diff --git a/ap/app/goahead/server/websSSL.c b/ap/app/goahead/server/websSSL.c
new file mode 100755
index 0000000..30949b2
--- /dev/null
+++ b/ap/app/goahead/server/websSSL.c
@@ -0,0 +1,759 @@
+#ifndef __ENABLE_MOCANA_SSL_SERVER__ 
+
+#include	"wsIntrn.h"
+#include	"webs.h"
+#include	"websSSL.h"
+#include	"ref_nv_def.h"
+
+
+#define DEFAULT_KEY_FILE	"/etc_ro/certs/cakey.pem"
+#define DEFAULT_CA_FILE		"/etc_ro/certs/cacert.pem"
+#define DEFAULT_PWD_FILE	"/etc_ro/certs/password"
+#define SSL_PORT			443
+
+#define DEFAULT_KEY_MASK	0x60
+typedef struct websSSLKey {
+	char pwd[17];
+	unsigned char procType;
+	unsigned short dekType;
+	unsigned char dekInfo[16];
+	unsigned char privateKey[624];
+	unsigned short certLen;
+} websSSLKey;
+
+
+
+#ifdef SIGPIPE
+#define do_pipe_sig()	signal(SIGPIPE,SIG_IGN)
+#else
+#define do_pipe_sig()
+#endif
+
+
+#  if defined(MSDOS) || defined(WIN16) || defined(WIN32)
+#    ifdef _O_BINARY
+#      define apps_startup() \
+		_fmode=_O_BINARY; do_pipe_sig(); CRYPTO_malloc_init(); \
+		SSLC_add_all_algorithms()
+#    else
+#      define apps_startup() \
+		_fmode=O_BINARY; do_pipe_sig(); CRYPTO_malloc_init(); \
+		SSLC_add_all_algorithms()
+#    endif
+#  else
+#    define apps_startup()	do_pipe_sig(); SSLC_add_all_algorithms();
+#  endif
+
+
+#ifdef OPENSSL
+#ifndef SSLeay_add_all_algorithms
+#define SSLeay_add_all_algorithms() OpenSSL_add_all_algorithms()
+#endif
+
+#define SSLC_add_all_algorithms()	SSLeay_add_all_algorithms()
+#else
+extern void SSLC_add_all_algorithms(void);
+#endif
+
+
+static int		websSSLVerifyCallback(int ok, X509_STORE_CTX *ctx);
+static RSA		*websSSLTempRSACallback(SSL *s, int is_export, int keylength);
+
+static int		websSSLReadEvent (webs_t wp);
+static int		websSSLAccept(int sid, char *ipaddr, int port, int listenSid);
+static void		websSSLSocketEvent(int sid, int mask, int data);
+static int		websSSLSetCertStuff(SSL_CTX *ctx, char *cert_file, char *key_file);
+
+
+static int		sslListenSock = -1;			
+static SSL_CTX	*sslctx = NULL;
+static char		*sslpwd = NULL;
+static websSSLKey sslkey = {0};
+static unsigned char *sslcert = NULL;
+
+
+static int getFileSize(char *lpath)
+{
+	gstat_t s;
+	
+	if (lpath && stat(lpath, &s) == 0) {
+		return s.st_size;
+	}
+	return 0;
+}
+
+
+int websSSLOpen()
+{
+	SSL_METHOD	*meth;
+
+	apps_startup();
+	trace(7, T("SSL: Initializing SSL\n")); 
+
+#ifdef SSLC
+	SSL_library_init();
+#endif
+
+	SSL_load_error_strings();
+
+#ifdef OPENSSL
+	SSLeay_add_ssl_algorithms();
+#endif
+
+
+#ifdef WEBINSPECT_FIX 
+	meth = TLSv1_2_server_method();
+#else 
+	meth = SSLv23_server_method();
+#endif	
+	sslctx = SSL_CTX_new(meth);
+
+	a_assert(sslctx);
+
+	if (sslctx == NULL) {
+		trace(2, T("SSL: Unable to create SSL context!\n")); 
+		return -1;
+	}
+
+
+	SSL_CTX_set_quiet_shutdown(sslctx, 1);
+	SSL_CTX_set_options(sslctx, SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION);
+	SSL_CTX_sess_set_cache_size(sslctx, 128);
+	
+	EC_KEY *ecdh = EC_KEY_new_by_curve_name (NID_X9_62_prime256v1);
+	if (ecdh){
+		long eret = SSL_CTX_set_tmp_ecdh (sslctx, ecdh);
+		trace(2, T("SSL: ecdh:%x ret=%d\n"), ecdh, eret); 
+		EC_KEY_free(ecdh);
+		ecdh = NULL;
+	}
+
+
+#ifdef WEBINSPECT_FIX	
+	if(!SSL_CTX_set_cipher_list(sslctx,"ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:!NULL:!RC4:!RC2:!DES:!3DES:!SHA:!SHA256:!SHA384:!MD5+HIGH:+MEDIUM"))
+		trace(2, T("SSL: Unable to set !DES:!RC4:!SHA1\n")); 
+#endif		
+
+	unsigned char webkey_flag = 0;
+	int retCode = cpnv_NvItemRead(ZPS_REF_MSINFO_WEBKEY_FLAG_BASE_ADDR, &webkey_flag, sizeof(webkey_flag));
+	if (retCode == CPNV_ERROR)
+	{
+		trace(2, T("SSL: read cpnv keyflag error\n"));
+		websSSLClose();
+		return -1;
+	}
+	trace(2, T("SSL: webkey_flag=%d\n"),webkey_flag);
+	if (webkey_flag != 1)
+	{
+		ssize_t read_len = 0;
+		char *pwdFile = DEFAULT_PWD_FILE;
+		int pwdSize = getFileSize(pwdFile);
+		if(pwdSize > 0)
+		{
+			int fd = open(pwdFile, SOCKET_RDONLY | SOCKET_BINARY, 0666);
+			if(fd >= 0) 
+			{
+				sslpwd = balloc(B_L,pwdSize + 1);
+				if(sslpwd != NULL)
+				{
+					memset(sslpwd, 0, pwdSize + 1);
+					read_len = read(fd, sslpwd, pwdSize);
+					if(read_len < 0)
+					{
+						trace(2, T("read len:%d ; errno: %s\n"), read_len, strerror(errno)); 
+					}
+					trace(2, T("SSL: pwd:%s\n"), sslpwd); 
+					SSL_CTX_set_default_passwd_cb_userdata(sslctx, (void *)sslpwd);
+				}
+				close(fd);
+			}
+		}
+			
+		//char *certFile = DEFAULT_CA_FILE;
+		//char *keyFile = DEFAULT_KEY_FILE;// kw OVERWRITE_CONST_CHAR
+		if (websSSLSetCertStuff(sslctx, DEFAULT_CA_FILE, DEFAULT_KEY_FILE) != 0) {
+			websSSLClose();
+			return -1;
+		}
+	}
+	else
+	{
+		retCode = cpnv_NvItemRead(ZPS_REF_MSINFO_WEBKEY_DATA_BASE_ADDR, (unsigned char *)&sslkey, sizeof(sslkey));
+		char i = 0;
+		if (retCode == CPNV_ERROR)
+		{
+			trace(2, T("SSL: read cpnv key error\n"));
+			websSSLClose();
+			return -1;
+		}
+		trace(2, T("SSL: key procType=%d dekType=%d certLen=%d\n"),sslkey.procType,sslkey.dekType,sslkey.certLen);
+		sslcert = balloc(B_L, sslkey.certLen);
+		if(sslcert == NULL)
+		{
+			trace(2, T("SSL: alloc cpnv cert fail\n"));
+			websSSLClose();
+			return -1;
+		}
+		retCode = cpnv_NvItemRead(ZPS_REF_MSINFO_WEBKEY_DATA_BASE_ADDR+sizeof(sslkey), sslcert, sslkey.certLen);
+		if (retCode == CPNV_ERROR)
+		{
+			trace(2, T("SSL: read cpnv cert error\n"));
+			websSSLClose();
+			return -1;
+		}
+		for(i=0; i < sizeof(sslkey.pwd); i++)
+		{
+			if(sslkey.pwd[i] != 0)
+			{
+				sslkey.pwd[i] = sslkey.pwd[i] - DEFAULT_KEY_MASK;
+			}
+			else
+			{
+				break;
+			}
+		}
+		SSL_CTX_set_default_passwd_cb_userdata(sslctx, (void *)sslkey.pwd);
+		retCode = websSSLSetCertificate(sslctx, sslcert, sslkey.certLen);
+		if (retCode <= 0)
+		{
+			trace(2, T("SSL: websSSLSetCertificate fail ret=%d\n"),retCode);
+			websSSLClose();
+			return -1;
+		}
+		retCode = websSSLSetPrivateKey(sslctx, &sslkey);
+		if (retCode <= 0)
+		{
+			trace(2, T("SSL: websSSLSetPrivateKey fail ret=%d\n"),retCode);
+			websSSLClose();
+			return -1;
+		}
+	}
+
+	SSL_CTX_set_tmp_rsa_callback(sslctx, websSSLTempRSACallback);
+
+
+	SSL_CTX_set_verify(sslctx, SSL_VERIFY_NONE, websSSLVerifyCallback);
+
+
+	sslListenSock = socketOpenConnection6(NULL, SSL_PORT, 
+		websSSLAccept, SOCKET_BLOCK);
+
+	if (sslListenSock < 0) {
+		trace(2, T("SSL: Unable to open SSL socket on port <%d>!\n"), 
+			SSL_PORT);
+		return -1;
+	}
+
+	return 0;
+}
+
+
+
+int websSSLIsOpen()
+{
+	return (sslListenSock != -1);
+}
+
+
+
+int websSSLAccept(int sid, char *ipaddr, int port, int listenSid)
+{
+	webs_t	wp;
+	int		wid;
+
+	a_assert(ipaddr && *ipaddr);
+	a_assert(sid >= 0);
+	a_assert(port >= 0);
+
+
+	if ((wid = websAlloc(sid)) < 0) {
+		return -1;
+	}
+	wp = webs[wid];
+	a_assert(wp);
+	wp->listenSid = listenSid;
+
+	ascToUni(wp->ipaddr, ipaddr, min(sizeof(wp->ipaddr), strlen(ipaddr)+1));
+
+
+	if (gstrcmp(wp->ipaddr, T("127.0.0.1")) == 0 || 
+			gstrcmp(wp->ipaddr, websIpaddr) == 0 || 
+			gstrcmp(wp->ipaddr, websHost) == 0) {
+		wp->flags |= WEBS_LOCAL_REQUEST;
+	}
+
+	wp->flags |= WEBS_SECURE;
+
+
+	socketCreateHandler(sid, SOCKET_READABLE, websSSLSocketEvent, (int) wp);
+
+	wp->timeout = emfSchedCallback(WEBS_TIMEOUT, websTimeout, (void *) wp);
+	//trace(8, T("webs: accept request\n"));
+	return 0;
+}
+
+void websSSLClose()
+{
+	trace(7, T("SSL: Closing SSL\n")); 
+
+	if (sslctx != NULL) {
+		SSL_CTX_free(sslctx);
+		sslctx = NULL;
+	}
+
+	if (sslListenSock != -1) {
+		socketCloseConnection(sslListenSock);
+		sslListenSock = -1;
+	}
+
+	if(sslpwd != NULL) {
+		bfree(B_L, sslpwd);
+		sslpwd = NULL;
+	}
+
+#ifdef SSLC
+	SSL_library_cleanup();
+#endif
+}
+
+
+static int websSSLReadEvent (webs_t wp)
+{
+	int			ret, sock;
+	socket_t	*sptr;
+	SSL			*ssl;
+	BIO			*bio, *bioSSL, *bioSock;
+#ifdef DEV
+	const char	*ciphers;
+#endif
+
+	a_assert (wp);
+	a_assert(websValid(wp));
+
+	sptr = socketPtr(wp->sid);
+	a_assert(sptr);
+	if(sptr == NULL)
+		return -1;
+	sock = sptr->sock;
+
+	bio = BIO_new(BIO_f_buffer());
+	a_assert(bio);
+
+	if (!BIO_set_write_buffer_size(bio, 128)) {
+		return -1;
+	}
+
+	ssl = (SSL *) SSL_new(sslctx);
+	a_assert(ssl);
+
+	if (ssl == NULL) {
+		return -1;
+	}
+
+	SSL_set_session(ssl, NULL);
+
+	bioSSL =  BIO_new(BIO_f_ssl());
+	a_assert(bioSSL);
+
+	bioSock = BIO_new_socket(sock, BIO_NOCLOSE);
+	a_assert(bioSock);
+
+	SSL_set_bio(ssl, bioSock, bioSock);
+	SSL_set_accept_state(ssl);
+
+	ret = BIO_set_ssl(bioSSL, ssl, BIO_CLOSE);
+	BIO_push(bio, bioSSL);
+
+#ifdef DEV
+	ciphers = SSL_get_cipher_list(ssl, 10);
+#endif
+
+#ifdef WEBS_SSL_SUPPORT
+	websSSLFree(wp->wsp);
+	wp->wsp = balloc(B_L, sizeof(websSSL_t));
+	a_assert (wp->wsp);
+	if(wp->wsp == NULL)
+		return -1;
+	(wp->wsp)->bio = bio;
+	(wp->wsp)->ssl = ssl;
+#endif
+
+	websReadEvent(wp);
+
+	return ret;
+}
+
+static void websSSLSocketEvent(int sid, int mask, int iwp)
+{
+	webs_t	wp;
+
+	wp = (webs_t) iwp;
+	a_assert(wp);
+
+	if (! websValid(wp)) {
+		return;
+	}
+
+	if (mask & SOCKET_READABLE) {
+		websSSLReadEvent(wp);
+	} 
+	if (mask & SOCKET_WRITABLE) {
+		if (websValid(wp) && wp->writeSocket) {//cov
+			(*wp->writeSocket)(wp);
+		}
+	} 
+}
+
+static int sslVerifyDepth = 0;
+static int sslVerifyError = X509_V_OK;
+
+int websSSLVerifyCallback(int ok, X509_STORE_CTX *ctx)
+{
+	char	buf[256];
+	X509	*errCert;
+	int		err;
+	int		depth;
+
+	errCert =	X509_STORE_CTX_get_current_cert(ctx);
+	err =		X509_STORE_CTX_get_error(ctx);
+	depth =		X509_STORE_CTX_get_error_depth(ctx);
+
+	X509_NAME_oneline(X509_get_subject_name(errCert), buf, 256);
+
+	if (!ok) {
+		if (sslVerifyDepth >= depth)	{
+			ok = 1;
+			sslVerifyError = X509_V_OK;
+		} else {
+			ok=0;
+			sslVerifyError = X509_V_ERR_CERT_CHAIN_TOO_LONG;
+		}
+	}
+
+	switch (err)	{
+	case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
+#ifdef OPENSSL
+		//X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert), buf, 256);
+		X509_NAME_oneline(X509_get_issuer_name(X509_STORE_CTX_get_current_cert(ctx)), buf, 256);
+#endif
+		break;
+
+	case X509_V_ERR_CERT_NOT_YET_VALID:
+	case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
+	case X509_V_ERR_CERT_HAS_EXPIRED:
+	case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
+		break;
+	}
+
+	return ok;
+}
+
+int websSSLSetCertificate(SSL_CTX *ctx, const unsigned char *data, int len)
+{
+	BIO *in;
+	int ret = 0;
+	X509 *x = NULL;
+	
+	in = BIO_new(BIO_s_mem());
+	if (in == NULL) {
+		trace(2, T("SSL: cert BIO_new NULL\n"));
+		goto end;
+	}
+
+	ret = PEM_write_bio(in, PEM_STRING_X509, "", data, len);
+	if (ret <= 0){
+		trace(2, T("SSL: cert PEM_write_bio fail ret=%d\n"),ret);
+		goto end;
+	}
+	x = PEM_read_bio_X509(in, NULL,
+			SSL_CTX_get_default_passwd_cb(ctx),//ctx->default_passwd_callback,
+			SSL_CTX_get_default_passwd_cb_userdata(ctx));//ctx->default_passwd_callback_userdata);
+
+	if (x == NULL) {
+		trace(2, T("SSL: cert PEM_read_bio_X509 NULL\n"));
+		goto end;
+	}
+
+	ret = SSL_CTX_use_certificate(ctx, x);
+	X509_free(x);
+
+ end:
+	if (in != NULL)
+		BIO_free(in);
+	return (ret);
+}
+
+int websSSLSetPrivateKey(SSL_CTX *ctx, websSSLKey *key)
+{
+	int ret = 0;
+	BIO *in;
+	EVP_PKEY *pkey = NULL;
+	const char *objstr = NULL;
+	char buf[PEM_BUFSIZE] = {0};
+	
+	in = BIO_new(BIO_s_mem());
+	if (in == NULL) {
+		trace(2, T("SSL: key BIO_new NULL\n"));
+		goto end;
+	}
+
+	objstr = OBJ_nid2sn(key->dekType);
+	if (objstr == NULL) {
+		trace(2, T("SSL: key OBJ_nid2sn NULL type = %d\n"),key->dekType);
+		goto end;
+	}
+	PEM_proc_type(buf, key->procType);
+	PEM_dek_info(buf, objstr, sizeof(key->dekInfo), (char *)key->dekInfo);
+
+	ret = PEM_write_bio(in, PEM_STRING_RSA, buf, key->privateKey, sizeof(key->privateKey));
+	if (ret <= 0){
+		trace(2, T("SSL: key PEM_write_bio fail ret=%d\n"),ret);
+		goto end;
+	}
+	pkey = PEM_read_bio_PrivateKey(in, NULL,
+			SSL_CTX_get_default_passwd_cb(ctx),//ctx->default_passwd_callback,
+			SSL_CTX_get_default_passwd_cb_userdata(ctx));//ctx->default_passwd_callback_userdata);
+	if (pkey == NULL) {
+		trace(2, T("SSL: key PEM_read_bio_PrivateKey NULL\n"));
+		goto end;
+	}
+	ret = SSL_CTX_use_PrivateKey(ctx, pkey);
+	EVP_PKEY_free(pkey);
+	
+ end:
+	if (in != NULL)
+		BIO_free(in);
+	return (ret);
+}
+
+
+int websSSLSetCertStuff(SSL_CTX *ctx, char *certFile, char *keyFile)
+{
+	a_assert (ctx);
+	a_assert (certFile);
+
+	if (certFile != NULL) {
+		if (SSL_CTX_use_certificate_file(ctx, certFile, 
+			SSL_FILETYPE_PEM) <= 0) {
+			trace(2, T("SSL: Unable to set certificate file <%s>\n"),
+				certFile); 
+			return -1;
+		}
+
+		if (keyFile == NULL) {
+			keyFile = certFile;
+		}
+
+		if (SSL_CTX_use_PrivateKey_file(ctx, keyFile, SSL_FILETYPE_PEM) <= 0) {
+			trace(2, T("SSL: Unable to set private key file <%s>\n"),
+				keyFile); 
+			return -1;
+		}
+
+
+		if (!SSL_CTX_check_private_key(ctx)) {
+			trace(2, T("SSL: Check of private key file <%s> FAILED!\n"),
+				keyFile); 
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
+
+int websSSLSetKeyFile(char_t *keyFile)
+{
+	a_assert (sslctx);
+	a_assert (keyFile);
+
+	if (sslctx == NULL) {
+		return -1;
+	}
+
+	if (SSL_CTX_use_PrivateKey_file(sslctx, keyFile, SSL_FILETYPE_PEM) <= 0) {
+		return -1;
+	}
+
+	if (!SSL_CTX_check_private_key(sslctx)) {
+		return -1;
+	}
+
+	return 0;
+}
+
+
+int websSSLSetCertFile(char_t *certFile)
+{
+	a_assert (sslctx);
+	a_assert (certFile);
+
+	if (sslctx == NULL) {
+		return -1;
+	}
+
+	if (SSL_CTX_use_certificate_file(sslctx, certFile, 
+		SSL_FILETYPE_PEM) <= 0) {
+		return -1;
+	}
+
+	if (!SSL_CTX_check_private_key(sslctx)) {
+		return -1;
+	}
+
+	return 0;
+}
+
+#ifdef SSLC
+extern RSA *RSA_new(void);
+#endif
+
+int websSSLEof(websSSL_t *wsp)
+{
+	a_assert(wsp);
+
+	if ((wsp == NULL) || (wsp->bio == NULL)) {
+		return -1;
+	} 
+
+	return BIO_eof(wsp->bio);
+}
+
+
+int websSSLRead(websSSL_t *wsp, char_t *buf, int len)
+{
+	a_assert(wsp);
+	a_assert(buf);
+
+	if ((wsp == NULL) || (wsp->bio == NULL)) {
+		return -1;
+	} 
+
+	return BIO_read(wsp->bio, buf, len);
+}
+
+static RSA *websSSLTempRSACallback(SSL *ssl, int isExport, int keyLength)
+{
+	static RSA *rsaTemp = NULL;
+
+	if (rsaTemp == NULL) {
+
+#ifdef OPENSSL
+		rsaTemp = RSA_generate_key(keyLength, RSA_F4, NULL, NULL);
+#endif
+
+#ifdef SSLC
+		rsaTemp = RSA_new();
+#endif
+
+	}
+
+	return rsaTemp;
+}
+
+
+int websSSLFree(websSSL_t *wsp)
+{
+	if (wsp == NULL) {
+		return -1;
+	}
+
+	if (wsp->ssl != NULL) {
+		SSL_set_shutdown(wsp->ssl, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
+	}
+
+	if (wsp->bio != NULL) {
+		BIO_free_all(wsp->bio);
+	}
+
+	bfree(B_L, wsp);
+
+	return 0;
+}
+
+
+
+
+#define BUF_BLOCK 256
+
+int websSSLGets(websSSL_t *wsp, char_t **buf)
+{
+	int		rc,	len, lenBuf;
+	char	c;
+
+	a_assert(wsp);
+	a_assert(buf);
+
+	lenBuf = 0;
+	len = 0;
+
+	if ((wsp == NULL) || (wsp->bio == NULL)) {
+		return -1;
+	} 
+
+	while (len < 1536) {
+
+		if ((rc = BIO_read(wsp->bio, &c, 1)) < 0) {
+			return rc;
+		}
+		
+		if (rc == 0) {
+
+			if (len > 0 && BIO_eof(wsp->bio)) {
+				c = '\n';
+			} else {
+				return -1;
+			}
+		}
+
+		if (c == '\n') {
+			if ((len > 0) && (len < lenBuf)) {
+				(*buf)[len] = 0;
+			}
+			return len;
+		} else if (c == '\r') {
+			continue;
+		} 
+
+		if (lenBuf == 0 || len >= lenBuf - 1) {
+			lenBuf += BUF_BLOCK;
+			*buf = brealloc(B_L, *buf, lenBuf);
+		}
+
+		a_assert(*buf);
+		if(*buf == NULL)
+			return -1;
+		(*buf)[len] = c;
+		len++;
+	}
+	bfreeSafe(B_L,*buf);
+	*buf = NULL;
+	return -1;
+}
+
+
+int websSSLWrite(websSSL_t *wsp, char_t *buf, int len)
+{
+	a_assert(wsp);
+	a_assert(buf);
+
+	if ((wsp == NULL) || (wsp->bio == NULL)) {
+		return -1;
+	} 
+
+	return BIO_write(wsp->bio, buf, len);
+}
+
+
+int websSSLFlush(websSSL_t *wsp)
+{
+	a_assert(wsp);
+
+	if ((wsp == NULL) || (wsp->bio == NULL)) {
+		return -1;
+	} 
+
+	return BIO_flush(wsp->bio);
+}
+
+#endif