You will
+need to run \fB-sslGenCA\fR on that directory first before
+doing any \fB-sslGenCert\fR key creation.
+.IP
+Note you cannot recreate a cert with exactly the same
+distiguished name (DN) as an existing one.  To do so,
+you will need to edit the [dir]/CA/index.txt file to
+delete the line.
+.IP
+Similar to \fB-sslGenCA,\fR you will be prompted to fill
+in some information that will be recorded in the
+certificate when it is created.  Tip: if you know
+the fully-quailified hostname other people will be
+connecting to you can use that as the CommonName "CN"
+to avoid some applications (e.g. web browsers and java
+plugin) complaining it does not match the hostname.
+.IP
+You will also need to supply the CA private key
+passphrase to unlock the private key created from
+\fB-sslGenCA.\fR  This private key is used to sign the server
+or client certicate.
+.IP
+The "server" certs can be used by x11vnc directly by
+pointing to them via the \fB-ssl\fR [pem] option.  The default
+file will be ~/.vnc/certs/server.pem.  This one would
+be used by simply typing \fB-ssl\fR SAVE.  The pem file
+contains both the certificate and the private key.
+server.crt file contains the cert only.
+.IP
+The "client" cert + private key file will need
+to be copied and imported into the VNC viewer
+side applications (Web browser, Java plugin,
+stunnel, etc.)  Once that is done you can delete the
+"client" private key file on this machine since
+it is only needed on the VNC viewer side.  The,
+e.g. ~/.vnc/certs/clients/<name>.pem contains both
+the cert and private key.  The <name>.crt contains the
+certificate only.
+.IP
+NOTE: It is very important to know one should always
+generate new keys with a passphrase.  Otherwise if an
+untrusted user steals the key file he could use it to
+masquerade as the x11vnc server (or VNC viewer client).
+You will be prompted whether to encrypt the key with
+a passphrase or not.  It is recommended that you do.
+One inconvenience to a passphrase is that it must
+be suppled every time x11vnc or the client app is
+started up.
+.IP
+Examples:
+.IP
+x11vnc \fB-sslGenCert\fR server
+x11vnc \fB-ssl\fR SAVE \fB-display\fR :0 ...
+.IP
+and then on viewer using ssl_vncviewer stunnel wrapper
+(see the FAQ):
+ssl_vncviewer \fB-verify\fR ./cacert.crt hostname:0
+.IP
+(this assumes the cacert.crt cert from \fB-sslGenCA\fR
+was safely copied to the VNC viewer machine where
+ssl_vncviewer is run)
+.IP
+Example using a name:
+.IP
+x11vnc \fB-sslGenCert\fR server charlie
+x11vnc \fB-ssl\fR SAVE-charlie \fB-display\fR :0 ...
+.IP
+Example for a client certificate (rarely used):
+.IP
+x11vnc \fB-sslGenCert\fR client roger
+scp ~/.vnc/certs/clients/roger.pem somehost:.
+rm  ~/.vnc/certs/clients/roger.pem
+.IP
+x11vnc is then started with the the option \fB-sslverify\fR
+~/.vnc/certs/clients/roger.crt (or simply \fB-sslverify\fR
+roger), and on the viewer user on somehost could do
+for example:
+.IP
+ssl_vncviewer \fB-mycert\fR ./roger.pem hostname:0
+.PP
+\fB-sslEncKey\fR \fI[pem]\fR
+.IP
+Utility to encrypt an existing PEM file with a
+passphrase you supply when prompted.  For that key to be
+used (e.g. by x11vnc) the passphrase must be supplied
+each time.
+.IP
+The "SAVE" notation described under \fB-ssl\fR applies as
+well. (precede this option with \fB-ssldir\fR [dir] to refer
+a directory besides the default ~/.vnc/certs)
+.IP
+The 
+.IR openssl (1)
+program must be installed on the system
+and available in PATH.  After the Key file is encrypted
+the command exits; the VNC server is not run.
+.IP
+Examples:
+x11vnc \fB-sslEncKey\fR /path/to/foo.pem
+x11vnc \fB-sslEncKey\fR SAVE
+x11vnc \fB-sslEncKey\fR SAVE-charlie
+.PP
+\fB-sslCertInfo\fR \fI[pem]\fR
+.IP
+Prints out information about an existing PEM file.
+In addition the public certificate is also printed.
+The 
+.IR openssl (1)
+program must be in PATH. Basically the
+command "openssl x509 \fB-text"\fR is run on the pem.
+.IP
+The "SAVE" notation described under \fB-ssl\fR applies
+as well.
+.IP
+Using  "LIST" will give a list of all certs being
+managed (in the ~/.vnc/certs dir, use \fB-ssldir\fR to refer
+to another dir).  "ALL" will print out the info for
+every managed key (this can be very long).  Giving a
+client or server cert shortname will also try a lookup
+(e.g. \fB-sslCertInfo\fR charlie).  Use "LISTL" or "LL"
+for a long (ls \fB-l\fR style) listing.
+.IP
+Using "HASHON" will create subdirs [dir]/HASH and
+[dir]/HASH with OpenSSL hash filenames (e.g. 0d5fbbf1.0)
+symlinks pointing up to the corresponding *.crt file.
+([dir] is ~/.vnc/certs or one given by \fB-ssldir.)\fR
+This is a useful way for other OpenSSL applications
+(e.g. stunnel) to access all of the certs without
+having to concatenate them.  x11vnc will not use them
+unless you specifically reference them.  "HASHOFF"
+removes these HASH subdirs.
+.IP
+The LIST, LISTL, LL, ALL, HASHON, HASHOFF words can
+also be lowercase, e.g. "list".
+.PP
+\fB-sslDelCert\fR \fI[pem]\fR
+.IP
+Prompts you to delete all .crt .pem .key .req files
+associated with [pem].  "SAVE" and lookups as in
+\fB-sslCertInfo\fR apply as well.
 .PP
 \fB-stunnel\fR \fI[pem]\fR
 .IP
 Use the 
 .IR stunnel (8)
 (www.stunnel.org) to provide an
-encrypted SSL tunnel between viewers and x11vnc.  This
-was implemented prior to the integrated \fB-ssl\fR encrpytion.
-It works well.  This requires stunnel to be installed
+encrypted SSL tunnel between viewers and x11vnc.
+.IP
+This external tunnel method was implemented prior to the
+integrated \fB-ssl\fR encryption described above.  It still
+works well.  This requires stunnel to be installed
 on the system and available via PATH (n.b. stunnel is
 often installed in sbin directories).  Version 4.x of
 stunnel is assumed (but see \fB-stunnel3\fR below.)
@@ -771,14 +1141,13 @@ Your VNC viewer will also need to be able to connect via
 SSL.  Unfortunately not too many do this.  UltraVNC has
 an encryption plugin but it does not seem to be SSL.
 .IP
-In the x11vnc distribution, a patched TightVNC Java
-applet is provided in classes/ssl that does SSL
+Also, in the x11vnc distribution, a patched TightVNC
+Java applet is provided in classes/ssl that does SSL
 connections (only).
 .IP
 It is also not too difficult to set up an stunnel or
-other SSL tunnel on the viewer side.
-.IP
-A simple example on Unix using stunnel 3.x is:
+other SSL tunnel on the viewer side.  A simple example
+on Unix using stunnel 3.x is:
 .IP
 % stunnel \fB-c\fR \fB-d\fR localhost:5901 \fB-r\fR remotehost:5900
 % vncviewer localhost:1
@@ -842,9 +1211,10 @@ Store password \fIpass\fR as the VNC password in the
 file \fIfile\fR.  Once the password is stored the
 program exits.  Use the password via "\fB-rfbauth\fR \fIfile\fR"
 .IP
-If called with no arguments, i.e., "\fB-storepasswd\fR",
+If called with no arguments, "x11vnc \fB-storepasswd",\fR
 the user is prompted for a password and it is stored
-in the file ~/.vnc/passwd
+in the file ~/.vnc/passwd.  Called with one argument,
+that will be the file to store the prompted password in.
 .PP
 \fB-nopw\fR
 .IP
@@ -1078,12 +1448,9 @@ each rectangle.  If one of the items on the list is the
 string "noptr" the mouse pointer will not be allowed
 to go into a blacked out region.
 .PP
-\fB-xinerama\fR
+\fB-xinerama,\fR \fB-noxinerama\fR
 .IP
 If your screen is composed of multiple monitors
-.PP
-\fB-noxinerama\fR
-.IP
 glued together via XINERAMA, and that screen is
 not a rectangle this option will try to guess the
 areas to black out (if your system has libXinerama).
@@ -2086,12 +2453,9 @@ slow links that take a long time to paint the first
 screen libvncserver may hit the timeout and drop the
 connection.  Default: 20 seconds.
 .PP
-\fB-nap\fR
+\fB-nap,\fR \fB-nonap\fR
 .IP
 Monitor activity and if it is low take longer naps
-.PP
-\fB-nonap\fR
-.IP
 between screen polls to really cut down load when idle.
 Default: take naps
 .PP
@@ -2101,6 +2465,26 @@ Time in seconds after NO activity (e.g. screen blank)
 to really throttle down the screen polls (i.e. sleep
 for about 1.5 secs). Use 0 to disable.  Default: 60
 .PP
+\fB-nofbpm,\fR \fB-fbpm\fR
+.IP
+If the system supports the FBPM (Frame Buffer Power
+Management) extension (i.e. some Sun systems), then
+prevent the video h/w from going into a reduced power
+state when VNC clients are connected.
+.IP
+FBPM capable video h/w save energy when the workstation
+is idle by going into low power states (similar to DPMS
+for monitors).  This interferes with x11vnc's polling
+of the framebuffer data.
+.IP
+"\fB-nofbpm\fR" means prevent FBPM low power states whenever
+VNC clients are connected, while "\fB-fbpm\fR" means to not
+monitor the FBPM state at all.  See the 
+.IR xset (1)
+manpage
+for details.  \fB-nofbpm\fR is basically the same as running
+"xset fbpm force on" periodically.  Default: \fB-fbpm\fR
+.PP
 \fB-noxdamage\fR
 .IP
 Do not use the X DAMAGE extension to detect framebuffer
@@ -2760,6 +3144,10 @@ nonap           disable \fB-nap\fR mode.
 .IP
 sb:n            set \fB-sb\fR to n s, same as screen_blank:n
 .IP
+fbpm            disable \fB-nofbpm\fR mode.
+.IP
+nofbpm          enable  \fB-nofbpm\fR mode.
+.IP
 xdamage         enable  xdamage polling hints.
 .IP
 noxdamage       disable xdamage polling hints.
@@ -2937,8 +3325,8 @@ pm input_skip input client_input speeds wmdt
 debug_pointer dp nodebug_pointer nodp debug_keyboard
 dk nodebug_keyboard nodk deferupdate defer wait_ui
 wait_bog nowait_bog slow_fb wait readtimeout nap nonap
-sb screen_blank fs gaps grow fuzz snapfb nosnapfb
-rawfb progressive rfbport http nohttp httpport
+sb screen_blank fbpm nofbpm fs gaps grow fuzz snapfb
+nosnapfb rawfb progressive rfbport http nohttp httpport
 httpdir enablehttpproxy noenablehttpproxy alwaysshared
 noalwaysshared nevershared noalwaysshared dontdisconnect
 nodontdisconnect desktop debug_xevents nodebug_xevents
diff --git a/x11vnc/x11vnc.c b/x11vnc/x11vnc.c
index 58a7f41..e29101e 100644
--- a/x11vnc/x11vnc.c
+++ b/x11vnc/x11vnc.c
@@ -142,6 +142,7 @@
 #include "sslcmds.h"
 #include "sslhelper.h"
 #include "selection.h"
+#include "pm.h"
 
 /*
  * main routine for the x11vnc program
@@ -468,6 +469,7 @@ if (debug_scroll) fprintf(stderr, "watch_loop: LOOP-BACK: %d\n", ret);
 			check_new_clients();
 			check_xevents();
 			check_autorepeat();
+			check_pm();
 			check_keycode_state();
 			check_connect_inputs();		
 			check_gui_inputs();		
@@ -1161,6 +1163,7 @@ static void print_settings(int try_http, int bg, char *gui_str) {
 	fprintf(stderr, " readtimeout: %d\n", rfbMaxClientWait/1000);
 	fprintf(stderr, " take_naps:  %d\n", take_naps);
 	fprintf(stderr, " sb:         %d\n", screen_blank);
+	fprintf(stderr, " fbpm:       %d\n", !watch_fbpm);
 	fprintf(stderr, " xdamage:    %d\n", use_xdamage);
 	fprintf(stderr, "  xd_area:   %d\n", xdamage_max_area);
 	fprintf(stderr, "  xd_mem:    %.3f\n", xdamage_memory);
@@ -1268,7 +1271,7 @@ static void check_loop_mode(int argc, char* argv[]) {
 #endif
 	}
 }
-static void store_homedir_passwd(void) {
+static void store_homedir_passwd(char *file) {
 	char str1[32], str2[32], *p, *h, *f;
 	struct stat sbuf;
 
@@ -1311,27 +1314,32 @@ static void store_homedir_passwd(void) {
 		exit(1);
 	}
 
-	h = getenv("HOME");
-	if (! h) {
-		fprintf(stderr, "** $HOME not set.\n");
-		exit(1);
-	}
+	if (file != NULL) {
+		f = file;
+	} else {
+		
+		h = getenv("HOME");
+		if (! h) {
+			fprintf(stderr, "** $HOME not set.\n");
+			exit(1);
+		}
 
-	f = (char *) malloc(strlen(h) + strlen("/.vnc/passwd") + 1);
-	sprintf(f, "%s/.vnc", h);
+		f = (char *) malloc(strlen(h) + strlen("/.vnc/passwd") + 1);
+		sprintf(f, "%s/.vnc", h);
 
-	if (stat(f, &sbuf) != 0) {
-		if (mkdir(f, 0755) != 0) {
-			fprintf(stderr, "** could not create directory %s\n", f);
-			perror("mkdir");
+		if (stat(f, &sbuf) != 0) {
+			if (mkdir(f, 0755) != 0) {
+				fprintf(stderr, "** could not create directory %s\n", f);
+				perror("mkdir");
+				exit(1);
+			}
+		} else if (! S_ISDIR(sbuf.st_mode)) {
+			fprintf(stderr, "** not a directory %s\n", f);
 			exit(1);
 		}
-	} else if (! S_ISDIR(sbuf.st_mode)) {
-		fprintf(stderr, "** not a directory %s\n", f);
-		exit(1);
-	}
 
-	sprintf(f, "%s/.vnc/passwd", h);
+		sprintf(f, "%s/.vnc/passwd", h);
+	}
 	fprintf(stderr, "Write password to %s?  [y]/n ", f);
 
 	if (fgets(str2, 32, stdin) == NULL) {
@@ -1597,9 +1605,64 @@ int main(int argc, char* argv[]) {
 					i++;
 				}
 			}
+		} else if (!strcmp(arg, "-ssldir")) {
+			CHECK_ARGC
+			ssl_certs_dir = strdup(argv[++i]);
+
 		} else if (!strcmp(arg, "-sslverify")) {
 			CHECK_ARGC
 			ssl_verify = strdup(argv[++i]);
+
+		} else if (!strcmp(arg, "-sslGenCA")) {
+			char *cdir = NULL;
+			if (i < argc-1) {
+				char *s = argv[i+1];
+				if (s[0] != '-') {
+					cdir = strdup(s);
+					i++;
+				}
+			}
+			sslGenCA(cdir);
+			exit(0);
+		} else if (!strcmp(arg, "-sslGenCert")) {
+			char *ty, *nm = NULL;
+			if (i >= argc-1) {
+				fprintf(stderr, "Must be:\n");
+				fprintf(stderr, "          x11vnc -sslGenCert server ...\n");
+				fprintf(stderr, "or        x11vnc -sslGenCert client ...\n");
+				exit(1);
+			}
+			ty = argv[i+1];
+			if (strcmp(ty, "server") && strcmp(ty, "client")) {
+				fprintf(stderr, "Must be:\n");
+				fprintf(stderr, "          x11vnc -sslGenCert server ...\n");
+				fprintf(stderr, "or        x11vnc -sslGenCert client ...\n");
+				exit(1);
+			}
+			if (i < argc-2) {
+				nm = argv[i+2];
+			}
+			sslGenCert(ty, nm);
+			exit(0);
+		} else if (!strcmp(arg, "-sslEncKey")) {
+			if (i < argc-1) {
+				char *s = argv[i+1];
+				sslEncKey(s, 0);
+			}
+			exit(0);
+		} else if (!strcmp(arg, "-sslCertInfo")) {
+			if (i < argc-1) {
+				char *s = argv[i+1];
+				sslEncKey(s, 1);
+			}
+			exit(0);
+		} else if (!strcmp(arg, "-sslDelCert")) {
+			if (i < argc-1) {
+				char *s = argv[i+1];
+				sslEncKey(s, 2);
+			}
+			exit(0);
+
 		} else if (!strcmp(arg, "-stunnel")) {
 			use_stunnel = 1;
 			if (i < argc-1) {
@@ -1633,11 +1696,15 @@ int main(int argc, char* argv[]) {
 		} else if (!strcmp(arg, "-usepw")) {
 			usepw = 1;
 		} else if (!strcmp(arg, "-storepasswd")) {
-			if (i+1 >= argc) {
-				store_homedir_passwd();
+			if (argc == i+1) {
+				store_homedir_passwd(NULL);
+				exit(0);
+			}
+			if (argc == i+2) {
+				store_homedir_passwd(argv[i+1]);
 				exit(0);
 			}
-			if (i+2 >= argc || rfbEncryptAndStorePasswd(argv[i+1],
+			if (argc >= i+4 || rfbEncryptAndStorePasswd(argv[i+1],
 			    argv[i+2]) != 0) {
 				fprintf(stderr, "-storepasswd failed\n");
 				exit(1);
@@ -1964,6 +2031,10 @@ int main(int argc, char* argv[]) {
 		} else if (!strcmp(arg, "-sb")) {
 			CHECK_ARGC
 			screen_blank = atoi(argv[++i]);
+		} else if (!strcmp(arg, "-nofbpm")) {
+			watch_fbpm = 1;
+		} else if (!strcmp(arg, "-fbpm")) {
+			watch_fbpm = 0;
 		} else if (!strcmp(arg, "-xdamage")) {
 			use_xdamage = 1;
 		} else if (!strcmp(arg, "-noxdamage")) {
@@ -2323,16 +2394,6 @@ int main(int argc, char* argv[]) {
 		exit(1);
 	}
 
-	if (ssl_verify) {
-		struct stat sbuf;
-		if (stat(ssl_verify, &sbuf) != 0) {
-			rfbLog("x11vnc: -sslverify %s does not exist\n",
-			    ssl_verify);
-			rfbLogPerror("stat");
-			exit(1);
-		}
-	}
-
 	/*
 	 * If -passwd was used, clear it out of argv.  This does not
 	 * work on all UNIX, have to use execvp() in general...
@@ -3031,6 +3092,7 @@ int main(int argc, char* argv[]) {
 	}
 #endif
 
+	check_pm();
 
 	if (! quiet) {
 		rfbLog("--------------------------------------------------------\n");
diff --git a/x11vnc/x11vnc.h b/x11vnc/x11vnc.h
index 09370fe..2c69d1b 100644
--- a/x11vnc/x11vnc.h
+++ b/x11vnc/x11vnc.h
@@ -190,6 +190,8 @@
 #include <X11/extensions/XShm.h>
 #endif
 
+#include <dirent.h>
+
 #if LIBVNCSERVER_HAVE_XTEST
 #include <X11/extensions/XTest.h>
 #endif
diff --git a/x11vnc/x11vnc_defs.c b/x11vnc/x11vnc_defs.c
index f6af73f..7c45af0 100644
--- a/x11vnc/x11vnc_defs.c
+++ b/x11vnc/x11vnc_defs.c
@@ -15,7 +15,7 @@ int xtrap_base_event_type = 0;
 int xdamage_base_event_type = 0;
 
 /*               date +'lastmod: %Y-%m-%d' */
-char lastmod[] = "0.8.1 lastmod: 2006-03-27";
+char lastmod[] = "0.8.1 lastmod: 2006-04-05";
 
 /* X display info */